AI Agent Red Team (LLM) — Making Hallucination Structurally Impossible

Product

A venture and industry research system that answers one question rigorously: should this idea actually be built. Ask a single LLM that question and it writes a fluent, confident, agreeable essay - it sounds like analysis but is pattern completion wearing a suit. The system exists to make that failure mode structurally impossible, replacing single-model judgment with an 8-stage pipeline: evidence grounding, a six-role specialist council, adversarial red-teaming on a stronger model, and mechanical gates that do not care how confident the prose sounds.

Problem

Every claim in an AI-generated research report has three ways to go wrong: it can be ungrounded (invented, not retrieved), it can be shallow (one model skimming everything instead of going deep on anything), or it can be self-graded (the same model that found the evidence also decides if the evidence is good enough). Any one of these alone produces a report that looks legitimate and is not. The system is built around a single refusal: no stage gets to both generate a claim and judge it.

My role

Sole architect and builder - system design, multi-model orchestration, anti-hallucination architecture, and the production incident response that hardened the design.

Scope

End-to-end pipeline architecture across evidence retrieval, a six-role specialist council, adversarial review, mechanical verdict validation, and delivery. Roughly 15+ venture-validation reports generated in production use, cutting research time per report from 3-4 hours to under 30 minutes.

AI stack

The cost architecture follows the risk architecture: cheap models absorb high-volume narrow extraction work, the stronger model is reserved for the two calls that actually need it, and it runs at effectively no marginal cost since it is subscription-based rather than metered.

• Specialist roles: Free-tier LLMs, task-matched per specialist role (faithful extraction, quantitative reasoning, broad world knowledge, with a fallback chain per role).
• Adversarial review + report writing: Claude Sonnet, run through a subscription CLI rather than the metered API, reserved for the two jobs where a weak model is actively dangerous rather than just lower quality.
• Persistence + delivery: Supabase for persistence, Telegram for delivery.
• Verdict validation: Mechanical Python gates for verdict validation - no LLM judgment in the check itself.

Approach

Three anti-hallucination layers stack on top of each other. None is sufficient alone.

1. 1Grounding: Every claim traces back to a shared evidence corpus built once per idea (web search, forum pulls, a recency-scoped pass, full page extraction, competitor dossiers), not to anything recalled from training data.
2. 2Decomposition: Six specialists, each owning exactly one question (demand, market, competition, feasibility, economics, external), with explicit boundaries on what they are not allowed to touch. No redundancy means a failed role is a visible missing dimension, never quietly smoothed over.
3. 3Adversarial review and mechanical rails: A genuinely stronger model tries to kill the thesis (hidden assumptions, contradictions, thin evidence, anything the six roles missed), then plain code checks that the final verdict did not outrun what the evidence supports - a fixed verdict vocabulary, a kill-likelihood ceiling on how strong a verdict is allowed to be, and every quote checked token-for-token against the corpus.

The orchestrator itself is kept deliberately small: parse the idea, build the corpus, call each stage in order, run the gates, and make the two calls that genuinely need personal context. It does not write the report. That boundary was written into the code as a warning - and it is exactly the boundary that got violated in the incident below.

The pipeline

1. 01

   Idea

2. 02

   Evidence corpus

   grounding

3. 03

   Six-role MECE council

   decomposition

4. 04

   Red team review

   adversarial check, stronger model

5. 05

   Mechanical gates

   code, not LLM judgment

6. 06

   Report delivered

What broke

A production run bypassed the entire pipeline. Instead of the six-role council, the red team, and the mechanical gates each doing their job, the orchestrator wrote the full report itself, in one pass, with no gates in between - the exact single-model failure mode the whole architecture exists to prevent.

The tell was almost funny in hindsight: the report's verdict was labeled "STRONG SIGNAL," a value that does not exist anywhere in the actual verdict schema. The real pipeline only ever outputs a fixed set of values, extracted by regex and constrained against the red team's kill-likelihood score - so a verdict outside that vocabulary was, on its own, proof the mechanical rails never ran. Everything downstream was fabricated: an invented citation, untraceable competitor names, suspiciously precise unit-economics figures. It was not a research mistake. It was a fluent essay from a system quietly behaving like the single confident LLM it was built to avoid becoming.

What was fixed

The fix was not a smarter model. It was refusing to let any stage exit quietly. Every stage now has to prove it ran - attach its evidence trail, or explicitly say "no evidence found," with that treated as a legitimate, expected output rather than a failure the system tries to route around. The red team's mandate was expanded specifically to hunt for outputs that look complete but carry no attached verification trail - precisely the fingerprint the bypassed run left behind.

The broader principle: more roles and more specialization can look like more rigor while actually being less trustworthy than a single model forced to show its work, because complexity gives failure more places to hide, not fewer. At every handoff, a stage can only say one of two things - here is what was found and where it came from, or nothing was found and that is being stated plainly. Anything in between is where hallucination lives.

Outcome

• 6-role MECE specialist council, replacing an earlier same-prompt-redundancy design that added no real information
• 3 stacked anti-hallucination layers - grounding, decomposition, adversarial review with mechanical rails - none sufficient alone
• Mechanical, LLM-independent verdict gates constraining every report against its own evidence
• 15+ venture-validation reports generated in production, cutting research time per report from 3-4 hours to under 30 minutes
• A real production failure caught, diagnosed, and closed - hardening the system against the exact silent-failure mode multi-agent pipelines are most exposed to