Guardian LATAM: Early Detection of Hallucination Risk in Spanish-Speaking Multi-Agent AI Systems Using Consensus Geometry

Edwin Hernan Cedeño Vargas

Guardian LATAM is an AI Safety research project that explores whether disagreement patterns among independent AI agents can serve as an early warning signal for hallucination risk.

The system introduces Consensus Geometry, a lightweight framework that analyzes semantic divergence, majority cohesion, contradiction signals, confidence spread, and escalation indicators to estimate hallucination risk before a final answer is delivered.

To evaluate the approach, we created the Guardian-LATAM Benchmark v1.0, a Spanish-language benchmark containing 120 prompts across government, legal, health, education, history, and AI safety domains.

Results show that Guardian LATAM achieved 90% overall accuracy, outperforming a single-agent baseline (50%) and a multi-agent majority baseline (75%), while achieving 100% detection of hallucination traps and safety escalation cases.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

Detecting hallucination is important. The value add of the new dataset isn't clear to me, as there are many hallucination-oriented benchmarks already. It's not clear whether the classification algorithm works, because you only reported performance on the new dataset, and didn't present the performance of a baseline.

The Spanish-language benchmark you built is the strongest part of this submission — 120 prompts grounded in Colombian civic, legal, and educational terminology (Registraduría, CONPES, acción de tutela, debido proceso) is a real artifact other Spanish-language safety researchers could reuse. The four-tier × six-domain structure is a clean design, and the honest, specific Limitations section plus open-source reproducible scripts raise the floor of the work.

Guardian LATAM is a lightweight hallucination-risk monitoring layer for Spanish-speaking multi-agent AI systems that estimates risk from five consensus signals (semantic divergence, majority cohesion, confidence spread, contradiction indicators, escalation phrases) derived from independent agent responses, avoiding the cost of a separate LLM judge. The authors introduce a purpose-built 120-prompt Spanish-language benchmark organized into four risk tiers across six civic and legal domains, reporting 90% overall accuracy and 100% on hallucination-trap and safety-escalation tiers. The motivating context — resource-constrained Latin American institutions that cannot afford expensive judge pipelines — is a genuinely underserved deployment scenario in the AI safety literature.

Strengths

1. The LATAM problem framing addresses a real and underserved gap. Safety evaluation infrastructure is overwhelmingly English-language and resource-intensive; targeting Spanish-language multi-agent deployments in civic, legal, and healthcare contexts gives this project immediate practical stakes.

2. The four-tier benchmark design (Known Facts → Uncertainty → Hallucination Traps → Safety Escalation) maps cleanly to a realistic threat model, and the REFUSE_OR_ESCALATE routing output goes meaningfully beyond binary hallucination detection toward an actionable safety interface.

Weaknesses

1. The risk-score weights in Eq. (3) are tuned on the same 120 prompts used to report 90% accuracy — there is no held-out test split, so the headline figure is an in-sample fit, not a generalization estimate. A simple fix: reserve 25–30 prompts before any tuning and report accuracy on that held-out set.

2. The perfect 100% scores on Tiers C and D are circular by design. The Tier D prompts were built with Spanish escalation phrases that trigger the system's hard-coded escalation override, and the Tier C prompts were built to produce agent disagreement — so these results confirm the triggers fire correctly, not that the system generalizes to hallucinations it wasn't designed around.

3. No baselines are included, so the 90% overall accuracy cannot be interpreted as evidence for Consensus Geometry over simpler alternatives. A keyword-only classifier or majority-vote baseline on the same agent outputs would immediately contextualize the figure.

4. The system's validity depends on the three agents producing independent responses, but their underlying models are never identified. If all agents share the same LLM, responses will be correlated and the divergence signal may be systematically suppressed regardless of actual hallucination — a direct threat to the core mechanism that can be addressed simply by disclosing model names and versions.

Guardian LATAM addresses a relevant need in low-resource contexts. Specifically, detecting hallucination risk in Spanish multi-agent systems without relying on an expensive LLM-as-a-judge. The consensus geometry framework is clearly explained and the lightweight implementation makes practical sense for public and educational institutions in LATAM. However, the work's most important limitation is not explicitly discussed. I see an issue in this: the benchmark was constructed by the same author who designed the system, with heuristic weights tuned on that same benchmark (which makes the 90% accuracy difficult to interpret as evidence of generalization). To give the results credibility, the most urgent next step is evaluating the system on an independent external benchmark, or on a held-out subset excluded during design. Additionally, replacing token-overlap similarity with multilingual embeddings (Sentence Transformers) and activating the Confidence Spread feature with calibrated agents would make the system substantially more robust.

Cite this work

@misc {

title={

(HckPrj) Guardian LATAM: Early Detection of Hallucination Risk in Spanish-Speaking Multi-Agent AI Systems Using Consensus Geometry

},

author={

Edwin Hernan Cedeño Vargas

},

date={

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Read More

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.