SafeLLM (Extraction over Rewriting): Line Numbering as a Shield Against Hallucinations When Working with Documents

All four strategies — from simple to complex:

STRATEGY 1 — COPY (Verbatim copying)
  Prompt: Copy verbatim the sentences that answer the question.
  Ban: don't paraphrase, don't add anything of your own.
  → Output: a set of sentences from the document

STRATEGY 2 — LINES (Line selection) ← BEST RESULT
  STEP 1: Number every line of the document (1, 2, 3...)
  STEP 2: The LLM picks the minimal set of line numbers
  STEP 3: You pull those lines from the original by hand
  → Output: a list of numbers (e.g., 4, 17, 23, 31)
  → Guarantee: the answer contains only original text, not a word from the model

STRATEGY 3 — SAFETY (Extraction with role labels)
  The LLM copies sentences + tags each one with a label:
    - answers_question (answers directly)
    - adds_required_detail (clarifies)
    - safety_critical (critical, must not be skipped)
  → Output: a labeled list of sentences from the document

STRATEGY 4 — JUNIOR (Two-agent workflow)
  AGENT 1: answers the question from memory, without the document
           → a draft answer with specifics (thresholds, numbers, steps)
  AGENT 2: compares the draft against the document
           → copies sentences that support, refine
           or correct the draft
  → Output: verified lines from the source

All four strategies work in a single chat — no code, just prompt structure.

The task: You sell products on Amazon. You want to know what happens if your product is damaged in shipping — who's liable and what the deadline is for filing a claim. The seller agreement runs 47 pages and you don't have time to read it.

Prompt (LINES strategy — two steps):

STEP 1 — send this message:

Number every line of the following text.  
Format: [number] line text  
Each line gets its own number, even if it's a single word.

[paste the section of the agreement about liability and shipping]

---

STEP 2 — once you have the numbered text, send:

Here is the numbered text of the agreement. 
Question: who is liable for damage to goods during shipping, 
and what is the deadline for filing a claim?

Rules:
- Return ONLY the numbers of the lines that answer the question
- The minimum necessary set — no more
- No explanations, no text of your own
- Format: a comma-separated list of numbers

[paste the numbered text from step 1]

Result:

The model will return something like: 12, 13, 34, 35, 36, 51. You open the numbered text from step one, copy out those lines — and get the exact answer from the agreement. Word for word. No one else's words.

If you use the SAFETY strategy, you'll also see labels: which lines answer directly, which add detail, and which are flagged as "must not skip." Handy for checking important terms.

An LLM is a next-word predictor, not a photocopier. When you ask "tell me what it says," the model generates text that is probably right. It doesn't quote — it composes a plausible continuation. Even with the document right in front of it, the model "blends" it with what it knows from training. That's the hallucination: not an invention from scratch, but an invisible blend.

LLMs are good at classifying and matching. Saying "here are 100 lines, which ones answer the question?" is a fundamentally different task from "write an answer." In the first case the model chooses from what's already there. In the second, it generates. Choosing is more accurate.

LINES closes the gap completely: the model returns only numbers. The text is assembled from the original mechanically — the LLM physically can't add a single word of its own. That's not a quality limitation — it's a guarantee of accuracy. The study showed up to 95% agreement with correct answers on medical terms.

Control levers: - COPY strictness → add "if unsure, leave it out" to raise precision, at the cost of some misses - Chunk size in LINES → if the document is long, first ask it to pick a section, then the lines within it - Roles in SAFETY → add your own label, e.g. must_read_before_signing for legal terms - Agents in JUNIOR → give Agent 1 a specific role (lawyer, accountant) for a sharper draft

COPY strategy — quick start:

Below is a document. Answer the question using ONLY verbatim 
sentences from the document.

Rules:
- Copy whole sentences without changes
- Don't paraphrase, don't summarize, don't add context of your own
- If a needed sentence is long, copy it in full
- If the answer isn't in the text, write "not found in the document"

Question: {your question}

Document:
{paste the document text}

LINES strategy — maximum accuracy:

TEMPLATE (two requests):

── REQUEST 1 ──
Number every line of the text below.
Numbering format: [N] line text
Number every line, including short ones.

{paste the document or section text}

── REQUEST 2 (after you get the numbered text) ──
Here is the numbered text.
Question: {your question}

Instructions:
- Return only the numbers of the lines needed to answer
- Pick the minimal sufficient set
- No text of your own — numbers only
- Format: comma-separated numbers

{paste the numbered text from request 1}

SAFETY strategy — with importance labels:

Below are a document and a question. Pick the minimal set of sentences 
that answer the question and contain important conditions.

For each sentence, state its role:
- answers_question — directly answers the question
- adds_required_detail — a necessary clarification
- critical — must not be skipped; an important condition or restriction

Rules:
- Copy sentences verbatim, without changes
- Keep the original order
- Don't add words of your own — only labeled quotes

Output format:
[role] "sentence from the document"

Question: {your question}

Document:
{paste the text}

Placeholders: - {your question} — a specific question about the document - {paste the document text} — the copied text (contract, policy, manual)

🚀 Quick start — paste into the chat:

I have a document and I want an exact answer without the model 
rewording anything. Help me adapt one of the SafeLLM templates 
to my task: {describe the task}.

Ask me clarifying questions.

[paste the template above]

The LLM will ask what document and what question — because the strategy depends on the task type: LINES is best for legal precision, SAFETY for understanding structure, COPY for quick lookups.

⚠️ Document length: LINES works worse on very long, structurally uneven documents (narrative text rather than protocols). The more "free-form" the document's language, the lower the accuracy of line selection.

⚠️ Context window: A numbered document takes up more tokens than the original. For very long documents (10,000+ words), split them into parts first and query section by section.

⚠️ Synthesis questions: If a question requires combining information from different parts of the document ("compare conditions X and Y"), LINES gives an incomplete result. It selects lines; it doesn't build connections between them.

⚠️ The SAFETY strategy cuts completeness: The "minimal set" requirement makes the model skip important details. In almost all models, Safety gives higher precision but more misses than LINES.

⚠️ The numbering step is manual: If you have a PDF or a scan, you need to copy the text first. Tables and visual elements don't carry over — text only.

A team from UCL and the NHS took three types of clinical documents: short acute-care protocols (UCLH, ~750 words), mid-length oncology guidelines (Somerset, ~3,150 words) and national NICE guidelines (~5,200 words). A 7x spread in length — which matters a lot, because different strategies behave differently depending on the structure of the text.

Each document was tested with 50–500 questions. The four strategies (COPY, LINES, SAFETY, JUNIOR) were compared against baseline RAG (semantic search over chunks). They measured not only word-level accuracy but also accuracy on medical terms — because errors in terms are what's dangerous (dose, contraindication, escalation threshold). In parallel, three clinical experts rated the answers manually on "relevant" and "complete."

The surprise: LINES beat SAFETY even in scenarios Safety was specifically designed for. The reason is simple: the requirement "pick only the critical sentences" forces the model to make judgment calls about what matters — and it gets them wrong. LINES makes no such calls at all: pick the lines, reproduce them verbatim, done. Fewer model decisions = fewer model mistakes.

From the strategy descriptions (the original has the verbatim prompts in Listings 3-6):

LINES strategy (description):

The guideline text is augmented with line numbers and provided to 
the model together with the user question. The model is then tasked 
with identifying the minimal set of line numbers required to answer 
the question. The final answer is reconstructed deterministically 
by retrieving the corresponding guideline lines in post-processing. 
This approach enforces tighter control over the extracted content 
and guarantees the absence of hallucinated text, as the output 
consists exclusively of selected guideline line numbers.

SAFETY strategy (description):

The model is prompted to select the smallest subset of full sentences 
that (i) directly answer the question and (ii) include any 
safety-critical information. Each selected sentence is annotated with 
a single reason label indicating its role in the response: 
answers_question, adds_required_detail, or safety_critical. 
Sentences must be copied verbatim from the guideline, paraphrasing 
is not allowed, and the original order must be preserved.

Context: Strategy descriptions from the Methods section. The listings with the exact prompts (Listings 3–6) are in the original but weren't included in the excerpt of the paper we had.

💡 Adaptation: LINES for legal documents

Same mechanics, different context — reviewing a contract before signing:

REQUEST 1:
Number every line of this contract. Format: [N] line text.

[contract text]

REQUEST 2:
Here is the numbered contract.
Questions:
1. What conditions allow either party to terminate the contract unilaterally?
2. What is the penalty for late payment?
3. Is there an automatic renewal?

Return only the line numbers for each question.
Format:
Question 1: [numbers]
Question 2: [numbers]  
Question 3: [numbers]

[numbered text]

🔧 Technique: SAFETY with custom labels → prioritizing terms

What changes: standard roles (answers_question / safety_critical) → labels tailored to your task.

Effect: the model categorizes by your logic, not a generic one.

Annotation rules for a lease agreement:
- deal_breaker — a term that means the lease must not be signed
- negotiate — can be discussed with the landlord  
- ok — a standard term, accept as is
- unclear — needs a lawyer's advice

🔧 Technique: JUNIOR for analyzing complex regulations

What changes: Agent 1 answers "off the top of its head" → surfaces discrepancies with the document.

Useful when you need to understand what changed in a new version of the rules:

AGENT 1: In your view, how do product returns on online 
marketplaces work under the general rules? Be specific: deadlines, who 
pays the costs, valid grounds.

AGENT 2: Here is the official document. Find the sentences that 
confirm, refine or CONTRADICT Agent 1's answer. 
Copy them verbatim. Mark contradictions: [DISCREPANCY].

[paste the document]

This works especially well for uncovering "non-obvious" terms — the ones people usually miss.

Paper title: SafeLLM: Extraction as a Hallucination-Resistant Alternative to Rewriting in Safety-Critical Settings

Authors: Julia Ive, Felix Jozsa, Evridiki Georgaki, Nabeel Sheikh, Emma Cattell, Nick Jackson, Paulina Bondaronek, Ciaran Scott Hill, Richard Dobson

Institutions: Institute of Health Informatics, University College London; National Hospital for Neurology and Neurosurgery (Queen Square); Somerset NHS Foundation Trust; King's College Hospital; King's College London