Measured on Nemotron: wrong values 1 to 0 with the gate
Live run: Nemotron 3 Super proposes, Ultra fixes two refused fields
Possibly missed: lines no proposal quoted go to a person
Ngaoundal is not on the place list, so a person confirms it
Field note traps refused: workplace town as origin, accident as self-harm

The problem

AI summaries write things nobody said, and leave out things that were said. The result reads well, so nobody checks.

In a team meeting, that costs an afternoon: a task you never accepted, a suggestion recorded as a decision. In humanitarian protection work it costs far more. A caseworker's record of where a person comes from, how they were hurt and how old they are decides family tracing, referrals and safety. Over 71,000 people across Africa are registered as missing with the ICRC, a 75 percent rise in five years (ICRC, August 2024). UNHCR counted 41.6 million refugees at the end of 2025 (Global Trends, June 2026). The people writing these records are overstretched, and AI note-taking is arriving in their workflow whether or not it is safe.

We attacked a model first

Before building anything, we red-teamed Apertus 1.5 (70B), an open model, on this exact task at Hack Apertus (October 2026), using invented field notes only. In 86 percent of notes it recorded the town where a girl worked as the town she comes from. One accident in three ("she hurt herself while cooking") became self-harm. Hedged statements came back as certain. Each of those failures became a check in FieldGuard. The full study becomes public on 1 December 2026.

What it does

FieldGuard turns notes into structured records, with two pipelines on one engine:

Meeting notes become commitments and decisions: who committed to what, by when, and what was actually decided.
Field notes become a protection intake record: age, origin, current location, where the person worked or was recruited, injury and its cause.

The model never writes the record. NVIDIA Nemotron 3 Super proposes each field together with the exact words from the note it is based on. Plain code then decides, field by field, with a reason a person can read:

Accepted when the quote is in the note and the value is in its quote.
Rejected when it is not, or when a check catches a known failure: the speaker recorded as the owner of someone else's task, "we could" recorded as a decision, a workplace town recorded as origin, an accident recorded as self-harm.
Confirm when the note hedges ("she thinks she is about 16"), when the model itself is unsure, or when a town name is not on the place list. Only a person can move these into the record.

When the checker refuses a field, NVIDIA Nemotron 3 Ultra re-reads the note for that field, told why the first answer was refused, and the checker judges its answer again. Ultra never writes the record either.

A check cannot judge what was never proposed, so FieldGuard also scans the notes for lines that read like a commitment or decision and that no proposal quotes, and shows them as "possibly missed".

French and English. Both pipelines take notes in either language, and the checks carry French cue words ("je vais essayer", "on pourrait", "il me semble"), because much protection work in West and Central Africa is recorded in French.

No copy of the notes. FieldGuard has no database and does not log note text. A note goes to the Nemotron call on Token Factory and nowhere else; the only thing the server holds is a per-address request count, in memory, for the rate limit.

What we measured on Nemotron

Six invented notes, Nemotron 3 Super then Nemotron 3 Ultra on Nebius Token Factory, temperature 0, recorded 28 October 2026 and replayed on the demo page through the same code:

Nemotron 3 Super avoided every trap our red-teaming was built on: no workplace or transit town as origin, no accident as self-harm, no speaker recorded as the owner of someone else's task.
The checker still refused 3 values whose evidence did not hold up: a task quoted from the wrong line (Mary's "I'll try" reply cited for "send the budget to the donor"), a paraphrased quote ("He is 17." where the note says "Mohamed is 17."), and a current location its quote did not contain.
Nemotron 3 Ultra re-read each refused field with the checker's reason. It fixed 2 of the 3: it quoted John's line for the budget, and "Mohamed is 17." Its answer for the third repeated the unsupported value and was refused again.
Wrong values reaching the record: 1 without the checker, 0 with it. The one wrong value was "un garage" as a place; FieldGuard held it for a person because the place list does not know it.
5 values waited for a person: the three Nemotron marked uncertain (two hedged ages and Mary's "I'll try"), "un garage", and Ngaoundal, a real town outside the place list.
Nemotron left out 3 of 6 meeting commitments and decisions. FieldGuard flagged all 3 for a person.
4,948 tokens for the six notes including the second passes, about 825 per note.

Even a good model paraphrases its evidence and drops items. FieldGuard proves what enters the record and shows what may be missing.

Two models, one loop

Super handles the fast first pass on every note; Ultra (nvidia/Nemotron-3-Ultra-550b-a55b) is called only for the fields the checker refused, so the demo stays responsive and the larger model's cost is spent where it is needed. Ultra's answer goes through the same checker: it can fix the field, mark it not stated, or be refused again. If Ultra fails or runs past its time limit, the field stays refused. On the live site Super takes about 2 seconds per note and Ultra's second pass under 1 second.

How we built it

Models: NVIDIA Nemotron 3 Super (nvidia/nemotron-3-super-120b-a12b) proposes every field with its evidence quote; NVIDIA Nemotron 3 Ultra (nvidia/Nemotron-3-Ultra-550b-a55b) re-reads only the fields the checker refused (src/core/retry.js).
Inference: every model call goes through Nebius Token Factory's OpenAI-compatible endpoint (api/_lib/tokenfactory.js). Each response's model name is checked against the model requested and refused if a different model answered, a lesson from our red-teaming, where a gateway silently substituted models on about half of our requests.
The gate: plain JavaScript (src/core/gate.js), the only code path that writes a record. Each pipeline brings its own form, checks and examples; the engine is shared.
Interface: React and Vite, deployed on Vercel, rate-limited per IP.
Evaluation: npm run eval scores every scenario live; --replay re-scores the recorded Nemotron answers offline, and a test pins the numbers on the page to the recorded answers so the page and README cannot drift apart.
Reuse: two modules come unchanged from TRACE, our humanitarian documentation assistant (a fact detector and review rules for machine transcripts).

How FieldGuard meets the judging criteria

Technological implementation. Nemotron proposes; plain code decides, with a written reason for every field; every model call goes through Token Factory and is checked against the model requested. Automated tests, a replayable evaluation on recorded Nemotron answers, and a live public demo.
Design. One page from note to record: see what was proposed, why each field was accepted, refused or held, confirm what is uncertain, and read the final record. Nothing reaches the record without passing the checker or a person.
Potential impact. Built for protection caseworkers, where a wrong home town sends family tracing to the wrong place. The meeting pipeline is the same engine for the coordination meetings those teams already run. English and French.
Quality of the idea. We attacked a model first and turned each measured failure into a check. The model proposes with evidence, code judges the evidence, and the model is never asked to police itself. FieldGuard also flags what the model left out, which checking proposals alone cannot catch.

Limitations, stated plainly

The checks are rules for specific, measured failures. A failure we have not seen yet will not be caught by a rule written for another one.
"Possibly missed" uses cue words ("I'll", "agreed", "je vais"). A commitment phrased without one is not flagged.
Free text (a task, a decision, an injury) passes when most of its words appear in its quote, so a value that reuses the note's words in a misleading order can pass. A person still reviews the record.
Six notes is a small evaluation. The numbers show the mechanism works on real model output, not a rate.
Caution has a cost. Of 18 correct values Nemotron proposed, 13 went straight into the record; the rest were held for a person or left empty. A field Ultra could not support stays empty rather than guessed.
The place list covers the towns in our scenarios, not a full gazetteer.
All notes are invented. FieldGuard has not been used on real case data, and should not be until a protection team tests it under their own data rules.

What's next

A confirmation queue for caseworkers, voice input, and more languages in the cue lists. The same engine can sit under every TRACE profile (humanitarian, anti-trafficking and climate), and coordination meetings, where cluster partners agree who follows up on what, are a natural next use.

Testing instructions (for judges)

No login. Open https://fieldguard-nine.vercel.app.

The Meeting notes tab is open. Click Propose with Nemotron: a live call to Nemotron 3 Super on Token Factory, a few seconds. The table shows each proposed field, its quote from the note, and the checker's verdict with a reason. A field marked "Second pass by Nemotron 3 Ultra" was refused first and fixed on the re-read. Scroll to Possibly missed for lines the model left out. Live answers can vary from run to run.
Click Show the gate on an example to see the checker on a hand-written proposal full of known traps, without a model call.
Open the Field notes tab, click Show the gate on an example, then Confirm on the age row. The confirmed age appears in the record below.
Still in Field notes, choose EN · Unfamiliar town name and click Propose with Nemotron. Ngaoundal is a real town outside the place list, so it waits for a person to confirm the spelling.
At the top, Show the 6 notes lists the recorded Nemotron runs behind the headline numbers.

Every note on the page is invented. The demo allows 30 live calls per hour per visitor.

How we used NVIDIA Nemotron and Nebius Token Factory

Nemotron 3 Super is the proposer: for every note it returns each field with a value, a verbatim quote, the speaker and whether the note states it plainly or hedges. We chose Super because a proposal has to feel instant in a demo: live calls take about 2 seconds, at about 825 tokens per note including second passes. Nemotron 3 Ultra is the reviewer: it is called only when the checker refuses a field, with the note and the reason, and answers in under a second. Every call goes through Nebius Token Factory's OpenAI-compatible API, which let us use a standard client and keep the whole stack open source. Token Factory made the evaluation loop fast: we could run all six scenarios live, cache the answers and re-score them offline as we changed the checks, at a cost of a few cents.

Code (Apache-2.0): https://github.com/nathadjaho/fieldguard