AI Hallucination Prevention & Agent Drift Guard

Stops unsafe AI continuations before execution by detecting hallucination and agent-drift risk at token level, then producing safe rewrites and auditable replay traces.

Comment

Demo video backup link: https://www.youtube.com/watch?v=yAGeKPewJfU

Inspiration

AI agents can drift away from instructions, invent tools that do not exist, or move toward actions they were never authorized to take. Detecting these failures after execution is often too late.

This project was inspired by a simple safety goal: make emerging hallucination and agent-drift risk visible early enough to stop an unsafe continuation before the demonstrated action executes.

AI Hallucination Prevention Before Execution

AI agents can drift away from instructions, invent tools that do not exist, or move toward actions they were never authorized to take. Detecting the mistake after execution is often too late.

AI Hallucination Prevention & Agent Drift Guard demonstrates a prevention-oriented approach: expose risk while an unsafe continuation is forming, stop it before the demonstrated action executes, provide a safe rewrite, and preserve an auditable record of the intervention.

What it does

The public-safe demo presents three agent-safety scenarios:

  • A coding agent drifts from read-only inspection toward modifying repository files.
  • An agent invents and attempts to use a nonexistent tool or API.
  • An instruction-following agent drifts from a chemistry task toward an unrelated cake-recipe prior.

Each dashboard replays the continuation token by token. Public proxy signals for instruction drift, action risk, and combined stress change as the text develops.

At the recorded trigger, the dashboard displays a STOP event before the demonstrated action executes. It then presents a safer continuation that returns to the permitted task boundary.

Inspectable safety evidence

Every scenario includes:

  • A standalone replay dashboard
  • An audit JSON document
  • A frame-by-frame JSON Lines trace
  • A readable Markdown report
  • The trigger token, stop status, intervention type, and policy fields

This allows reviewers to inspect what happened instead of relying only on a polished visual demonstration.

Build Week work with Codex and GPT-5.6

The proprietary research core and the original public-safe demonstration baseline predate Build Week. Proprietary internals were not exposed to Codex and are not included in this repository.

During Build Week, Codex with GPT-5.6 was used to extend and harden the public evaluation and submission layer. The new work includes:

  • An audit JSON Schema
  • Structural audit validation
  • Cross-file artifact-consistency verification
  • Portable repository paths
  • Disclosure and testing documentation
  • A clear prior-work versus Build Week record
  • An isolated Playwright-based automated demo recorder
  • Real validator output captured inside the final demo video

The Git history includes a tagged prior-work baseline and separate Codex-assisted Build Week commits.

How it was built

The public package uses Python for artifact generation and validation, HTML, CSS, and JavaScript for the replay dashboards, JSON and JSON Lines for audit records, and Node.js with Playwright for deterministic browser recording.

The automated recording workflow serves the repository through localhost, runs the real validators, captures their output, and produces a 1920x1080 video without exposing local filesystem paths or browser chrome.

Challenges

The main challenge was demonstrating meaningful safety behavior while protecting proprietary implementation details.

The submission therefore separates three things clearly:

  1. Pre-existing proprietary research
  2. The pre-existing public-safe scenario baseline
  3. The new Codex-assisted Build Week validation, testing, disclosure, and recording layer

Another challenge was keeping the claims precise. Passing validators confirms internal consistency among the supplied public artifacts. It does not independently verify a proprietary runtime.

What we learned

AI safety demonstrations become more useful when they provide inspectable artifacts, explicit intervention boundaries, reproducible checks, and a clear distinction between prior work and new work.

We also learned that stop-before-execution is a valuable interface pattern: the system should not only report that drift occurred, but make the intervention visible before a demonstrated unsafe action advances.

Limitations

This public-safe proxy demonstration does not claim universal hallucination prevention. A runtime signal may not emerge when a model confidently follows a false premise. Those cases may require improved training, knowledge correction, or additional safeguards.

What's next

Future work will evaluate the approach across more agent tasks, tool policies, and model families, while preserving the same requirements for early intervention, safe rewriting, and auditable evidence.

Built With

Share this project:

Updates