Using large language models for research safely means treating them as grounded assistants rather than as sources: scope every prompt to documents you supply, force the model to say when it does not know, check every citation against the original, never paste confidential or participant data into a consumer tool, and disclose how you used it. That is the whole discipline, and most of it lives outside the model.
The reason this matters is that the failure mode is invisible. A fabricated citation, a decade-old statistic presented as current, a summary that quietly drops the dissenting finding — all of it reads exactly like correct output, in the same confident tone, with the same tidy formatting. You cannot spot it by feel.
I keep four things in view when I run a model on a research task: accuracy, privacy, integrity, and disclosure. Accuracy is the verification pass. Privacy is what you refuse to type. Integrity is sourcing and bias. Disclosure is the methods note nobody writes but everybody should.
This guide is aimed at journalists, researchers, and newsroom teams. It assumes you have no machine-learning background and no budget for a private deployment. Everything below works with the tools already on your laptop, plus one habit change that does most of the heavy lifting.
Table of Contents
- What You Need
- Step-by-Step: How to Use Large Language Models for Research Safely
- Step 1: Define the research question and boundaries
- Step 2: Choose an approved tool and access method
- Step 3: Classify and minimize the information
- Step 4: Use a controlled prompt and request sources
- Step 5: Verify every factual claim
- Step 6: Review privacy, bias, and safety risks
- Step 7: Document the workflow and keep approval visible
- Common Mistakes
- Frequently Asked Questions
- Conclusion
What You Need
Before you open a chat window, five things should exist. Skipping any one of them is how confidential material ends up in a training set.
- An approved tool and a named account type. Personal account, institutional account, or self-hosted. Know which one you are signed into before you paste anything, because retention terms differ.
- A written scope note. Two or three sentences: the question, the date range, the sources you will allow, and the sources you will not touch.
- A source pack you control. The PDFs, transcripts, datasets, and notes the model is allowed to draw on. If the model is meant to be grounded, grounding material has to exist.
- A verification route. Library access to the journals you need, an archivist, or a human expert who can check a claim in your field. Verification you cannot perform is not verification.
- A prompt log. A spreadsheet or plain text file with one row per prompt. Fields are listed in step 7.
For red-tier material, add a sixth item: a local open-weights model such as one run through Ollama on your own hardware, where your prompts never leave the machine.
The classification table below is the decision I make first, every time, before I think about which tool to use.
| Tier | Typical material | Allowed use | Verification required |
|---|---|---|---|
| Green | Published articles, public datasets, open-licence documents, your own drafts | Summarise, rephrase, expand search terms, extract structured fields, explain a passage you already hold | Spot-check three or four extracted facts against the source |
| Amber | Internal memos, draft reporting, unpublished analysis, licensed but non-public material | Only in an approved institutional or private instance with retention disabled, and only after redaction | Claim-by-claim check against the original document, plus a reviewer |
| Red | Personal identifiers, health or financial records, human-subject data, embargoed findings, source identities, anything under NDA | Do not use a consumer or hosted tool at all. Local model, or no model | Not applicable: the material should not have left your environment |
A second table keeps the division of labour honest, because the most common failure is quietly handing the model a job you are still accountable for.
| Task | What the model does well | What you must still do |
|---|---|---|
| Literature discovery | Broaden and re-rank search terms, suggest adjacent terminology in other fields | Run every query in a real database and read what comes back |
| Reading | Summarise a document you supply, pull out a methods section, build a comparison grid | Read the document yourself; confirm each extracted figure |
| Analysis | Suggest coding categories, check your arithmetic logic, draft a table shell | Make the inferential decisions and own any error in them |
| Writing | Restructure text you wrote, tighten a paragraph, check a plain-language version | Write it. Never let a model originate a claim you then publish |
| Verification | Nothing, reliably | Everything |
Step-by-Step: How to Use Large Language Models for Research Safely
Step 1: Define the research question and boundaries
Start by turning a broad topic into one question you can actually check. “What is happening with housing policy in Manchester” is not a question; “which Manchester wards saw a rise in eviction filings between the two dates you logged, and what does the council say about causes” is.
Then write down three limits. A date range, a set of sources you will use, and a set you will not. Newsroom work usually also needs a boundary of geography and population, because a model will happily generalise from a national dataset to your city without flagging that it did so.
The third boundary is the one people skip. Write a short list of what the model must never be asked to do with this task: identify a confidential source, guess at a person’s motivation, infer a protected characteristic, or fill a gap in the record where no evidence exists. Put that list where you will see it, because the model’s default is to close gaps smoothly.
Step 2: Choose an approved tool and access method
Three tiers cover most research work, and each is safe for a different set of tasks.
Consumer chat assistants are fast and excellent at green-tier work: summarising a document you paste in, expanding a Boolean search string, explaining a passage you already hold. Their weakness is that consumer tiers commonly retain prompts and may use them for improvement, and that behaviour changes without notice. Treat them as a private space only in the sense that a café is private.
Research-integrated assistants sit inside tools like reference managers or discovery platforms and keep the link between your notes and the source. The advantage is provenance: you can see which document a passage came from. Check whether the vendor trains on your inputs and whether retention can be switched off, because those two settings are the whole conversation.
Local open-weights models run on your own machine through software such as Ollama. Nothing is transmitted, so red-tier material becomes workable. What you give up is raw capability and convenience: a small local model is weaker at reasoning, has a limited context window, and produces clumsier output.
Whichever you pick, use the account your institution approves. Personal accounts on a work laptop are a common and entirely unnecessary way to leak a source list.
Step 3: Classify and minimize the information
Run your material through the tier table before you paste. Then minimize, which is the boring part and the part that actually protects people.
Replace names with codes. Strip document metadata and hidden revision history. Cut anything not strictly needed for the question, including whole documents that merely mention the subject. If a paragraph contains one usable statistic and three names, extract the statistic and discard the paragraph.
On paywalled or licensed material: a model may refuse to process it, and where it does process it, the licence may not cover storage in a third-party system. If the material is licensed, check the licence before uploading. “I could not read it” is a better outcome than a licensing problem discovered at publication.
Step 4: Use a controlled prompt and request sources
A weak prompt looks like this: “Summarise the findings on eviction in Manchester.” You get a confident paragraph built from training data, with no idea how old it is or which study it came from.
A guarded prompt names the role, the task, the evidence rule, the uncertainty rule, and the prohibition:
You are a research assistant working only from the documents I have supplied. Ignore your own knowledge of the subject entirely. Base every sentence on the supplied documents and name the document and page for each claim. If the documents do not answer something, reply exactly: “Not in the supplied documents.” Do not produce references, DOIs, author names, or publication details unless they appear verbatim in the supplied text. Answer one claim at a time and stop after each one for my confirmation.
Four elements do the work. Grounding restricts the corpus. The explicit instruction to ignore internal knowledge stops the model blending your paper with its own. The forced abstention gives it a legitimate exit, which is the single most effective guardrail available. And the citation-by-document-name requirement makes your verification step mechanical.
One claim per prompt sounds slow and is faster overall. Long prompts produce long outputs, and long outputs are where the invented citation hides.
Step 5: Verify every factual claim
Treat model output as a set of claims to be checked, not as a paragraph to be approved. Break it into atomic claims and run each one.
- Go to the primary source. Not a summary of it, not the abstract, not a news write-up of it. A plausible-looking DOI is not a reference; open it and read the page.
- Check the date. Models routinely serve statistics whose underlying data has been superseded, and they will not flag it.
- Check who is missing. See step 6.
- Repeat the prompt. Ask the same question in a new session a few weeks later and compare. Divergence is a signal, not a nuisance.
- Re-ask a second model. Agreement between two unrelated systems is weak evidence, not proof, but persistent disagreement tells you exactly where to dig.
The Digital Methods Initiative ran a longitudinal study on exactly this, re-running a fixed prompt set on a fixed cadence for months and capturing every output. Their findings are the reason I insist on the repeat protocol: the same prompt returned contradictory answers across the study period, sometimes reversing a technical claim outright. Their source analysis found that 1,062 of 1,166 cited URLs were US-based, roughly 40 percent sat on commercial domains, and about 55 percent of domains recurred across runs — a “once-trusted, always-trusted” pattern where the model keeps leaning on the same sources it liked the first time.
That last finding matters for newsroom work. If you are covering a region the model sources thinly, its citations will skew toward anglophone, US-centred, commercial material, and it will do so without remark.
Step 6: Review privacy, bias, and safety risks
Now read the output for harms rather than facts.
Privacy leakage. Models have been shown to surface or reconstruct sensitive detail from prompts and reasoning traces. If your input contained a name, a case number, or an address, check the output for it and strip it before the text goes anywhere else.
Representational harm. Generative systems inherit patterns from training data, so occupations, roles, and communities get described with wildly uneven frequency and detail. Ask who is absent from the output and who is described most thinly. Library guidance on AI literacy points to concrete documentation of these co-occurrence skews; a general bias section without an example is not much help.
Framing. Ask a second model to summarise the same material and compare what each treated as central. Where framing shifts with no change in facts, the framing was doing work, and you should decide that yourself.
Prompt injection. If the model fetched a web page or opened a document you did not write, treat anything inside it as untrusted input rather than instruction. Retrieved pages can carry text designed to redirect the model, and a model that obeys embedded instructions can leak your prompt back out.
Copyright. Model output that closely reproduces a source can carry that source’s rights. Do not paste generated text into a published work without comparing it against the original.
Step 7: Document the workflow and keep approval visible
Log one row per prompt while you work, not afterwards. The fields:
- Date and time, plus the model name and version you saw in the interface
- The exact prompt text
- Which documents or files were supplied
- The model version and settings, including whether web search or retrieval was on
- Which claims you verified, against which source, and the result
- What you edited and what you discarded
- The reviewer and the approval status
Archive the actual outputs too. A screenshot or a saved text file beats a memory of what it said, because of the next point.
Proprietary models change without version notice. The same prompt on the same document can return different content in three months, which means your results are not reproducible unless you recorded what produced them. This is the strongest argument for keeping a log even when no one asks you to, and it is also why open-weights models are worth the inconvenience for anything you expect to re-run later.
For journalistic research specifically, keep unpublished data and source identities out of hosted tools entirely, and treat model output as a lead rather than a finding. A generated summary can point you at a document worth reading; it can never be the reason a document was cited.
Common Mistakes
Pasting confidential material into a consumer tool. The fix is the tier table plus redaction, applied before the paste rather than after. If it is red-tier, it does not go into a hosted service at all.
Accepting a citation that looks right. A real-looking DOI with the wrong author or the wrong year is common. Fix: open every reference, no exceptions, and record the check in your log.
Treating fluent writing as evidence. Tone is not support. Fix: break each output into atomic claims before deciding whether it stands.
Skipping the bias read. Fix: ask who the output leaves out, every time, even when the topic feels narrow.
Keeping no version or retention record. Fix: log the model version and settings with every prompt, and check your provider’s retention and training settings once a term.
Letting the model draw on its own corpus. This is the default in every consumer chat window. Fix: supply documents and instruct the model to ignore internal knowledge and to say “I don’t know” otherwise.
One enormous prompt for a whole research phase. Fix: one claim per prompt, with your confirmation between them.
Publishing with no disclosure note. Fix: write two or three sentences in your methods section naming the tool, the version, the date range of use, and what it was used for. Style guides including MLA and APA have published guidance on citing generative AI; the substance they agree on is that the use must be visible.
One governance point worth keeping in view: there is no settled legal or ethical regime for this yet. Institutional policy, funder rules, professional style guidance, and frameworks such as the UNESCO Recommendation on the Ethics of AI are the current reference points, and they can disagree. When they conflict, the stricter rule is the defensible one.
Frequently Asked Questions
How to properly use AI for research?
Use a six-stage loop: define the question and its limits, pick an approved tool, classify and redact the input, ground the prompt in documents you supplied, verify every claim against the original source, then log and disclose what you did. Treat the model as an assistant that summarises what you give it, never as a database of facts. Anything it produces stays unverified until you have opened the underlying source yourself.
What are the risks of large language models?
Four risks dominate research work. Hallucination produces confident claims, statistics and references that do not exist. Bias and representational harm reproduce unequal representation from training data. Privacy failures expose whatever you typed, and models have been shown to leak detail from prompts and reasoning traces. Instability means the same prompt can return different answers later, so results are not reproducible unless you record the model version, settings and date.
What is the most critical issue with large language models?
Plausible-but-false citations are the most consequential failure, because they are the hardest to catch downstream. A wrong statistic looks wrong; an invented reference looks real, with a working link format and an author who seems to exist. Check every citation against the original source, keep the reference list under human control, and never let a model generate the bibliography.
Is it okay to use AI to do research?
Yes, within limits that most institutions and style guides now set out. Using a model to summarise documents you already hold, expand search terms, or structure your own analysis is normal practice. Generating findings, fabricating references, or producing text you present as your own without disclosure is not. The line most people argue about is ghostwriting, so decide your own position in writing before you start and state it in your methods note.
What data should I not put into an LLM?
Never paste personal identifiers, health or financial records, human-subject data, embargoed findings, confidential source details, or anything under a non-disclosure agreement into a hosted service. Redact first: replace names with codes, strip document metadata, and send only the extract the question needs. For genuinely sensitive work, run an open-weights model locally so the material never leaves your machine.
Last updated: October 2026.
Conclusion
If you do one thing differently tomorrow, write your scope note before you open the model. One paragraph naming the question, the date range, the permitted sources, and the things the model must never be asked to do prevents more bad research than any prompt trick.
Then keep three standing rules. Ground everything in documents you supply. Verify every claim and every citation against the original. Disclose every use in writing, in your own words, in the methods section. The models will keep improving, and the verification and disclosure discipline around them will not improve on its own.
Human oversight is not a formality added to satisfy a committee. A person still reads the source, still signs the piece, and still answers for what was published.
