Conversational, Generative, and Foundation-Model Recommenders

Measure candidate recall, valid-ID rate, attribute support, contradiction, clarification turns, task success, user correction, latency, cost, and safety. Two published instruments keep that list from being a wish.

The corpus came first. ReDial, released in 2018, holds 10,006 conversations and 182,150 utterances from 956 users. Inside them sit 51,699 movie mentions. Its authors were measuring against collections far smaller: “In contrast, our corpus has over 10k conversations and 160k utterances.” The number to read twice is the split in those mentions. Of the 51,699, some 35,421 were suggested by the recommender and 16,278 were mentioned by the seeker. Most of what a conversational surface has to stand behind is what it volunteered, not what the user brought.

The rubric came second. Groundedness got a formal definition in 2023, from Rashkin and nine colleagues: “To this end, we present an evaluation framework, Attributable to Identified Sources (AIS), stipulating that NLG output pertaining to the external world is to be verified against an independent, provided source.” AIS is a two-stage human annotation pipeline. It was validated across two conversational QA datasets, a summarization dataset and a table-to-text dataset. That is what an attribute-support metric should be built on. Not a rater's impression that a reply read well.

Human evaluation should use explicit rubrics of that kind and verified catalog evidence. Keep a conventional fallback for model outages and low-confidence states. A conversational surface should be able to say that no eligible item satisfies the constraints.

The hallucinated item is not a story about one bad reply. It has a measured rate.

GPT-3.5-turbo produced 321,048 top-20 recommendations in a 2023 study, of which 95.51% could be string-matched to the IMDb title database. GPT-4 produced 322,323, of which 94.86% matched. Roughly one in twenty generated titles matched nothing at all. He and eight co-authors ran the count, and they are explicit about what it is: only a lower bound on the non-hallucinated fraction. A string that matches a real title can still be the wrong item, or an unavailable one.

They state the mechanism themselves. “We note that language models trained on open-domain data naturally produce items out of the allowed item set during generation.” That is the whole lesson in one sentence. An item can fit every constraint the conversation established, be described fluently and confidently, and still not be in the catalog. In such a system that is not an anomaly. It is the expected tail. You can measure it on your own catalog before you ship, or discover it from a user who drove to an address that was never there.

Language and multimodal models can interpret natural-language preferences, summarize histories, encode items, generate synthetic supervision, rerank candidates, create explanations, or participate in conversational search. The recommendation itself should stay tied to eligible catalog items and verified attributes. A generative model may transform the evidence or reason over it. It should not invent the inventory it is authorized to recommend.

Generative retrieval shows how literal that boundary has to be, because there the model generates the item identifier itself. TIGER, presented at NeurIPS in 2023, gives each item a Semantic ID: a tuple of quantized codewords produced by an RQ-VAE over Sentence-T5 embeddings, drawn from a 1,024-token item vocabulary (256 x 4). The model then autoregressively decodes the next item's ID. It works. On the Beauty, Sports and Outdoors, and Toys and Games categories of the Amazon Product Reviews dataset, “TIGER performs considerably better on the Beauty benchmark compared to the second-best baseline with up to 29% improvement in NDCG@5 compared to SASRec”, alongside 17.3% in Recall@5 over S3-Rec.

And a Semantic ID is still a string a decoder produced. A decoded tuple of codewords can fail to name a real item, exactly as a decoded movie title can. That is why the catalog check sits after the decode instead of being assumed inside it.

The loop exists to keep a fluent model attached to real inventory. Elicitation gathers the constraints. Retrieval searches structured stock. Grounded comparison uses verified attributes, availability, price and provenance. The state and feedback layer decides what the conversation is allowed to remember afterwards. Read the layers against the measured failure rate. Elicitation and comparison are where a language model earns its place. Retrieval is the only layer permitted to decide which items exist.

Fix the catalog boundary before writing a single prompt. Valid item IDs, current eligibility, nothing generated into existence. Then separate the model's roles, validate tool and schema outputs deterministically, and evaluate the conversations rather than the replies.

The last step measures the whole apparatus against search, forms, filters, and conventional re-ranking. The field has a documented base rate for what happens when that step is skipped. A 2019 RecSys paper asked in its title whether neural recommendation was really making much progress, then answered by trying to rerun the work: “Specifically, we considered 18 algorithms that were presented at top-level research conferences in the last years. Only 7 of them could be reproduced with reasonable effort. For these methods, it however turned out that 6 of them can often be outperformed with comparably simple heuristic methods, e.g., based on nearest-neighbor or graph-based techniques.” Even the one remaining reproducible method “clearly outperformed the baselines but did not consistently outperform a well-tuned non-neural linear ranking method”.

Step 5 is not a caution to be nodded at. It is the step whose omission produced 6 of 7 published methods losing to nearest-neighbour and graph heuristics. A conversational surface is a far more expensive thing to leave unchecked than a reranker.

Catalog hallucination is the failure users notice, and cost-blind architecture is the one finance does. Between them sits the failure someone else chooses for you.

Indirect prompt injection has been run against shipped products. Bing Chat and code-completion engines were compromised in 2023 by prompts planted in data those systems would later retrieve. Greshake and five co-authors did the planting. The abstract of their preprint says why a marketplace that lets suppliers write item descriptions has a security problem and not only a quality problem: “We argue that LLM-Integrated Applications blur the line between data and instructions.” Their taxonomy of impacts runs to data theft, worming and information ecosystem contamination.