One sentence stopped Gemini inventing an audit. A different sentence made it worse.

Why a fourth test on the same fake cafe

The previous article ended with a limitation I did not want to leave sitting there: I had not tested whether telling the model to behave differently actually changes anything. That is the first question a working freelancer asks after reading a piece like that, and answering it is more useful than finding a fourth way to catch the model out.

It is also the test most likely to undermine the series. If one line of prompt fixes everything, then three articles of warnings are overstated and should say so.

What I changed, and the confound I had to remove first

The previous test's two runs were done in a session where I had not recorded which model variant was selected. That matters more than it sounds, so before comparing anything I re-ran the original prompt with no additions, on 3.6 Flash specifically, confirming the model in the interface first.

Without that control, any difference could have been the variant rather than the prompt. With it, every run below is the same model, the same account, the same day.

Four different scores for the same non-existent business: 42, 38, 48, 28. A twenty point spread, which on its own retires the idea that these numbers measure anything.

The sentence that worked

This is the whole change, appended to the end of the original prompt:

Both runs refused to fabricate. They did it in two different ways, which is worth being precise about rather than smoothing over.

The first run asked for real data. Instead of writing anything, it replied that it needed permission to turn on the Google Business Profile connector, and offered a consent card. I declined it, because granting an app access to a Google account is not a decision to make casually and it would have connected to a real profile rather than the fictional one. On refusal it stopped. No report, no score, nothing invented.

The second run wrote a report and refused to score it. Its headline read "Audit Score: Unverifiable / 0 out of 100", followed by a plain statement that a score could not be calculated because no online presence, profile, listing or website could be verified for the business. Every section carried a "Status: Unverified / Not Found" label. The recommendations were still there, but framed as what to do if the business exists, rather than as faults it had detected.

Two runs, two mechanisms, one outcome: nothing invented and nothing scored. That is enough to recommend the sentence. It is not enough to call the behaviour stable, and the fact that the same instruction produced two different response shapes is itself a reason to check the output rather than trust the instruction.

The sentence that backfired

The obvious fix is to tell it to go and look. That is the instruction I expected to work, and it is the one that produced the worst result in the entire series.

The run opened like this:

"Here is the Local SEO Audit Report for Nguyet Cam Coffee & Bakery in Hue, Vietnam, based on a real-time web search and digital presence scan."

Then it scored the business 28 out of 100, with a 20 for the Google Business Profile and a 25 for reviews.

The previous test caught the model implying it had checked things. Here it states it outright, in the first sentence, as a preamble. If you were going to trust anything in an AI report, you would trust a line that specific.

And then the part that took me a while to see

Read that run's findings closely and something odd emerges. They are accurate.

• "Listing Status: Missing or unindexed under Nguyet Cam Coffee & Bakery in Hue"
• "Review Volume & Recency: Extremely low or non-existent public review profile"

Both true. There is no listing and there are no reviews, because there is no business. Whatever it did or did not search, it arrived at the correct observation.

And then it filed that observation under the wrong heading. It took "nothing is there" and reported it as "this business has weak SEO", assigned it 28 out of 100, and produced five recommendations for fixing it.

It converted the absence of the subject into a deficiency of the subject. The model appears to have no category for "the premise of your question is false". It has a category for answering the question, and an empty result set gets rendered as a bad score rather than as a missing entity.

That reframes the whole series for me. The problem may be less that the model lies about what it found, and more that it has no way to hand back the answer "your question does not apply".

The control run did something worse than inventing

Running the plain prompt on 3.6 Flash produced a fabricated audit, as expected, scoring 48. But this one did not invent its evidence from nothing. It reached out and borrowed somebody else's.

The report displayed a real Hue cafe, by name, with its real star rating and price band, as an example of a listing customers get "directed to" instead. It then listed a second real, similarly named local business as evidence of naming inconsistency for the business that does not exist.

I am not naming either of them here. Neither has any connection to this test, and reproducing "here is a real cafe that appears in an audit of a fake one" is the exact harm the second test in this series warned about in the abstract. Both are ordinary businesses that turned up in a search because their names are similar.

A fabricated rating is wrong. A real business's rating, presented as evidence about a different business, is wrong in a way that involves somebody who never agreed to be in your document.

Why one sentence works and the other does not

I do not know, and I am not going to invent a mechanism for it. That would be a strange thing to do in this particular article.

What I can say is what the two instructions ask for. "Search the web first" adds a step to the task while leaving the goal untouched: produce an audit. "Do not invent, and say so if you cannot verify" changes what counts as success, and gives it a permitted way to finish without a report. One tells it how to work. The other tells it what an acceptable answer looks like, including an acceptable answer that is not a report.

That is a description, not an explanation. If someone with a better one wants to correct me, I will publish it.

What to actually do

• Append the guardrail sentence to any prompt that touches real-world facts. It costs one line and it visibly changed the behaviour in both runs here. Do not treat it as a guarantee: check the output anyway.
• Do not use "search the web first" as a safety instruction. On this evidence it does not prevent fabrication and it adds a confident claim that a search happened, which makes the output harder to distrust rather than easier.
• Better than either: gather the facts yourself and hand them over. Open the profile, count the reviews, check the directories, paste it in. The first test in this series found the model reproduces supplied data accurately, including awkward numbers. That is where the real time saving is, and it does not depend on any prompt trick.
• Treat a specific-sounding preamble as a warning sign, not a reassurance. "Based on a real-time web search" was written by the run that was least connected to reality.
• Watch for absence dressed up as a low score. If a report says everything is missing, unclaimed and not found, consider that the correct conclusion might be that the thing does not exist, not that it needs your help.

Corrections to earlier articles in this series

Two things I got wrong, both fixed on the original pages rather than only here.

The second and third articles named the model variant as 3.6 Flash. I did not record it at the time and wrote that in without verifying it. Both now say the variant was not recorded. The first article's attribution stands, because that one was noted when the test was run.

The third article inferred from the output that no web search had taken place. This test found the same prompt on 3.6 Flash clearly surfacing live data, so that inference does not generalise, and a correction now sits in that article next to the original claim.

Four tests, one rule

• Given real data, it reproduced the data accurately and invented the branding.
• Given no data, it invented the data.
• Given no subject, it invented the findings and invented having looked.
• Given permission to fail, it stopped inventing.

The first three tests kept landing on the same observation: the model has no output mode that looks unfinished. This one suggests why that is worth stating so carefully. It is not that it cannot say "I do not know". It is that nothing in an ordinary request tells it that "I do not know" is an acceptable answer, so it produces the artifact it was asked for and fills the gaps to get there.

The gaps get filled because a complete answer is what looks like success. Change what success means and the filling stops.

Who should skip this

If your work does not depend on the model reporting real-world facts, none of this applies. Writing, drafting and rewriting from material you supply were never the problem in any of these four tests.

If it does, the guardrail sentence is worth adding today. It is not a licence to stop checking.

Limits of this test

Two runs per variant, one model, one day, one task, one made-up business. That is enough to show a clear difference in behaviour and not enough to state a rate. I would treat "this changed the behaviour in four out of four relevant runs" as a reason to adopt a one-line habit, and not as a reason to stop reading output.

I tested one phrasing of each instruction. Other phrasings may do better or worse, and I have no basis for ranking them. I also did not test other models, so nothing here should be read as a claim about ChatGPT or anything else.

The two guardrail runs behaved differently from each other, one asking for a data connector and one labelling everything unverified. Same instruction, same model, same day. Whatever is happening is not a switch.

Raw output for all four new runs is kept on file. If you run this and get a different result, tell me and I will publish the correction.

Why there are no affiliate links here

This one is closer to home than usual: the finding is that a free one-line prompt change does much of what some paid tools promise. There was nothing to buy to discover it and nothing to sell at the end of it. Reviews on this site carry affiliate links and disclose it. This page does not.