The TOPS Trap: Local AI Models Hallucinated Facts, Cited Real Sources, and Sounded Confident

SPOKANE VALLEY, Wash. — October 16, 2026 — AIToolworx today published The TOPS Trap, a reproducible study of whether language models running on local hardware stay inside the evidence they are given. In the configurations tested, they often did not, and their answers read as though they had.

The study gave six local model configurations on a Raspberry Pi 5 (some on the CPU alone, some on the Hailo-10H accelerator in the Raspberry Pi AI HAT+ 2, listed at 40 TOPS) a fixed folder of evidence and one rule: answer only from it. Evidence packets were identified by cryptographic hash, prompts were preserved, and every run was logged.

"Our assertion is not that AI sometimes gets facts wrong. It is that an AI system can produce a well-formulated, seemingly well-reasoned, and convincingly supported answer while contradicting or misrepresenting the very evidence it was explicitly instructed to follow." — James Childers | Founder, AIToolworx

What the tests found

• Who’s actually building your local AI model? The box doesn’t say. The retail box reads Raspberry Pi, Empowered by Hailo, Made in Taiwan, with no mention of Alibaba or China. Neither do Raspberry Pi’s product page or Hailo’s launch announcement, and Raspberry Pi’s launch article lists Qwen as a model name without saying whose it is. Yet the Qwen models tested on that board were built by Alibaba, in China, and the instruction sentence the study found in the prompt names Alibaba. Where something was made, or where its maker is headquartered, is not its supply chain. The study tracks three: physical (the hardware), software and model, and control (the instructions that steer behavior, and who can change them). It is a supply-chain question, not a nationality test, and the study does not show who inserted the sentence or why the models behaved as they did.
• Citations were not proof. In one model's evidence-packet test (Ministral 3 3B Instruct 2512, Q4_K_M; four supplied sources, told to answer only from them and cite them), 45 of 93 claims (48.4%) were unsupported or contradicted. The model cited sources only on the U.S. topic: of those 37 cited claims, 18 (48.6%) pointed to a supplied source that did not support them. On the China topic it gave no citations at all, though told to cite.
• Confident hallucination, in separate closed-book tests (no sources supplied). In all four stock-prompt U.S. runs, Qwen 2 1.5B stated that Andrew Jackson was impeached and misdated Worcester v. Georgia (1842, not 1832), with no hedging and identical output each time (temperature 0). In all four neutral-prompt China runs, Llama 3.2 opened with a caveat about uncertainty, then supplied specific death-toll ranges attributed to named organizations, which the paper identifies as unsupported specificity.
• The prompt a user types is not always the prompt the model receives. In all 32 runs of two Qwen 2.5 configurations started with no system message, the runtime log shows an identity sentence added to the prompt. The same sentence is in the official upstream chat template. The study does not establish who placed it in the accelerator-hosted build.
• Speed did not predict trust. The configuration with the strongest source discipline ran on the CPU alone at about 6.7 tokens per second, roughly the speed of accelerator-hosted models that failed more often.

The paper's engineering conclusion: the model may reason about the evidence, but the evidence must remain authoritative. Verification, logging and authorization belong outside the model.

Scope and limits. Findings apply to the exact configurations tested, on one hardware platform and two matched topic packets. They are not claims about all local models or all edge AI. The study is not peer reviewed. AIToolworx has a commercial interest in AI architecture and security consulting, and the trust benchmark proposed is an AIToolworx framework, not an independent standard. Before publication the author sent requests for comment to Raspberry Pi, Hailo, Qwen/Alibaba, DeepSeek and Meta (12 September 2026) and a notice to Mistral AI (6 October 2026). None had responded as of October 16, 2026.

Check the work. The paper, a 12-page executive summary and an evidence archive (prompts, evidence packets, raw requests and responses, runtime logs, scoring records and file hashes; no model weights) are free at http://tops-trap.aitoolworx.com/downloads/ . Each file's SHA-256 hash is published beside it. Permanent archived copy: https://doi.org/10.5281/zenodo.23423297

About AIToolworx. AIToolworx works in AI architecture, data security, and private and edge computing. Secure AI. Local control. Trusted data. [confirm boilerplate]

About the author. James Childers is the founder of AIToolworx. He has more than 40 years of experience in IT security, identity assurance and authentication, is a named co-inventor on two issued U.S. smart-card patents, and has published on multi-factor authentication, including in NATO Defence Journal (2007). Full biography: http://tops-trap.aitoolworx.com/author/ . ORCID: 0009-0005-6827-6921.

Media contact: James Childers, Founder, AIToolworx, james.childers@aitoolworx.com

The cover illustration and five conceptual diagrams were generated with an AI image tool. Model and company names are trademarks of their owners; their appearance does not imply endorsement.