HaloGuard

A local-first hallucination firewall for LLM applications. HaloGuard sits between an LLM and the application consuming its output, scoring every response for hallucination risk before it reaches a user. Everything runs on the caller's machine -- no prompt, response, or context ever leaves the device.

Scoring modes

• Entailment mode (RAG-style): scores whether the response is supported by supplied source context, using an NLI cross-encoder (DeBERTa-v3-small).
• Consistency mode (no context): scores whether the response is internally consistent, using the same NLI model over the response's own claims.

Verdicts

Every check returns a FirewallResult with:

• score -- 0.0-1.0 hallucination risk (higher = more likely hallucinated)
• verdict -- PASS / FLAG / BLOCK / UNKNOWN
• reason -- human-readable explanation
• mode_used -- which scorer ran
• latency_ms -- how long the check took

UNKNOWN is the fail-open verdict returned when scoring itself fails and strict_mode=False (the default). Set strict_mode=True to fail closed instead.

Honest limitations

HaloGuard is defense-in-depth, not a guarantee. An adversarially crafted response can read as entailed/consistent to any NLI model while still being false. The measured false-negative rate on the golden benchmark is the real accuracy statement; treat HaloGuard as one layer in a safety stack, not the only one.

Development status

v0.1.0 -- early. See CHANGELOG.md.

License

MIT