## 3 Materials and Methods
The specific weights or rules allow tuning the system's sensitivity to different types of risks. * **Final Action Decision (Action, Resp_Final):** Based on the aggregated risk Risk_Agg and potentially the individual scores, the final action Action and final response Resp_Final are determined according to action policies P_Action. These policies define specific thresholds, Thresh_Modify and Thresh_Block, which delineate the boundaries for different actions. The final action Action is determined by comparing the aggregated risk against these thresholds: \[ \begin{array}{lcl}Action=&&\\ \mathit{ALLOW}&&if\;\mathit{Risk\_Agg}<\mathit{Thresh\_Modify}\\ \mathit{MODIFY\_LLM}&&if\;\mathit{Thresh\_Modify}<=\mathit{Risk\_Agg}<\mathit{ Thresh\_Block}\\ \mathit{BLOCK}&&if\;\mathit{Risk\_Agg}>=\mathit{Thresh\_Block}.\\ \end{array} \] (15)  
Subsequently, the final response Resp_Final delivered to the user is determined based on the selected Action:  
\[ \begin{array}{lcl}Resp\_Final=&&\\ \mathit{Resp^{\prime}}&&if\;Action=\mathit{ALLOW}\\ \mathit{SafetyLLM}(\mathit{Resp^{\prime}},\;\mathit{Scores\_RAM},\;\mathit{P\_Action})&&if\;Action=\mathit{MODIFY\_LLM}\\ \mathit{ErrorMessage(\"Blocked due to high risk\")}&&if\;Action=\mathit{BLOCK}.\\ \end{array}  \tag{16}\]  
ALLOW permits the (potentially OVM-modified) response Resp\({}^{\prime}\) to pass through to the user. MODIFY_LLM triggers a reformulation attempt, potentially invoking a separate, highly aligned \"Safety LLM\", which uses the original response Resp\({}^{\prime}\) and assessment scores Scores_RAM as input, guided by specific instructions in P_Action. BLOCK prevents the response from reaching the user, returning a predefined message indicating the reason for blockage. The specific thresholds (Thresh_Modify and Thresh_Block) and the implementation details of the modification strategy (SafetyLLM function) are crucial configurable elements within the action policy P_Action. This formal model provides a structured representation of the multi-stage validation and decision-making process inherent to the AVI framework. To validate this framework, a proof-of-concept (PoC) system was implemented as an independent academic research effort. The PoC utilized Python (version 3.10), FastAPI (version 0.110.0) for the API and orchestration, ChromaDB (version 0.4.22) for vector storage, the Sentence-Transformers library (version 2.5.1) with the all-MiniLM-L6-v2 model for text embeddings, Pandas (version 2.2.0) for data handling, and Scikit-learn (version 1.4.0) for metric calculations. The primary LLM for testing was Groke-2-1212, accessed via its public API [48]. This model was specifically chosen for the proof-of-concept due to its availability and, notably, its tendency to generate responses with fewer inherent restrictions or \"baked-in\" safety alignments compared to some other large-scale models [49; 50]. This characteristic, where some models are designed with more permissive default settings regarding content generation, provides a more challenging baseline for evaluating the effectiveness of an external filtering system like AVI, allowing for a clearer observation of the filter's impact in mitigating potentially problematic outputs. Development and testing were conducted on a standard desktop computer (Apple M1 Pro chip with 10-core CPU, 16-core GPU, and 16 GB Unified Memory) without dedicated GPU acceleration, focusing on architectural validation over performance optimization. The source code for this specific PoC implementation is maintained privately. The selection of an appropriate large language model (LLM) for evaluating the efficacy of an external guardrail system like AVI is crucial. To provide a challenging testbed, a model with relatively fewer built-in content restrictions is preferred as this allows for a clearer assessment of the guardrail's independent impact. Table 3 presents a qualitative comparison of several contemporary LLM families or their prominent representatives, including Grok (used in this study).