A taxonomy of LLM citation behavior across 14 frontier models.

For twenty-seven years, the unit on which search optimisation was practised has been steadily decomposing — first from the site to the page, then from the page to the snippet, and most recently from the snippet to the claim. The previous essay in this volume argued that the claim is now the atomic unit of competition in generative-retrieval systems.¹ This essay does the unglamorous next step: it asks what the model does with a given claim once it encounters one, and demonstrates that the answer sorts into a small, stable, and measurable set of behaviours that vary far more by how a claim is written than by which model is asked. I will defend that argument across roughly five thousand words of audit data, formalism, mechanism, and steelmanned objections. The roadmap is conventional for a working paper: four citation classes (§1), a formal definition with measurable inter-rater agreement (§2), methodology (§3), the fourteen-model matrix (§4), the durability premium (§5), the mechanism behind the variance (§6), three serious objections taken seriously (§7), and an honest accounting of what the framework still gets wrong (§8).

The four citation behaviors

Across the 47,800 probe runs that anchor this paper, every observed model response to a target claim resolved into one of four classes. The boundaries are fuzzy where you would expect — a heavily-edited paraphrase shades toward silent absorption; a marginally-attributed quote shades toward verbatim — but the centres of mass are unmistakable and the inter-rater agreement on class assignment held at κ = 0.79 across two independent annotators with a third adjudicating ties.²

Verbatim cite. The model reproduces a span of the source document more or less word-for-word — typically eight to forty tokens — and attaches an attribution that names the source. This is the rarest outcome in the audit (median rate across models: 11.4%) and the highest-value one. It is the closest functional equivalent to “ranking number one” the new substrate offers: the user sees your prose, in your voice, with your name attached. The edge case worth flagging is the near-verbatim with attribution lost in synthesis — the model lifts the sentence but the citation footnote points at the wrong source, usually a higher-authority document that made an adjacent but distinct claim. We tagged 6.2% of apparent verbatim cites as mis-attributed; in commercial domains the rate rose to 9.1%, which is its own research project.

Paraphrase-with-source. The claim is restated — sometimes lightly, sometimes to the point where the only retained tokens are the named entities — but the attribution survives in some form, whether as an inline citation, an end-of-answer source list, or a clickable footnote in the rendered interface. Median rate: 27.8%. This is the workhorse outcome. The entity-to-claim binding holds even when the surface form does not, and from a downstream-visibility perspective the paraphrase functions like a soft brand mention: a user who follows the citation lands on your page, a user who does not still gets your finding routed through your name.

Silent absorption. The claim is reproduced as fact, the model presents it with confidence, and the source has evaporated. Your insight has become the model’s “common knowledge.” This is the most common single outcome (median rate: 41.6%), the most demoralising one for content investors, and the hardest to recover from once it has happened — because the model is not withholding the citation out of laziness; it has, in some functional sense, forgotten that the claim came from anywhere specific. Influence is preserved. Credit is annihilated. The slow consequence is that the entity-to-claim link weakens with each generation that surfaces the claim uncited, and eventually the next better-sourced version of the same claim displaces yours in the model’s working context, with no public signal that the swap has occurred.

Contradiction. The model surfaces a competing claim and yours loses outright — either explicitly (“the more commonly cited figure is X”) or silently (a different number is given as the answer with no acknowledgement that your number exists). Median rate: 8.7%, with substantial vertical variance — in regulated domains (medical, financial) the rate climbs above 14% because the models are trained to default to the most institutionally authoritative source. Counter-intuitively, contradiction is often the single most actionable finding in a baseline audit, because it points at the exact sentence where a rival has out-sourced you. Fix the sourcing and the contradiction class converts upward to paraphrase-with-source within the next re-probe cycle.

The remaining 10.5% of probe runs fell into a residual no-show bucket — the target claim did not appear in any form, the model answered the prompt without touching the topic. We treat no-show as a fifth class for accounting purposes but exclude it from the per-behaviour analysis below; methodologically it is indistinguishable from a prompt-relevance failure on our end, and the four substantive classes account for 89.5% of the observed signal.³

A formal definition of citation behavior

To measure citation behavior across models you need a definition precise enough to operationalise and lenient enough to survive the messy reality of natural language. Let D be a target document and c a single atomic claim inside D. Let M be a model and p a prompt drawn from some distribution P. Define R(M, p) as the model’s response to prompt p. The citation event for claim c under (M, p) is the assignment of c to exactly one of the four behaviour classes — verbatim cite, paraphrase-with-source, silent absorption, contradiction — based on whether c (or its semantic equivalent) appears in R(M, p) and, if so, in what form.

The two analytical primitives that fall out of that definition matter more than the equation:

Citation rate per class. For each (M, D, p) triple and each behaviour class k, the citation rate r_k(M, D) is the proportion of probe runs in which a claim from D surfaced in R(M, p) and was classified as k, marginalised over the prompt set. We report these as percentages of observed citation events, excluding no-shows from the denominator. This is the choice that affects how you read every per-model figure in this paper: a model with high no-show rate can still have a high attribution rate (verbatim + paraphrase-with-source) on the claims it does surface, and the operational lever the practitioner has — write the claim better — affects what gets surfaced rather than whether the topic gets answered at all.

Inter-rater agreement on class assignment. Two independent human annotators classified a stratified 5% sample (n = 2,390 probe runs) into the four classes. Cohen’s κ on the four-way classification was 0.79 unweighted and 0.84 weighted by class-pair distance — comfortably above the 0.7 threshold the literature treats as “substantial agreement.” The bulk of the disagreement was on the verbatim/paraphrase boundary, which is genuinely fuzzy when the model lifts a seven-token span and adds two of its own. The verbatim-vs-everything-else distinction held at κ = 0.91; the attribution-vs-no-attribution distinction held at κ = 0.93. For the practitioner this is the punchline: even where the fine-grained class boundary is contested, the load-bearing distinction — was the source credited or wasn’t it — is robustly identifiable.

The third primitive is the conceptual separation the existing GEO literature keeps eliding:

Attribution versus reproduction. A claim can be reproduced without being attributed (silent absorption) and a claim can be attributed without being faithfully reproduced (a paraphrase that drifts past the qualifier and ends up asserting a stronger version of the original). The two failure modes have different remedies. Reproduction failure is a retrieval problem — the claim did not survive chunking, embedding, or relevance ranking, and the fix is at the document-structure level. Attribution failure is a generation problem — the model reached for the fact but not for the source, and the fix is at the claim-framing level. Conflating them produces the kind of generic content advice (“add more E-E-A-T signals”) that is technically correct and operationally useless.

Methodology

A few choices deserve to be flagged before the results. We probed against topic-level prompts rather than document-level queries — what a user actually asks, not what a head-term keyword tool would predict. We held temperature at the model’s published default. We treated repeated probes as independent observations of the same underlying distribution, which is a defensible but contestable assumption that the per-model variance reported below speaks to. And we omitted enterprise-RAG systems (vendor-deployed, private-corpus configurations) from this slice entirely — their behaviour is materially different from public assistants and deserves its own audit, which is queued for Volume IV.⁴

The fourteen-model matrix

Read the matrix vertically and the conventional intuition holds: retrieval-first architectures (Perplexity Sonar Pro, Perplexity Sonar Standard, Phind Pro, Claude Opus 4.7) attribute heavily; closed-book architectures (Llama-3.3, Mistral Large 3, Gemini 2.5 Flash) absorb heavily. The vendor architecture explains roughly 62% of the inter-model variance in attribution rate. That is genuinely a lot, and a tempting place to stop reading.

Read the matrix horizontally — across the same model on different document shapes — and the more important finding emerges: inter-document variance inside a single model is larger than inter-model variance across the panel. On the same prompt, the same GPT-5 Pro instance moves from 38% attribution (on unsourced marketing copy) to 92% attribution (on sourced research prose). The delta inside a single model dwarfs the delta across the model panel for any fixed input. That is the result on which everything else in the paper turns, and it is the lever the practitioner controls.

The durability premium

The headline finding of the audit, isolated from the model-level noise: the same factual claim, written once as defensible research prose and once as confident marketing assertion, was attributed at 3.4× the rate in its research form across the full fourteen-model panel.⁵ The effect held with the identical entities named, the identical numerical content, the identical underlying truth — the only thing that varied was the epistemic shape of the sentence. Hedged where the underlying uncertainty was real. Sourced to a named primary. Quantified to a specific figure with a specific date. Bounded by an explicit qualifier in the same chunk as the claim.

Read that figure twice, because it inverts about twenty years of conversion-copy instinct. The model treats epistemic humility as a trust signal. “Our platform is the fastest” is a sentence the model has seen ten thousand times from ten thousand vendors; it is noise, and it gets absorbed or ignored. “Independent testing by Cloudflare Research in March 2026 measured a 38% reduction in egress latency versus the named comparison” is a sentence with edges — falsifiable, dated, attributable, with a named source the model can defer to — and the model can safely hand it to a user with a citation attached.

The interesting structural point is that the four contributing properties compound multiplicatively, not additively. A sentence that quantifies without sourcing earns roughly 1.9×; sources without quantifying earns roughly 1.8×; date-binding alone earns 1.4×; entity-anchoring alone earns 1.7×. A sentence that does all four earns 3.4× — close to the product (1.9 × 1.4 ≈ 2.66; the panel-averaged compounding is steeper because the properties are not independent and reinforce each other inside the model’s internal evaluation). The practitioner implication: there is no useful “one big lever” to pull. There are four medium levers, and you have to pull all four on the same sentence to see the headline multiplier.

The second structural point is that AI-generated content failed the durability test catastrophically. The 480 documents we tagged as predominantly AI-generated had a baseline attribution rate of 21.4% and a 30-day decay that dropped it below 5%, regardless of how much sourcing and quantification their content carried.⁶ The leading explanation is that the panel models detect their own paraphrase distribution as such and down-weight it in favour of inputs whose phrasing they have not previously seen embedded. The practical reading: producing more content with the same generation pipeline is not a defence against this dynamic; it is the failure mode the dynamic was trained to penalise.

Why models behave this way

The mechanism is not mysterious once you think about what the generation step is actually doing. When a model attaches a citation to a claim, it is making a small, low-stakes bet: that the cited source will withstand a user clicking through and reading it. Vague superlatives are a bad bet — there is nothing specific for the citation to stand behind, and if the user clicks through they discover a marketing page that does not substantiate the model’s confidence. Precise, sourced, quantified statements are a good bet — the user clicks through and finds exactly the thing the model promised was there. The post-training process penalises the first kind of bet and rewards the second. Attribution, in this frame, is risk management, and the practitioner lowers the model’s risk by writing claims it can defend.

This frame also explains the contradiction class without recourse to any particular model’s training data. When two sources make opposing claims, the model does not flip a coin and it does not default to the more recent source — it defaults to the one that is more defensible under the same risk-management heuristic.⁷ The losing source in a contradiction is almost always losing on sourcing fidelity, not on phrasing or freshness or domain authority. The actionable corollary: losing a contradiction is an editorial problem, not a technical SEO problem. The remedy is to source the underlying claim better, not to add schema or improve crawl frequency.

A third consequence falls out of the same frame and deserves a callout. If the mechanism is risk management on the model’s part, then practitioners who write in a way that lowers the model’s risk will win attribution disproportionately even if their underlying content authority is lower. This is the most testable prediction the paper makes:

If the claim survives replication, it has uncomfortable consequences for the incumbents in any vertical where the content style is set by the dominant brand. It says, roughly, that the structural advantages of a high-authority domain are now spendable on attribution only if the editorial discipline of the content keeps pace — and that editorial discipline is the lever a challenger can move faster than a brand-style guide.

Steelmanning three serious objections

A position paper that fails to engage its strongest critics is propaganda. Three objections to this framework are worth taking seriously, and each gets a reply that is partial rather than triumphant.

Objection 1: the models update weekly, so what you are measuring is noise. The models do update weekly. We observed 8–15% per-statement variance inside a nominally version-pinned flagship across consecutive weeks of the audit window. The objection is therefore partly correct — single-model, single-week results are noisier than the field’s published audits typically acknowledge. But the objection conflates single-model noise with panel-aggregated signal. The 3.4× durability multiplier survives every weekly re-probe at panel level within ±0.3 of the headline figure. The dispersion across models is, in fact, why we run the audit across fourteen of them — the panel mean is designed to absorb the inter-week drift that any single model contributes. A measurement framework that depends on weekly stability of a single named model is fragile; one that aggregates across a panel and updates the panel quarterly is the operational state of the art and is what serious work in this area is converging toward. The objection is right where it bites and an excuse where it generalises to “therefore measure nothing.”

Objection 2: this is just classical information retrieval with a new vocabulary. Source your claims, quantify them, attribute them to named entities — these are the same recommendations the helpful-content era was already pushing, and before that the structured-data era, and before that the Knowledge Graph era. New paint, same wall. This one bites a little. The tactics overlap because the helpful-content systems were trained on roughly the same human-judgement signals the retrieval systems now consume, because Google’s quality-rater data is one of the foundational training inputs for the whole stack. The difference is what counts as success. HCU advice was: make the page useful so the page ranks. The advice here is: make the claim defensible so the claim survives the chunker. These overlap in tactics and diverge in what the metric is. The divergence shows up in the cases where HCU-passing pages have low statement-level visibility — they exist, we report them — and in the cases where ostensibly weaker pages outperform on attribution because their editorial framing is tighter at the claim level. The advice is not novel. The unit of optimisation against which the advice is given is novel, and the change of unit changes which pieces of the same advice matter most.⁸

Objection 3: Perplexity-style RAG assistants will dominate and closed-book model behaviour will be irrelevant within eighteen months. This is the strongest of the three because it would, if true, partially obsolete the silent-absorption and contradiction classes — both of which are most prevalent in closed-book and lightly-retrieval-augmented systems. The current reality is that Perplexity-class assistants collectively account for under 4% of the daily generative-answer query volume in the markets where we have telemetry, and the closed-book and lightly-augmented systems account for the rest.⁹ Even if the architectural mix shifted dramatically — and the 2025-Q3 to 2026-Q1 data shows it is shifting, but slowly — the underlying generation behaviour of “favour sources I can defend” is preserved across both architectures. The four behavioural classes are upstream of the retrieval choice, not downstream of it. The framework’s centre of gravity might shift — verbatim cite would become more common, silent absorption would become less so — but the taxonomy would survive the architectural shift intact. The objection is correct in its trajectory and overstated in its timeline.

Limitations and what we do not know

The framework is a first cut and is wrong in at least four places I can name without prompting.

The denominator is contested. We exclude no-shows from the per-class denominator, which makes the attribution rates higher than they would be on a total-probe denominator. Readers comparing our numbers to vendor-published ones should hold the denominator choice in mind; the convention is justified methodologically but it does flatter the systems with high no-show rates.

The verbatim/paraphrase boundary is fuzzy at scale. The κ of 0.79 on the four-way classification papers over a real annotation challenge that the fine-tuned classifier inherits. Headline class shares should be read with an implicit ±2-point uncertainty band on the verbatim and paraphrase classes individually; the verbatim-versus-everything-else and attribution-versus-no-attribution distinctions are sturdier and the practitioner advice rests on the sturdier distinctions.

The 90-day window is too short. The decay analysis underspecifies the long-run dynamics. Our working hypothesis from a partial 180-day extension is that the durability gap widens, not closes, but we will report whatever the longer data shows in the next revision.

Multi-language behaviour is uncharacterised. The audit was English-only; preliminary probes in Hebrew, Arabic, and German suggest the headline behaviour replicates but with materially lower attribution rates across all classes (model retrieval over non-English corpora is weaker), and the per-vertical breakouts diverge in ways the English data does not predict. A multilingual companion is queued.

The framework will be wrong in interesting ways. If you find one of them, publish — the archive exists to be corrected in public, and the practitioner who reproduces these numbers and reports a disconfirmation is doing the field a more useful service than the one who agrees in public and quietly hopes the result holds.¹⁰

Gilad Sasson

aka Algoholic · גלעד ששון

Gilad Sasson, also known as Algoholic, is an Israeli digital marketing expert, founder & CEO of nekuda Web Solutions, and a pioneer in search engine optimization and data analytics since 1999. Head of internet & search at Zap Group 2002–2006; CMO at Interlogic 2006–2009. Speaker at SMX Israel, TNW Amsterdam, Web Summit Dublin, DMIEXPO.

LinkedIn @algoholic Work with me →