LLM 回答一个问题并附上引文:对每条主张,给出源文档的一个小节以及它所依据的引文。其中一些引文是错误的或幻觉出来的:引文可能压根不在文档里,也可能一字不差地躺在文档中,而它的上下文说的却是与主张相反的话。
人工逐条核对很慢:找到文档,在文档里找到引文,再读足够多的上下文来判断它是否支持该主张。
为了把这个检查自动化,我们先用普通的字符串匹配查找缺失的引文,再用一个 Choice 问题阅读每条幸存引文的上下文,判断它是否支持该主张。
下面,来自 LLM 关于 RFC 7519(JSON Web Token)的回答的八条引文会经过这项检查。四条准确的引文以 0.93 或更高的置信度返回 verified。植入的四个失败案例全部被抓到:一条捏造的引文、一条被反驳的主张,以及两条被送去人工处理的支持不足的引文。
check_citation() 是你在这里要构建的函数,它接收一份源文档和一条引文,返回四种判定之一:verified、unsupported、contradicted 或 fabricated。它还返回一个置信度,用来标记那些应该由人来看一眼的引文。
准备工作
pip install ipython "typesafe-sdk>=0.5.7" cooksafe --extra-index-url https://pypi.typesafe.ai/
然后设置 TYPESAFE_API_KEY。每个 API 调用都缓存在 json_cache.json 中,该文件随本实战指南一同提供,因此重新运行会重放已发布的数字,而不是调用 API。删除该文件即可全部实时运行。
下面的数字来自 2026-08-16 的 jev-1.12。
import json
import os
import re
from pathlib import Path
from time import perf_counter
from cooksafe import JsonCache, make_playground_link
from IPython.display import Markdown, display
from typesafe_sdk import Choice, TypeSafeClient
TYPESAFE_MODEL = "jev-1.12"
AUTO_ACCEPT = 0.8 # start high for more human review as you build trust in the model
client = TypeSafeClient(
api_key=os.environ.get("TYPESAFE_API_KEY", "cache-only"),
base_url=os.environ.get("TYPESAFE_ENDPOINT"),
timeout=120.0,
)
json_cache = JsonCache(Path("json_cache.json"))
加载源文档和引文
源文档是 RFC 7519(JSON Web Token),取自 rfc-editor.org,以 rfc7519.txt 的名字提交在本实战指南旁边。下面的代码去掉页眉和页脚,然后把文本按编号切分成小节。
citations.json 中的八条引文由 LLM 对照该 RFC 写出。四条是准确的;另外四条经过我们的编辑,无法通过检查。
def load_source() -> str:
"""RFC 7519 verbatim, minus the page headers and footers that interrupt its paragraphs."""
lines = []
for line in Path("rfc7519.txt").read_text().splitlines():
bare = line.lstrip("\f")
if re.match(r"Jones, et al\.\s.*\[Page \d+\]$", bare):
continue
if re.match(r"RFC 7519\s+JSON Web Token \(JWT\)\s+May 2015$", bare):
continue
lines.append(bare)
return re.sub(r"\n{3,}", "\n\n", "\n".join(lines))
def split_sections(source: str) -> dict[str, str]:
"""Map each numbered section ("4.1.3") to its text, split on the RFC's header lines."""
boundary = re.compile(r"(?m)^(?:(\d+(?:\.\d+)*)\. .+|Appendix [A-Z]\..*)$")
marks = list(boundary.finditer(source))
sections = {}
for mark, nxt in zip(marks, marks[1:] + [None]):
if mark.group(1) is None: # an appendix header only terminates the section before it
continue
sections[mark.group(1)] = source[mark.start() : nxt.start() if nxt else len(source)].strip()
return sections
SOURCE = load_source()
SECTIONS = split_sections(SOURCE)
CITATIONS = json.loads(Path("citations.json").read_text())
print(f"{len(SOURCE):,} characters, {len(SECTIONS)} numbered sections, {len(CITATIONS)} citations")
print("\nA citation with a quote:")
print(json.dumps(CITATIONS[1], indent=2))
print("\nA claim-only citation:")
print(json.dumps(next(c for c in CITATIONS if c["quote"] is None), indent=2))
58,365 characters, 45 numbered sections, 8 citations
A citation with a quote:
{
"id": "aud_reject",
"claim": "If a validator does not find itself in a token's audience list, it has to reject the token.",
"quote": "If the principal processing the claim does not identify itself with a value in the \"aud\" claim when this claim is present, then the JWT MUST be rejected.",
"section": "4.1.3"
}
A claim-only citation:
{
"id": "iat_future",
"claim": "The \"iat\" claim requires validators to reject tokens whose issue time is in the future.",
"quote": null,
"section": "4.1.6"
}
在源文档中查找每条引文
不在源文档中的引文就是捏造的,查明这一点不需要任何模型。先把空白字符和弯引号归一化,让引文在 RFC 的换行处依然能够匹配,然后把它当作子串去查找。匹配还会指出引文来自哪个小节,而该小节就是下一步模型要读的文本。
一条引文可以只指明小节而不引用其中的任何内容。这种情况下没有东西可匹配,于是直接取引文所指的小节,交给模型。
def normalize(text: str) -> str:
"""Collapse whitespace and fold curly quotes, so a quote matches across line wraps."""
table = str.maketrans({"“": '"', "”": '"', "‘": "'", "’": "'"})
return re.sub(r"\s+", " ", text.translate(table)).strip()
def find_quote(sections: dict[str, str], quote: str) -> str | None:
"""The number of the section that contains the quote verbatim, or None."""
needle = normalize(quote)
for number in sorted(sections, key=lambda n: [int(p) for p in n.split(".")]):
if needle in normalize(sections[number]):
return number
return None
def locate(sections: dict[str, str], citation: dict) -> tuple[str, str | None]:
"""Step 1 for one citation: a status, plus the section step 2 will read."""
if citation["quote"] is None:
return "section-only", sections[citation["section"]]
number = find_quote(sections, citation["quote"])
if number is None:
return "missing", None
return "found", sections[number]
for citation in CITATIONS:
status, section = locate(SECTIONS, citation)
where = f"section of {len(section):,} chars" if section else "not in the source"
print(f"{citation['id']:<18}{status:<14}{where}")
epoch_seconds found section of 3,122 chars
aud_reject found section of 761 chars
sig_reporting missing not in the source
clock_skew found section of 529 chars
exp_required found section of 529 chars
pii_encryption found section of 1,653 chars
iat_future section-only section of 270 chars
duplicate_names found section of 918 chars
核实源文档是否支持该主张
到这里仍保有引文的引证已经与源文档逐字匹配。但这还不够:引文本身可以是准确的,而建在它之上的主张仍然是错的。要判定这一点,需要引文的上下文,也就是第 1 步找到的那个小节。
每条幸存的引文对应一个 Choice 问题,覆盖小节与主张之间的三种关系。
概率最高的选项就是判定结果,而 AUTO_ACCEPT(上面代码中为 0.8)决定它的去向:
- 置信度不低于 0.8:判定自行生效;
- 低于 0.8:在任何东西依据判定采取行动之前,先由人来确认。
从高值起步,随着你观察模型在你自己文档上的表现再调低阈值。
QUESTIONS = {
"relation": Choice(
instructions="How does the section relate to the claim?",
criteria={
"supports": "The section states the claim or directly implies that it is true",
"contradicts": "The section states the opposite of the claim or implies it is false",
"says_nothing": "The section does not address what the claim asserts, either way",
},
),
}
RELATION_TO_VERDICT = {
"supports": "verified",
"contradicts": "contradicted",
"says_nothing": "unsupported",
}
@json_cache
def ask(claim: str, section: str) -> dict:
started = perf_counter()
response = client.system_one(
state={"claim": claim, "section": section},
questions=QUESTIONS,
model=TYPESAFE_MODEL,
)
answer = response.answers["relation"]
return {
"choice": answer.choice,
"probabilities": answer.probabilities,
"confidence": answer.confidence,
"seconds": round(perf_counter() - started, 2),
"input_tokens": response.usage.input_tokens or 0,
"output_tokens": response.usage.output_tokens or 0,
}
def verdict(status: str, answer: dict | None) -> dict:
"""Fold step 1 and step 2 into one of the four labels, plus an auto-or-review flag."""
if status == "missing":
# confidence None: no model was called, so there is no model confidence to report
return {"verdict": "fabricated", "confidence": None, "auto": True}
return {
"verdict": RELATION_TO_VERDICT[answer["choice"]],
"confidence": answer["confidence"],
"auto": answer["confidence"] >= AUTO_ACCEPT,
}
def check_citation(sections: dict[str, str], citation: dict) -> dict:
status, section = locate(sections, citation)
answer = ask(citation["claim"], section) if section is not None else None
return {"id": citation["id"], "status": status, "answer": answer, **verdict(status, answer)}
检查全部引文
全部八条引文经过同一套检查:
print(f"{'citation':<18}{'quote':<14}{'relation':<14}{'conf':>6} {'verdict':<13}{'action':>7}")
for citation in CITATIONS:
result = check_citation(SECTIONS, citation)
answer = result["answer"]
relation = answer["choice"] if answer else "-"
conf = f"{answer['confidence']:.2f}" if answer else "-"
action = "auto" if result["auto"] else "review"
print(
f"{result['id']:<18}{result['status']:<14}{relation:<14}{conf:>6}"
f" {result['verdict']:<13}{action:>7}"
)
citation quote relation conf verdict action
epoch_seconds found supports 0.93 verified auto
aud_reject found supports 0.95 verified auto
sig_reporting missing - - fabricated auto
clock_skew found supports 0.99 verified auto
exp_required found contradicts 0.99 contradicted auto
pii_encryption found says_nothing 0.27 unsupported review
iat_future section-only says_nothing 0.56 unsupported review
duplicate_names found supports 0.99 verified auto
四条引文返回 verified,一条 fabricated,一条 contradicted,两条 unsupported。
epoch_seconds、aud_reject、clock_skew和duplicate_names是准确的四条。它们全部以 0.93 或更高的置信度返回verified,远高于AUTO_ACCEPT。sig_reporting根本没到模型那里。它的引文不在 RFC 中,仅凭字符串匹配就把它标记为fabricated。exp_required逐字引用了 4.1.4 节,而同一节里写着 "Use of this claim is OPTIONAL",因此它是contradicted,置信度 0.99。pii_encryption和iat_future分别以 0.27 和 0.56 返回unsupported,都低于阈值,因此都被送去人工处理。pii_encryption说明了为什么光有字符串匹配不够:它的引文逐字存在于源文档中,而它所在的小节对主张只字未提。
要把它指向你自己的数据,替换 rfc7519.txt 和 citations.json 即可。load_source() 和 split_sections() 是按 RFC 的版式写的,另一种形状的文档需要自己的解析逻辑。
归一化之后的字符串匹配是精确匹配:被截断或轻微改写的引文会返回 fabricated。如果生产系统要容忍不严格的引用,就需要改用模糊匹配。
在 Playground 中打开
链接里装着一条引文的主张和小节,外加问题。打开它即可在浏览器中实时运行同一次调用。
example = next(c for c in CITATIONS if c["id"] == "exp_required")
_, example_section = locate(SECTIONS, example)
playground_link = make_playground_link(
{"claim": example["claim"], "section": example_section}, QUESTIONS, models=[TYPESAFE_MODEL]
)
display(Markdown(f"🔗 [Open one citation's claim + section in the TypeSafe playground]({playground_link})"))