Vort AI Systems
Model Architecture

vb0 combines a transformer-based foundation model with a proprietary orchestration layer, enabling it to reason, retrieve, execute tools, and generate structured outputs across legal, financial, and defence domains. The three-tier architecture — Foundation Model, Orchestration Engine, Application Layer — is designed so that no single component is a single point of failure.

• Foundation Model: transformer backbone with domain-specific fine-tuning
• Orchestration Engine: task routing, tool invocation, execution graph management
• Application Layer: document intelligence, structured output, compliance reporting

vb0 is not a general-purpose consumer AI. Every architectural decision is made for the operational environment it inhabits: high-stakes regulated industries requiring explainability, auditability, and zero external data exposure. Unlike cloud-dependent models, vb0's inference stack runs entirely within South African infrastructure.

The standard transformer processes sequences through alternating self-attention and feedforward sublayers, each wrapped with layer normalisation and residual connections. vb0 adopts a pre-norm (Pre-LN) variant that provides superior training stability at the parameter scales required for legal and financial reasoning.

Standard BPE vocabulary of 50,257 base tokens is augmented with 2,400 domain-specific tokens covering South African legal terminology (POPIA, FICA, Companies Act terms), financial instrument names, and regulatory identifiers. Domain tokenisation reduces average sequence length for legal documents by 18%, directly improving inference speed and context efficiency.

Token embeddings map discrete vocabulary indices to continuous vector representations. vb0 uses RoPE (Su et al., 2021) rather than learned or sinusoidal positional encodings — RoPE encodes position as a rotation of the key/query vectors, enabling superior extrapolation to sequence lengths beyond those seen during training.

Each head learns to attend to different aspects of the input: one head may specialise in entity coreference, another in clause-obligation relationships, a third in numerical spans. This parallelism is central to vb0's document understanding capability.

vb0 replaces the standard ReLU FFN with SwiGLU activation (Shazeer, 2020), which empirically improves performance on reasoning benchmarks. The hidden dimension is 8/3 × model dimension (rather than the standard 4×) to match parameter count while using the gated variant.

vb0 uses RMSNorm (Zhang & Sennrich, 2019) rather than full LayerNorm, omitting the mean-centering step. This reduces compute by ~7% with no measurable quality loss, an important consideration at the scale of continuous enterprise inference.

Without residual connections, gradient signal degrades exponentially with depth. At vb0's layer count, residual paths ensure that early layers receive sufficient gradient to learn domain-relevant low-level representations (tokenisation patterns, entity types) while later layers develop high-level reasoning.

Standard self-attention has O(n²) time and memory complexity with sequence length n. At 128K tokens, naive attention would require ~64 GB of memory for a single sequence — infeasible. Flash Attention (Dao et al., 2022) tiles computation to SRAM, reducing memory from O(n²) to O(n) while maintaining exact attention computation.

Multi-Head Attention (MHA) with h heads requires storing h sets of K and V matrices in the KV cache — expensive at long contexts. Grouped-Query Attention (GQA) uses g groups where g ≪ h, reducing KV cache by a factor of h/g with minimal quality loss. vb0 uses 8 KV groups with 32 query heads (4× reduction).

Kaplan et al. (2020) established that model loss follows predictable power laws with model parameters N and dataset size D. Hoffmann et al. (2022) refined this to show that compute-optimal training requires equally scaling N and D — the "Chinchilla" finding that smaller, better-trained models outperform larger under-trained ones.

Full fine-tuning of a large model requires storing gradients and optimiser states for every parameter — cost-prohibitive for frequent domain updates. LoRA (Hu et al., 2021) decomposes the weight update ΔW into a low-rank product BA where rank r ≪ min(m,n), reducing trainable parameters by 10,000× while matching full fine-tuning quality on domain tasks.

• Decoder-only (GPT-style): selected — autoregressive generation, strong in-context learning, unified training objective
• Encoder-decoder (T5-style): rejected — higher inference cost, complex training pipeline for domain tasks
• Encoder-only (BERT-style): rejected — unsuitable for generation; fine for classification but vb0 must generate structured outputs

Mixed precision training reduces memory consumption by 50% compared to FP32, enabling larger batch sizes and faster gradient computation. BF16 is preferred over FP16 for training because its wider dynamic range avoids loss spikes. Deployment uses INT8 quantisation via GPTQ, achieving 2× memory reduction with less than 0.5% quality degradation on legal benchmarks.

ERA (Evolutionary Reinforcement for Algorithms) integrates a large language model with tree-search optimisation (analogous to AlphaGo) to automatically propose, evaluate, and refine scientific software. The system tests thousands of code variations faster than any human expert and incorporates ideas from papers and textbooks without human intervention.

vb0 applies ERA-inspired tree search within its orchestration layer: when solving multi-step analytical tasks, the orchestrator generates candidate execution plans, simulates outcomes, and selects the plan with highest estimated task completion score before executing.

Brantley's research demonstrates that periodically resetting certain model weights during reinforcement learning from human feedback (RLHF) prevents the model from over-optimising the reward proxy while losing core language capabilities — a phenomenon known as reward hacking. Resets act as a regulariser, keeping the policy close enough to the SFT model that the reward model remains accurate.

vb0's RLHF pipeline incorporates reset schedules every 500 policy gradient steps during preference optimisation, with the reset target being the SFT checkpoint from the start of that training phase.

APEX+ (Agentic and Physical AI for Excellence) is a Harvard SEAS initiative to develop general-purpose agentic AI that can interface directly with physical laboratory instruments, scientific sensors, and robotic systems. The key insight is that agentic AI systems require fundamentally different architectural considerations from conversational models: they must handle partial observability, real-world latency, and irreversible physical actions.

vb0's orchestration layer draws from APEX+ principles: the execution graph models action reversibility, and the system defaults to safe, reversible actions when uncertainty exceeds a threshold.

Harvard SEAS researchers have pioneered physics-informed neural networks (PINNs) that embed known physical or domain constraints directly into the loss function, rather than expecting the model to learn them implicitly from data. This significantly reduces the data requirement for domain-specific tasks and improves generalisation to novel inputs within the domain.

vb0's legal and financial fine-tuning incorporates constraint loss terms that penalise outputs violating known legal rules (e.g., contradicting a statutory definition) — analogous to physics constraints in scientific ML.

The Center for Research on Computation and Society (CRCS) at Harvard conducted foundational research on when fairness and accuracy are complementary versus in tension. Their findings show that trade-offs depend strongly on the data distribution and the specific fairness criterion chosen — demographic parity, equalised odds, and calibration can all require different interventions and may conflict with each other.

A separate CRCS research line examined whether models can simultaneously satisfy fairness requirements and differential privacy guarantees. Their conclusion: trade-offs between fairness and privacy are sometimes necessary, but the nature of the trade-off can be precisely characterised and minimised through careful algorithm design.

Doshi-Velez's Inverse Transition Learning approach uses Bayesian inference to learn environment dynamics from observational data without explicit intervention — critical in healthcare where randomised experiments are unethical or impractical. The method produces calibrated uncertainty estimates over learned transition models, enabling safe policy optimisation.

Glassman's research establishes that well-designed AI interfaces leave users "stronger after using them" — they expand the user's own capabilities rather than creating dependency. This principle has concrete technical implications: the interface must make AI reasoning transparent, allow graceful override, and surface the AI's uncertainty prominently.

The MnemoMaker study from CHARM examined users' sense of ownership over outputs created with substantial AI assistance. Despite AI generating nearly equal contributions, users maintained high ownership — suggesting that the framing of AI as a tool rather than an author preserves human agency even under high AI output ratios.

Adaptive Transformer Programs (ATPs) treat attention heads as conditional computation units that can be dynamically activated or suppressed based on input complexity. This halts computation in heads that are not informative for a given input, reducing FLOPs by 15–23% while preserving performance on hard reasoning tasks where all heads contribute.

Standard self-attention captures pairwise relationships between tokens. Poly-attention extends this to model higher-order interactions, critical for long legal documents where obligation relationships span multiple independent clauses and cannot be captured by any single pairwise attention score.

Linear attention approximates the softmax kernel with a feature map φ such that φ(q)ᵀφ(k) ≈ exp(qᵀk/√d). This allows the attention computation to be reformulated as a product of φ(K)V computed once, then applied to each query — O(n·d) instead of O(n²·d).

When training on multiple domain tasks simultaneously, conflicting gradients from different tasks can slow or destabilise training. Gradient alignment methods (PCGrad, MGDA) project gradients to remove conflicting components, ensuring each update step is beneficial for all tasks.

CRCS research on preference datasets found that annotation quality — specifically the expertise and consistency of the annotators — is the largest single determinant of reward model quality, outweighing dataset size. A small dataset of expert annotations produces better reward models than a large dataset of crowd-sourced annotations for specialised tasks like legal document review.

The Berkman Klein Center's 2025 research on agentic AI governance establishes that when AI agents take real-world actions — sending emails, modifying databases, executing financial transactions — the standard accountability chain breaks down. New governance frameworks must explicitly model authorization scope, action reversibility, and multi-agent delegation chains.

Viégas and Wattenberg's transparency research demonstrates that attention visualisation, while not a complete explanation of model behaviour, provides valuable signals about which parts of an input the model relies on. Combined with counterfactual explanations, transparency tools significantly improve human-AI decision quality in high-stakes settings.

vb0's pre-training uses causal language modelling: the model learns to predict each token given all preceding tokens. This self-supervised objective requires no labelled data and scales effectively with corpus size and model parameters.

vb0's training corpus is assembled from South African legal databases (Jutastat, SAFLII), financial regulatory filings (JSE disclosures, SARB publications), enterprise process documentation, and high-quality general text. Domain-specific content is upsampled by 8× relative to its natural corpus frequency during pre-training.

• Legal: contracts, judgments, statutes, regulations (SA jurisdiction)
• Financial: JSE filings, SARB publications, audited annual reports
• Enterprise: operational procedures, compliance manuals, audit reports
• General: curated web text, Wikipedia, scientific papers

• N-gram deduplication at paragraph level using MinHash LSH
• Perplexity filtering via a small 125M reference model (remove top and bottom 10%)
• Language detection: SA English, SA legal Afrikaans retained; other languages filtered
• Toxicity classifier: remove content with P(toxic) > 0.8
• PII removal: regex + NER-based detection of personal information

Byte-Pair Encoding merges frequent character pairs iteratively to build a subword vocabulary. The domain extension adds legal and financial tokens that would otherwise be split into multiple subwords — reducing average document token count by 18% and improving attention efficiency on long contracts.

The preprocessing pipeline handles terabyte-scale corpora through distributed stream processing. Online shuffling with a 10⁶-document buffer prevents gradient collapse from document ordering bias. All preprocessing steps are deterministic given fixed random seeds, ensuring experiment reproducibility.

SFT dataset construction follows a three-stage process: template generation (automated), response generation (model-assisted), and expert review (human). Legal and compliance examples are reviewed by qualified attorneys; financial examples by chartered accountants. Chain-of-thought examples are included for all multi-step reasoning tasks.

Input tokens are masked from the loss. Label smoothing with ε=0.1 reduces overconfidence, improving calibration on out-of-distribution legal documents where the model should express appropriate uncertainty.

Weight decay is applied directly to parameters rather than through the gradient (decoupled), which avoids undesired interactions with adaptive learning rates. Hyperparameters: β₁=0.9, β₂=0.95, ε=10⁻⁸, λ=0.1.

Warmup runs for 2,000 steps (0 → η_max = 3×10⁻⁴) to allow gradient statistics to stabilise before large updates. Harvard SEAS finding: this schedule improves downstream task performance by 18% vs. linear decay alone.

Without clipping, occasional large gradient norms from complex training examples can destabilise training within a few steps. Clipping to c=1.0 provides a reliable bound on update magnitude. Adaptive clipping is used during fine-tuning phases to accommodate domain-specific data gradient scales.

The linear scaling rule suggests that learning rate should scale proportionally with batch size. vb0 ramps batch size from B=512 to B=4096 over the first 10% of training, allowing early iterations to explore the loss landscape efficiently before committing to large-batch updates. This schedule reduces the total number of optimizer steps required by 23%.

• Forward + backward pass: BF16 (8 exponent bits — wider dynamic range than FP16)
• Master weights: FP32 (full precision for parameter accumulation)
• Loss scaling: static scale of 2^15, halved on overflow
• Gradient reduction: FP32 all-reduce across nodes, then cast to BF16 for update
• Memory saving: ~50% vs. full FP32 training

• Data parallelism: identical model replicated across N nodes; each sees B/N samples per step
• Tensor parallelism (Megatron-LM style): weight matrices split column/row across GPUs within a node
• Pipeline parallelism: model layers partitioned across nodes; micro-batches fill the pipeline
• ZeRO-3: optimiser states, gradients, and parameters sharded across all data-parallel ranks
• Communication: NCCL collective operations (all-reduce, all-gather, reduce-scatter)

Storing all intermediate activations for backpropagation requires O(n·d) memory per layer. Gradient checkpointing stores only activations at selected checkpoint layers and recomputes intermediate values during the backward pass — reducing activation memory from O(n) to O(√n) at the cost of ~33% additional compute.

• Phase 1 (2T tokens): general text — web, books, Wikipedia, code
• Phase 2 (500B tokens): domain-upsampled — legal 8×, financial 5×, enterprise 3×
• Phase 3 (100B tokens): instruction format — question-answer pairs, structured extraction tasks
• Each phase evaluated on held-out domain benchmarks before advancing

After pre-training, the model undergoes SFT on 500K expert-reviewed examples. Training continues for 2 epochs over the SFT dataset. Learning rate is reduced to 10⁻⁵ with a shorter cosine schedule. Evaluation: held-out 5K examples scored by domain experts.

The RLHF pipeline trains a reward model on preference-labelled data, then uses PPO to update the policy to maximise expected reward while constraining divergence from the SFT model. Harvard SEAS research (Brantley §2.2) informs the reset schedule used in the PPO phase.

DPO (Rafailov et al., 2023) reformulates RLHF as a supervised learning problem over preference pairs, eliminating the need for a separate reward model and PPO training loop. vb0 uses DPO for the final alignment stage after an initial PPO pass, achieving stable convergence on legal preference tasks where PPO can oscillate.

vb0 generates text autoregressively: at each step, the model computes a probability distribution over the vocabulary conditioned on all previous tokens, samples or selects the next token, and appends it to the context. The KV cache stores key and value projections from all previous steps, avoiding recomputation of the prefix on every decode step.

• τ → 0: greedy decoding — always select the highest-probability token
• τ = 1.0: standard sampling from the model's learned distribution
• τ > 1: flattens distribution, more diverse/creative outputs
• vb0 default for structured extraction: τ = 0.2; for generation: τ = 0.7

Top-k sampling prevents very low-probability tokens from being selected, which can derail structured legal output. vb0 uses k=50 for free-form generation and k=10 for structured JSON extraction tasks.

Top-p is preferred over top-k for variable-entropy distributions: when the model is confident, V_p is small (near-greedy); when uncertain, V_p is large (more diverse). For vb0's legal reasoning tasks, p=0.9 balances coherence and coverage of valid legal formulations.

Beam search is used when vb0 generates structured documents (compliance reports, risk registers) where determinism and completeness matter more than diversity. Length normalisation with α=0.6 prevents the systematic bias toward shorter sequences.

Without KV caching, each decode step would require O(n) attention computation over the growing context — making inference cost O(n²) total. KV caching reduces decode attention to O(1) per step, achieving O(n) total cost.

Standard attention materialises the full n×n attention matrix in GPU HBM — bandwidth-bound and memory-intensive. Flash Attention (Dao et al., 2022) computes attention in tiles sized to fit in the GPU's fast SRAM, fusing the softmax, dropout, and matrix multiplication into a single kernel. This eliminates HBM reads/writes for the attention matrix, achieving 2–4× speedup on H100 GPUs.

A small 7B "draft" model generates candidate token sequences (typically 4–8 tokens ahead). vb0's full model then verifies all candidate tokens in a single parallel forward pass — accepting tokens that match its distribution and rejecting the first divergent token. Net speedup is 2–3× with negligible quality loss.

• GPTQ: minimise L2 error between quantised and original weight matrices using inverse Hessian
• AWQ: activation-aware quantisation — protect salient weights identified by activation magnitude
• INT8: 8-bit symmetric quantisation — 2× memory vs. BF16
• INT4: 4-bit quantisation for edge deployment — 4× memory, ~1-2% quality loss on legal benchmarks
• QLoRA: quantise base model to NF4, then add FP16 LoRA adapters for fine-tuning

Static batching waits until a fixed batch size is assembled before starting inference. Continuous batching inserts new requests into the batch at any decode step and evicts completed sequences immediately, maintaining near-100% GPU utilisation. This achieves 10–20× throughput improvement over static batching at equivalent latency SLAs.

KV cache memory is allocated in fixed-size pages (analogous to OS virtual memory) rather than contiguous tensors. This eliminates memory fragmentation from variable-length sequences, allowing the serving system to pack many more concurrent sequences into available HBM. vb0's serving layer uses 16-token KV pages, achieving 85% HBM utilisation vs. 40% with contiguous allocation.

Large weight matrices are partitioned: the attention projection W_Q, W_K, W_V are split column-wise across T GPUs; W_O is split row-wise. Each GPU computes a partial output, and an all-reduce communication collects the full result. vb0 inference on 4×H100 GPUs uses tensor parallel degree T=4.

Time-to-first-token (TTFT) is dominated by the prefill phase — computing attention over the entire input context. vb0 parallelises the prefill across all available GPUs to minimise TTFT for long inputs, a critical SLA factor for document review workflows.

Harvard SEAS research on sustainable AI found that sparse attention mechanisms can reduce energy by up to 45% beyond quantisation savings alone. vb0's 2027 roadmap includes adaptive sparsity targeting 60% energy reduction relative to the current baseline.

The orchestration layer sits between the raw model and the application interface. It classifies incoming tasks, allocates them to the appropriate execution strategy, manages intermediate state, and assembles the final output. This layer adds less than 8ms latency overhead — within enterprise real-time SLA budgets.

• Task types: QA, Generation, Analysis, Action, Multi-step
• Confidence thresholding: uncertain inputs (P < 0.72) escalated to human review
• Fine-tuned on 200K labelled enterprise request examples
• Calibrated: stated confidence correlates with empirical accuracy at ρ = 0.94

• Registered tools: code execution sandbox, SQL query engine, document fetcher, vector store retriever, external API gateway
• Tool selection: cosine similarity between task embedding and tool description embedding
• Permission checks: every tool invocation verifies caller scope and data classification
• Schema: JSON-RPC 2.0 compatible tool call format
• Audit: every tool call logged — tool name, arguments, caller, timestamp, result hash

Dynamic graph expansion allows new nodes to be inserted mid-execution — for example, if a document retrieval node returns a result that triggers a compliance check, the compliance check node is added to the DAG and scheduled without restarting the graph.

• Ready queue: nodes with all dependencies satisfied, sorted by CP estimate
• Worker pool: parallel execution threads consume ready queue
• Completion: parent nodes notified; new ready nodes enqueued immediately
• Timeout: each node has a budget; overflow triggers deterministic fallback

• Short-term: sliding context window with importance-weighted compression for overflow
• Long-term: vector store with HNSW index; cosine similarity retrieval
• Write-through cache: writes to both short-term context and long-term store simultaneously
• Eviction: least-recently-accessed embeddings evicted from in-memory HNSW when capacity reached

vb0 retrieves the top-20 candidate documents by embedding similarity, then applies a cross-encoder reranker to select the top-5. The cross-encoder jointly encodes query and document, capturing fine-grained relevance signals that bi-encoder retrieval misses.

When a session's accumulated context approaches the 128K token limit, vb0 scores earlier turns by attention weight magnitude (a proxy for their contribution to recent outputs) and compresses low-salience turns into brief summaries. High-salience content (referenced clauses, established facts, user constraints) is preserved verbatim.

• Retry with exponential backoff: 3 attempts at 100ms, 400ms, 1600ms
• Tool chain fallback: primary tool → secondary tool → rule-based computation
• Circuit breaker: tool suspended after 5 consecutive failures; reinstated after 60s health check
• Human escalation: tasks with no successful fallback route to the review queue

Complex tasks may be decomposed across multiple specialised agents: a legal analysis agent for clause extraction, a risk quantification agent for scoring, and a report generation agent for output formatting. Agents communicate through a structured JSON message protocol; shared state is maintained in the distributed key-value store with optimistic concurrency control.

• Result collection: gather outputs from all completed DAG leaf nodes
• Conflict resolution: deterministic merge rules resolve contradictions (more specific overrides general)
• Format transformation: raw model outputs → structured JSON → formatted PDF/DOCX via template engine
• Schema validation: output checked against predefined JSON schema before delivery

• Trace ID: every request tagged with a unique trace ID propagated across all service calls
• Span per orchestration step: duration, input/output hashes, tool calls, errors
• Metrics: request rate, latency percentiles, error rate, tool call frequency
• Immutable audit log: append-only, cryptographically chained, 7-year retention

• Formats: PDF (native + scanned), DOCX, HTML, XML, plain text
• OCR fallback: Tesseract 5 for scanned documents; deskew + denoise preprocessing
• Layout analysis: detect tables, headers, footnotes, margin annotations
• Structure extraction: section hierarchy, clause boundaries, paragraph numbering

A domain-fine-tuned sequence labelling model segments document text at four levels: Section → Subsection → Clause → Sub-clause. Conjunction patterns, numbered list detection, and heading recognition provide high-precision boundary detection on South African contract formats.

Each extracted clause is embedded and compared against the template library. Clauses with sim < 0.78 are flagged as non-standard. The system then applies a cross-encoder to rank non-standard clauses by deviation severity.

Applied at Scale

Processes thousands of documents per minute with clause-level precision

• Liability exposure: clauses that create unbounded financial obligations
• Ambiguity: clauses with high syntactic uncertainty (multiple valid parse trees)
• Missing clauses: mandatory provisions absent from the document
• Non-standard terms: deviations from approved templates above severity threshold

A domain-specific NER model extracts structured entities from document text: party names, obligation types (shall, must, agrees to), monetary amounts with currency, dates and durations, and governing law jurisdictions. Relation extraction then links entities — "Party A shall pay Party B ZAR 500,000 within 30 days" becomes a structured triple in the document knowledge graph.

• Version diff: clause-level change detection across document versions (not character diff)
• Semantic drift: clauses that appear identical but shifted meaning across contexts
• Counterparty analysis: compare received contracts against known counterparty document databases
• Jurisdiction mapping: flag clauses valid in one SA jurisdiction but not another

• POPIA (Protection of Personal Information Act): data processing clauses, consent mechanisms, retention periods
• FICA (Financial Intelligence Centre Act): KYC obligations, reporting thresholds, record-keeping
• Companies Act 71 of 2008: director obligations, shareholder rights, fiduciary duties
• NDA validity: compliance with common law requirements for enforceable confidentiality agreements

Financial documents contain critical structured data embedded in natural language prose. vb0's extraction pipeline uses schema-guided decoding — the model is constrained to generate JSON output matching a predefined schema for each document type — ensuring machine-readable output without post-processing parsing.

• Executive summary: 150-word plain-language summary of key risks and recommendations
• Risk register: tabular output — risk ID, clause reference, category, severity score, recommended action
• Evidence citations: every finding linked to the exact clause that generated it
• Audit trail: cryptographic hash of input document + model version + output document for tamper detection
• Formats: PDF (print-ready), DOCX (editable), JSON (API consumers)

• Input safety: prompt injection detection, adversarial pattern matching, rate limiting
• Model-level constraints: constitutional principles embedded in training; DPO alignment
• Output safety: factual consistency checking, citation validation, hallucination detection
• Tool access control: every tool invocation requires explicit scoped authorisation
• Audit: immutable log of all inputs, outputs, tool calls, and override events

• Accuracy before speed: do not sacrifice correctness for response latency
• Escalate uncertainty: when confidence is low, surface the uncertainty rather than confabulate
• Never fabricate citations: legal and statutory citations must be verified against authoritative databases before inclusion
• Scope discipline: do not act beyond the explicitly authorised task scope
• Human primacy: in all high-stakes decisions, recommend — do not decide

• Prompt injection detection: pattern matching + semantic classifier for injection attempts
• Jailbreak detection: fine-tuned classifier trained on red-team adversarial examples
• PII detection: regex + NER-based identification before any external logging
• Rate limiting: IP + API key based throttling; burst detection triggers CAPTCHA or block

vb0's output filter applies three checks: (1) claim-source consistency — every factual claim in the response must be traceable to a retrieved document or training knowledge with calibrated confidence; (2) citation accuracy — statutory references checked against the official SA legal database; (3) hallucination score — a specialised classifier assigns a hallucination risk score; responses above threshold are regenerated or escalated.

• Every tool invocation requires a scoped authorisation token (scope = tool × data classification × time window)
• Blanket authorisation is not accepted — each invocation must match an active, specific scope
• Audit: tool name, arguments, authorisation token, response summary, latency — all logged immutably
• Real-time revocation: tool access can be suspended within one polling cycle (< 1s)
• Harvard Berkman Klein (§2.15): every autonomous action must have traceable human authorisation

Output distribution entropy above threshold τ indicates the model is uncertain. Rather than generating a confident but potentially wrong response, vb0 routes to a deterministic fallback: a rule-based template response that acknowledges the task but declines to speculate.

• Each log entry: input hash, model version ID, tool calls, output hash, user ID, timestamp, latency
• Cryptographic chain: each entry includes hash of previous entry (blockchain-style tamper detection)
• Retention: 7 years for financial and legal use cases (FICA requirement)
• Access control: role-based; access to audit logs itself is audited

• Jailbreak resistance: tested against 2,400 adversarial prompts across 12 attack categories
• Prompt injection: 0 successful injections in production red-team exercise (n=500 attempts)
• Paraphrase stability: output consistency under semantically equivalent paraphrases (variance < 3%)
• Perturbation robustness: performance degrades < 2% under character-level noise typical of OCR output

vb0 is evaluated for demographic parity and equalised odds across SA's language communities (English, Zulu, Xhosa, Afrikaans, Sesotho) and across company size (SME vs. large enterprise). Following Harvard CRCS guidance (§2.5), fairness metrics were chosen in consultation with domain experts.

• Attention maps: visualise which document sections most influenced each output clause
• Counterfactual explanations: 'what would change this risk classification?'
• Confidence scores: per-field confidence displayed prominently alongside every AI-generated value
• Evidence citations: every finding links to the exact source clause or statutory reference

• Risk threshold: risk scores above 0.82 trigger mandatory human review before output delivery
• Uncertainty escalation: confidence below 0.72 on any field escalates that field for human verification
• Override logging: every human override recorded with reviewer ID, reasoning, and timestamp
• Post-decision audit: random sampling of 5% of all AI-only decisions for quality assurance review

• Pre-deployment: capability evaluation + red-team + legal review + bias assessment
• Post-deployment: drift detection (KL divergence between output distribution and baseline > 0.05 triggers review)
• Incident response: defined playbook — detect, contain, assess, remediate, communicate
• Model versioning: every deployed model version pinned with hash; rollback < 15 minutes

All defence-adjacent applications of vb0 require pre-engagement legal and export review. vb0 does not engage with sanctioned jurisdictions, non-state armed groups, embargoed parties, or activities that violate international humanitarian law. This constraint is both policy and technically enforced — the system maintains a real-time sanctions screening layer against the UN, EU, and OFAC consolidated lists.

• Inference: runs on SA-domiciled GPU infrastructure
• Storage: all document data encrypted at rest (AES-256) in SA data centres
• Transit: TLS 1.3 with certificate pinning for all API connections
• Key management: HSM-based key custodian, SA-domiciled, no cloud provider access to keys
• POPIA compliance: data subject access, correction, and deletion rights fully implemented

vb0 is evaluated exclusively on tasks representative of its deployment environment. General academic benchmarks (MMLU, HellaSwag) measure breadth; vb0's benchmarks measure depth in the legal, financial, and enterprise domains where it is actually used. Following the ERA principle (Brenner, §2.1), all automated benchmarks are cross-validated against human expert judgment before publication.

The benchmark covers: clause identification, risk classification, obligation extraction, and compliance checking (does this NDA comply with POPIA requirements?). vb0 surpasses junior attorney performance on all four sub-tasks.

This benchmark tests whether vb0 can find and extract specific information from very long contracts. The 128K context window enables processing entire contract packages as a single context without chunking, which would otherwise introduce retrieval errors.

Chain-of-thought reasoning improves vb0's financial reasoning accuracy by 14.2 percentage points over direct output generation. Harvard CS197 principle: AI benchmarks must measure reasoning processes, not just answer accuracy.

Time-to-first-token (TTFT) is the primary user-perceived latency metric for document review tasks. P95 output latency of 2.1s for a 512-token response comfortably meets enterprise synchronous API SLA requirements (typically 5s).

Harvard SEAS sustainable AI research demonstrates that sparse attention activation can reduce energy consumption by 45% beyond quantisation savings. vb0's 2027 roadmap targets adaptive sparsity combined with INT4 weight quantisation.

• Remove orchestration layer: −31% task completion quality
• Remove RAG: −18% accuracy on citation-dependent tasks
• SFT-only (no RLHF): −22% score on expert preference evaluation
• Remove domain fine-tuning: −34% on SA legal benchmark
• Remove gradient alignment (§2.13): +22% training time to equivalent loss

Evaluators were shown outputs without knowing which was from vb0, a general frontier model, or a human professional — ensuring unbiased preference judgments. vb0 is preferred over a general frontier LLM in 73% of enterprise task comparisons.