## 3 Materials and Methods
Conceptually, the AVI Decision Process can be modeled as a sequence of transformations and decisions based on the outputs of its core modules. To formalize this workflow and the subsequent evaluation metrics, we introduce the following notation. Let R be the input request; let P represent the set of active policies governing the various AVI modules and resultant actions:  
Figure 1:1  
where each P_module (e.g., P_IVM for the Input Validation Module) defines the specific rules and thresholds for that module, and P_Action defines the overall decision logic. Further, let C be the retrieved context (if any), Resp_LLM the raw response from the downstream LLM, and Resp_Final the final output delivered to the user. The process unfolds through the following key steps:  
1. **Input Validation Score (Score_IVM):** The IVM module assesses the input request R against input policies P_IVM. This assessment yields a risk score, Score_IVM \(\in\) [0, 1], where 0 represents a safe input and 1 represents a high-risk input (e.g., detected high-severity prompt injection or forbidden content). This score can be derived from the maximum confidence score of triggered classifiers or the highest risk level of matched rules. The module may also produce a modified request R\({}^{\prime}\). Figure 1:2
2. **Context Retrieval (Context):** If the RAG mechanism is enabled by the policy P_CE (which governs the Contextualization Engine's operation) and potentially triggered by the initial request R or its risk score Score_IVM, the Contextualization Engine (CE) module retrieves relevant contextual information C. This context C typically consists of textual excerpts from a trusted knowledge base, intended to ground the LLM's subsequent response. The retrieval process is represented as follows: Figure 1:3 (10) where R\({}^{\prime}\) is the (potentially modified) input request from step 1 (Equation (8)), and P_CE encompasses the policies defining the RAG activation, source selection, and retrieval strategy. If no context is retrieved (e.g., RAG is disabled or no relevant information is found), C can be considered empty. 3. **LLM Interaction:** The base (downstream) large language model then generates a raw response, denoted as Resp_LLM. This generation process takes the (potentially modified) request R\({}^{\prime}\) and the retrieved context C (if any) as inputs: Figure 1:4 (11) Here, LLM(...) represents the generation function of the core language model. If context C is empty (i.e., no RAG-based context was provided), the LLM generates its response based solely on the request R\({}^{\prime}\). The Resp_LLM is the direct output from the LLM before any further AVI processing by the OVM or RAM modules. 4. **Response Quality Scores (Scores_RAM):** The RAM module assesses the raw response Resp_LLM potentially using context C and policies P_RAM. This yields multiple quality scores, for example, Hallucination_Prob \(\in\) [0, 1]: the probability of the response containing factual inaccuracies; Faithfulness_Score \(\in\) [0, 1]: the degree to which the response adheres to the provided context C (if applicable), where 1 is fully faithful; Relevance_Score \(\in\) [0, 1]: the relevance of the response to the initial request R: Figure 1:5 (12)
5. **Output Validation Score (Score_OVM):** The OVM assesses Resp_LLM against output policies P_OVM, yielding an output risk score, Score_OVM \(\in\) [0, 1], similar to Score_IVM (e.g., based on toxicity, PII detection, and forbidden content). It may also produce a potentially modified response Resp\({}^{\prime}\): Figure 1:6 (13)
6. **Risk Aggregation (Risk_Agg):** The individual risk and quality scores are aggregated into a single metric or vector representing the overall risk profile of the interaction. A simple aggregation function could be a weighted sum, where weights (w_i) are defined in P_Action: Figure 1:7More complex aggregation functions could use maximums, logical rules, or even a small meta-classifier trained on these scores.