Prompt Variants v1-v4 We now describe for each prompt version we tried how it differs from the base prompt provided above.

V1 Differences from Base:

• Focuses on whether the continuation logically follows from the original text.
• No reference to human continuation or world knowledge.
• Hallucinations include internal inconsistencies or implausible statements given the original text.

V2 Differences from Base:

• De-emphasizes coherence with the original text; focuses on factual correctness only.
• Allows use of general world knowledge as valid ground truth.
• Only statements that are false, self-contradictory, or implausible count as hallucinations.
• Minor logical or coherence issues with the original text should not be considered hallucinations.
• Provides explicit label definitions for “No Hallucination”, “Possible Hallucination”, and “Definite Hallucination”.

V3 Differences from Base:

• Allows minor invented/unverifiable terms if plausible and not contradicting world knowledge.
• De-emphasizes off-topic or loosely connected content.
• Only clear factual errors or implausible claims are considered hallucinations.
• Plausible but invented terms or creative liberties are treated as “Possible Hallucination” unless they contradict facts.

V4 Differences from Base:

• Removes ambiguity around coherence, style, and narrative oddities.
• Explicitly tolerates creative, loosely grounded content while still catching true factual errors.
• Instructs not to penalize for minor semantic or logical quirks in story continuations.
• Narrative oddities, off-topic content, or unusual story events are not hallucinations if plausible or creatively reasonable.

B   Synthetic data generation

B.1   Unsafe test set

To extract unsafe data, we applied two-staged filtering to the RedPajama dataset: first, we used existing tags to extract unsafe content. Specifically, we modify recommended quality filtering rules1 to add a rule that searches for curse words or blocklist content (Figure 12). Filtered data is then split into train, validation and test data. Since we further extract a prefix and suffix from each sample randomly, it might happen that the extracted prefix is safe. To limit testing on purely unsafe prefixes, we then used a strong model – GPT-OSS-120B – to further filter validation and test splits. In particular, we prompt the model to evaluate safety of the prefixes with 8 random seeds, and only use data where all 8 responses judged prefixes as unsafe. We use the same safety prompt we used for judging safety during training (Figure 2).