Aegis

RAG pipelines fail quietly. The model retrieves something close enough, answers confidently, and nobody notices the claim wasn't actually in the sources. Frontier models are better at this, but they cost far more per token, and you're still trusting the model to police itself.

Aegis moves that policing out of the model and into the pipeline, so it works the same regardless of which model is behind it.

• Query decomposition: complex, multi-hop questions are broken into sub-questions that can each be answered from evidence.
• Hybrid retrieval and cross-encoder reranking: dense and lexical retrieval over Qdrant, reranked so the best evidence is actually what the model sees.
• NLI verification: each generated claim is checked against its retrieved evidence with natural-language inference.
• Abstain over hallucinate: if a claim can't be supported, the harness says so rather than guessing, and every supported claim carries a citation.

Those rules were enforced across 40,000 generations during evaluation.

With Aegis wrapped around it, Llama 3.1 8B reached near-parity with GPT-5.4 and Claude Opus 4.8 on multi-hop QA, cutting operating cost by up to 19× against a 25× per-token price gap.

I didn't want a lucky run, so results were validated with multi-seed, significance-tested runs across four models, tracked in MLflow.

The same layered structure makes a good defense surface. Against a suite of direct and indirect prompt-injection attacks, attack success dropped from 80% to under 10%.

• Designed and built a full evaluation harness, not just a demo: decomposition, retrieval, verification, abstention, citations.
• Made a small open model competitive with frontier models on a hard task, and proved it with statistics.
• Treated security as a measured property, with a before/after number.