## 3 Materials and Methods
It utilizes text-embedding models (e.g., sentence-transformers/all-MiniLM-L6-v2 [46] as used in the PoC) and a vector database (e.g., ChromaDB [47] as used in the PoC) with k-NN search. AVI's CE supports both explicit rule-document links (for curated context based on triggered rules) and implicit query-based similarity search against a general knowledge base. An Orchestration Layer manages this workflow, implementing a multi-stage \"traffic light\" decision logic. Based on validation outputs from IVM, RAM, and OVM against configured policies, it determines the final action: ALLOW (pass through), BLOCK (reject request/response), MODIFY_RAG (add context before LLM call), or MODIFY_LLM (request reformulation by a Safety LLM). Figure 2: Diagram illustrating the Compound AI concept. Source: made by authors. AVI's adaptability relies on its configurable Policy Management Framework. Policies define the rules (keywords, regex, semantic similarity, and classifier outputs), sensitivity thresholds, and corresponding actions (block, mask, log, reformulate, and add context) for each module. While the PoC utilized CSV files for simplicity, the framework conceptually supports more robust formats (JSON, YAML, and databases) suitable for complex, potentially hierarchical or context-dependent policies [47]. Critically, the dynamic nature of LLM risks and information necessitates continuous policy maintenance. Effective deployment requires human oversight and curation by a dedicated team or individual responsible for monitoring emerging threats (e.g., new prompt injection techniques), adapting ethical rules to evolving norms, maintaining the factual grounding knowledge base for RAG, analyzing system logs for refinement, and managing rule-context links. This human-in-the-loop approach ensures the long-term relevance and effectiveness of the AVI system. **Performance Metrics** include Latency, which quantifies the additional processing time introduced by the AVI system. This overhead is a critical factor for user experience and is calculated as follows:  
\[L\_AVI=L\_Total-L\_LLM,\text{ measured in ms} \tag{1}\]  
and Throughput (requests per second, RPS). Equation (1) defines the latency directly attributable to AVI (L_AVI). Here, L_Total is the total response time experienced by the end-user when the request is processed through AVI, and L_LLM is the baseline inference time of the downstream LLM when called directly (without AVI). Minimizing L_AVI is essential for ensuring AVI's practicality in real-time interactive applications. **Validation Quality Metrics** for AVI's classification tasks (such as detecting toxicity, PII, or prompt injection attacks) are derived from the Confusion Matrix elements: True Positives  
Figure 3: Flowchart diagram illustrating the orchestration logic (“traffic light”). Source: made by authors. (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). Accuracy is a general measure of correct classifications:  
\[\frac{(TP+TN)}{(TP+TN+FP+FN)}. \tag{2}\]  
As shown in Equation (2), Accuracy represents the proportion of all instances correctly classified by an AVI module. For example, in toxicity detection, TPs are toxic items correctly flagged, TNs are safe items correctly passed, FPs are safe items wrongly flagged as toxic (Type 1 error), and FNs are toxic items wrongly passed as safe (Type 2 error). While intuitive, accuracy can be less informative for imbalanced datasets, necessitating other metrics. **Precision** is used to evaluate how many of the items flagged by AVI as positive (e.g., harmful content) are actually positive:  
\[\frac{TP}{(TP+FP)}. \tag{3}\]  
Equation (3) calculates Precision. In the operational context of AVI, high precision is crucial as it signifies a low rate of false positives; for instance, ensuring that when AVI intervenes by flagging or blocking content, such actions are predominantly applied to genuinely problematic instances, minimizing disruption to legitimate user interactions. (TP and FP are defined under Equation (2)).