A field report from the AI x physics workbench
I built a QA system that may only answer from Edward Witten's papers, and then measured it until it told the truth about itself.
Like many people in my field, I have been asking LLMs physics questions and watching them confidently hallucinate about hep-th. Part of the reason is structural. The literature is uneven: foundational papers sit right next to wildly speculative ones. A model trained on the whole web has no way to weight one over the other. For technical questions, I do not just want a fluent model. I want one that knows when it is allowed to speak.
So I spent some weekends building one, and then measured it until I trusted the numbers. The bet: for expert domains, corpus quality and epistemic constraint may matter as much as model size.
For readers coming from the AI side: Edward Witten is widely considered the most influential theoretical physicist of the past half century. He shaped quantum field theory, string theory, and countless other fields in theoretical physics, and he is the only physicist ever awarded the Fields Medal, the top prize in mathematics. There is a standard joke among physics students: if you took a sip of water every time Witten's name came up in a graduate course or a seminar, you would drown. His collected papers are close to a fifty-year map of modern theoretical physics, written to an unusually high standard.
So the corpus is the highest-signal one I can think of. 293 of Witten's papers, spanning 1976–2026. Not his complete works: it is every paper my pipeline could actually fetch. 48 of them are pre-arXiv journal papers, dug out through an INSPIRE / Unpaywall fallback chain, some via OCR (1980s scans don't love being parsed). On top of that, one rule: answer only from retrieved passages, cite every claim by paper ID, refuse when unsupported. Cite or fail.
For physics readers, the mechanics in one breath: cut the papers into short passages, and give each passage a vector fingerprint. For each question, fetch the eight nearest passages and hand them to a language model, with the rule above. This pattern is called RAG (retrieval-augmented generation). The opposite mode, a model answering from whatever stuck during its training, is called closed book. Both show up in the tables below.
The retrieval half is standard and deliberately boring (BGE embeddings, exact FAISS search, all local and free). The interesting parts are the instruments around it. A validator checks every citation in an answer against the passages that were actually retrieved. A guardrail runs the validator live: if a draft answer cites a paper that was not retrieved, or cites nothing, the draft goes back with a correction note and the model tries again. A refusal gate can reject a question before the model speaks at all. And an expert-scored evaluation set. There is a browser demo of the retrieval half on this site (paste your own API key and it will also write guardrail-checked answers). The full pipeline is on GitHub.
To measure anything, I needed a gold set: physics questions with known correct answers and known correct citations. I drafted 24 with a frontier model plus my own judgment. Then I did something that felt pedantic but became the most important step of the project. I wrote a resolver that checks every expected citation against the actual index.
Five of the 24 cited papers were not in the corpus. And these are not obscure papers: the positive energy theorem proof, Supersymmetry and Morse Theory, the 1988 TQFT paper. My memory of the literature said "obviously in the corpus". The corpus said no. They were pre-arXiv, and my ingestion had missed them. I hand-ingested the missing papers instead of dropping the questions. Lesson one: validate the gold set against the corpus, not against your memory of the literature.
The same thing happened with the refusal probes, in the other direction. I wrote 26 questions that should be unanswerable from the corpus: experimental values, other authors' theorems, made-up follow-up papers. A calibration run flagged 7 as suspicious. It was right twice. The corpus really does discuss Perelman's Ricci-flow program, in a 2024 sigma-model paper I had forgotten about. One "unanswerable" probe was even promoted into a gold question. Benchmarks are wrong in both directions until something mechanical audits them.
Baseline: qwen2.5:7b, an open model small enough to run on my laptop (7B: seven billion parameters, small by today's standards). 23 gold questions, three conditions: closed book (memory only), RAG with nothing enforced (naked), and RAG with the guardrail. The citation columns are computed by the validator. Correctness and refusal are 0–2 scores, graded by me. (An independent second-model review pass triaged the 69 answers first, and caught several holes in my rubric.)
| condition | ungrounded cites ↓ | uncited ↓ | cite recall ↑ | correctness ↑ (of 2) | refusal ↑ (of 2) |
|---|---|---|---|---|---|
| closed book | 0.17 | 0.83 | 0.05 | 0.16 | 1.25 |
| RAG, naked | 0.09 | 0.91 | 0.00 | 0.42 | 0.00 |
| RAG + guardrail | 0.00 | 0.00 | 0.64 | 0.53 | 0.00 |
Ungrounded cites: share of answers citing a paper that was not retrieved (some are real papers cited from memory, some are invented IDs; the checker treats both the same). Uncited: share citing nothing at all. Cite recall: share of the expected citations recovered. Arrows point the good way.
Four findings. Each comes with a specimen I keep going back to.
1. Closed-book models cite sources they were never shown. Asked where Witten proposed the 2D-gravity/KdV relation, the closed-book model cited hep-th/8910145, an arXiv ID dated 1989, two years before arXiv existed. Later I checked every ungrounded citation against INSPIRE: about half were real papers pulled from memory, the rest invented, like that impossible ID or the digit-mangle 2605.15180 became 1605.08291. Both kinds look plausible to the eye. Both are easy to catch mechanically, because the check does not ask whether the paper is real, only whether it was retrieved.
2. Given perfect retrieval, the model simply does not cite. Retrieval found the right papers 94% of the time. The naked model cited them in zero answers. 91% of its answers had no citations at all. The failure mode of small models is not defiance. It is omission. A retry loop that says "your answer cited nothing, here are the allowed IDs" fixes it. Ungrounded citations and omission both drop to zero, and faithfulness (does the answer stay inside what its cited passages say, scored 0–2) jumps from 1.00 to 1.88.
3. Retrieval destroys refusal. This one I did not expect. On out-of-corpus probes, the closed-book model at least hedges (refusal 1.25 of 2). Both RAG conditions score 0.00. Shown eight relevant-looking passages, the model answers the passages instead of questioning the premise. The same mechanism that suppresses ungrounded citations also suppresses refusal. This is why the final system can refuse before generation (next section). If you ship RAG, be aware: retrieval quality and refusal quality fight each other.
4. Grounded is not the same as right. With everything on, correctness topped out at 0.53 of 2. My favorite specimen: a fully guardrail-compliant answer said AdS/CFT "was proposed by Maldacena [hep-th/9807109]". The bracket is legal, because that paper was retrieved. The attribution is wrong, because that ID is Witten's theta-dependence paper. Grounding guarantees that claims trace back to retrieved text. It cannot supply physics judgment. That still comes from the model. A 7B stays physics-shallow no matter how disciplined its citations are.
One quirk from the first week kept bothering me. Ask about Chern-Simons theory and the Jones polynomial, and the 1989 originating paper does not make the top five. Standard retrieval fingerprints the question and each passage separately, then matches fingerprints (a bi-encoder: fast, slightly deaf). It prefers the modern lectures, which use both terms together more densely. The paper that started it all showed up at rank 8.
The sharper tool is a cross-encoder: it reads question and passage together and scores the pair. Slower, but it actually reads. Re-ordering the top candidates with one is called reranking. I added that, expecting better coverage. The result was more interesting. Recall@8, the share of questions whose expected paper lands in the top eight passages, did not move (0.94 either way). But the rank of the expected paper improved sharply: 5th to 1st, 6th to 1st on several questions. That matters for models that anchor on early passages.
The unplanned bonus: cross-encoder scores are roughly absolute. Every topic-absent probe scored negative. In-corpus questions scored +2 to +5. That is a free "the corpus has nothing relevant" detector. It became the pre-generation refusal gate: decline before the model speaks.
Calibration showed exactly what the gate is and is not. It detects topical coverage, not answer presence. Questions whose topic is absent (lattice QCD values, biography, made-up results) are refused up front. Near-miss probes, like other authors' theorems on topics Witten wrote about, pass through by design and are handled downstream. No single layer is enough. That observation became the architecture.
The guardrail proves the discipline can be enforced. The last experiment asked whether it can be learned: move the citation reflex from the retry loop into the model itself. The recipe is called distillation. A strong teacher model writes worked examples. A small student model is trained on them until the behavior sticks.
A DeepSeek teacher wrote 2,050 (question, passages, cited-answer) training triples over the corpus. Every one was gated by the same citation validator. That cost about $12. The gold set was strictly held out (the student never trained on it), with an overlap guard that fired 15 times. Training used QLoRA, a budget method: freeze the student, train only a small low-rank correction on top. One rented RTX 4090, about $2. Total: roughly $14.
The pipeline had its bug stories. DeepSeek's V4 models are thinking models. Give them a small token budget, and the whole budget goes to internal reasoning; the visible answer comes back empty. My first pilot generated 293 empty questions, retrieved passages for empty strings, and produced a fake "98% retrieval drift" result that I briefly believed. Measure, then measure your measurement. (Also: the training run finished all 504 steps, and then the GPU pod died of balance exhaustion minutes later. The finished adapter was rescued from the dead pod's disk for pennies, using a CPU-only boot. Rent-a-GPU life.)
Results, on the same 23 held-out questions (columns as in the first table):
| run | ungrounded ↓ | uncited ↓ | cite recall ↑ |
|---|---|---|---|
| base, naked | 0.09 | 0.91 | 0.00 |
| base + guardrail | 0.00 | 0.00 | 0.64 |
| distilled, naked | 0.17 | 0.04 | 0.78 |
| distilled + guardrail | 0.00 | 0.00 | 0.77 |
The reflex transferred. Naked, the distilled model cites unprompted in 96% of answers. Its citation recall (0.78) beats the base model with the guardrail forcing it (0.64). What used to need a retry loop is now an instinct. The guardrail still earns its place. Citing more means more chances to cite something that was not retrieved: the naked ungrounded-citation rate rose to 0.17, sometimes recalling real IDs seen in training. The guardrail zeroes that, at no recall cost.
And the regression is the real lesson. All 2,050 training samples were positive demonstrations. None demonstrated refusal. The distilled model kept refusal where the topic supports it ("the essay makes no mention of GPT-style scaling laws", correctly cited: a textbook decline). But it collapsed on false premises. Asked about a fictional 2027 follow-up paper, it asserted the fictional result while citing the real 2026 paper. It looks grounded, but it is fake: the most dangerous failure I measured all summer, produced by my own fine-tune. Distillation teaches what the data contains, and only that. The refusal gate catches three of the four probes before the model speaks. That is the point:
| failure mode | caught by |
|---|---|
| topic absent from corpus | refusal gate (pre-generation) |
| ungrounded citation | validator + guardrail (post-generation) |
| substantive answer, no citations | guardrail (omission check) |
| claim drifts beyond the passage | faithfulness scoring (human) |
| grounded but physically wrong | correctness scoring (human) |
The system is not the model. The system is the stack.
The evaluation instruments are the product.
Total spend: about $12 of teacher API and $2 of GPU rental. Everything else ran free and local, on a fanless MacBook Air that served as ingestion cluster, evaluation rig, and web server. The distilled model is on HuggingFace, with a hard warning in the model card: it is a RAG component, not a chatbot. Without passages in front of it, it just cites papers it was never given, confidently.
I came to this project from theoretical physics, expecting to learn engineering. The surprise was how much transferred the other way. Every save came from research habits, not code: measure before building, hold out your gold set, distrust numbers you have not traced to the source, assume your benchmark is wrong until an instrument says otherwise. The plumbing (pipelines, checkpoints, retry loops) can be learned in a season. Knowing what counts as evidence takes longer. Physics turns out to be good training for exactly that.
A running, honest record of what changed and what broke since this post went up. Newest first.
Edward.Witten.1), and recovered 5 pre-arXiv-era articles a naive TeX parser had been dropping.cyber-witten-7b) from the RAG teacher for $14.
Try it: the browser demo (retrieval free, answers with your own key) ·
full pipeline on GitHub ·
the distilled model.
Questions or corrections: email me.
Yes, an AI helped me edit this post. It did not get to grade its own homework: every number comes from the eval runs, and the mistakes in the project were mine.