llm-layered-defense 0.2.0__tar.gz

llm_layered_defense-0.2.0/.gitignore

@@ -0,0 +1,170 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script to a directory where the package
+#  is being installed etc.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tosca/
+.pytest_cache/
+.unittest_cache/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.nox/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or app, you might want to share your .python-version if you
+#   use pyenv and want other developers to use the same version of Python
+#.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if used with a venv it might be ignored.
+#Pipfile.lock
+
+# poetry
+#   Similar to Pipfile.lock, poetry.lock is generally recommended to be committed.
+#poetry.lock
+
+# pdm
+#   Similar to Pipfile.lock, pdm.lock is generally recommended to be committed.
+#.pdm-python
+#.pdm-build/
+
+# PEP 582; dependency directory created by pipflow via profile, pdm, etc.
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath vars
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# OS-specific files
+.DS_Store
+.DS_Store?
+._*
+.Spotlight-V100
+.Trashes
+ehthumbs.db
+Thumbs.db
+
+# Project-specific ignored files
+data/
+results.json
+
+# project
+.venv/
+results*.json
+paper.aux
+paper.log
+paper.out
+paper.fdb_latexmk
+paper.fls
+submission.zip
+.DS_Store
+pdf-forge-exports/

llm_layered_defense-0.2.0/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## 0.2.0 - 2026-10-07
+
+Runtime guard for agents (phase one).
+
+* `LayeredDefense` / `Guard`: wrap any LLM call with retrieval, prompt
+  hardening, generation and claim-level verification; sync `answer()`,
+  async `aanswer()`, `stream()` (tokens, then verdict and final answer) and
+  standalone `verify()` for answers produced elsewhere.
+* Bring your own LLM: `"provider:model"` strings, plain callables (sync or
+  async), `OpenAILLM`, `AnthropicLLM`, `LangChainLLM`, or any `.chat()` object.
+* `GuardPolicy`: rewrite / refuse / flag / allow per claim class, risk-tiered
+  verification, parametric-knowledge mode, context budget, persona and prompt.
+* Pluggable retrieval (`Retriever` protocol, `CallableRetriever`,
+  `LexicalRetriever`) and `as_documents()` so tool outputs, dicts and
+  LangChain documents can be passed as evidence.
+* Adapters: tool definitions and functions for OpenAI/Anthropic tool calling,
+  LangChain `as_runnable()`.
+* `GuardEvent` callbacks for tracing; verifier claims carry evidence ids.
+
+## 0.1.0 - 2026-10-07
+
+First packaged release, replacing the three loose scripts.
+
+* `layered_defense` package with corpus/retrieval, prompt assembly, providers,
+  pipeline, LLM judge, ablation runner, reporter and `layered-defense` CLI.
+* Removed the simulation fallback that fabricated results calibrated to the
+  paper's own numbers whenever an API call failed; failures are now recorded.
+* Closed-book prompts no longer force a refusal through the "stay inside the
+  documents" constraint.
+* Metadata recency window is relative to the current (or a given) year.
+* Retrieval tokenises properly (punctuation, stop-words) and follows the
+  paper's retrieve-20 / filter / re-rank-to-k scheme.
+* Added the poisoned-index control conditions so Layer 2 is measured.
+* Summary statistics carry `n`, error counts, Wilson 95 % intervals, refusal
+  and correction rates; reporter emits data-driven observations.
+* Bundled the synthetic corpus and QA data; no hard-coded absolute paths.

llm_layered_defense-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rajesh Govindarajan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

llm_layered_defense-0.2.0/PKG-INFO

@@ -0,0 +1,190 @@
+Metadata-Version: 2.5
+Name: llm-layered-defense
+Version: 0.2.0
+Summary: Layered defense framework (verifier, metadata-filtered RAG, negative prompting, alignment) for mitigating LLM hallucinations, with a reproducible ablation harness.
+Project-URL: Homepage, https://github.com/rgolabs/Mitigating-Hallucination
+Project-URL: Issues, https://github.com/rgolabs/Mitigating-Hallucination/issues
+Project-URL: Paper, https://doi.org/10.5281/zenodo.23768596
+Project-URL: Changelog, https://github.com/rgolabs/Mitigating-Hallucination/blob/main/CHANGELOG.md
+Author-email: Rajesh Govindarajan <rj@onboardai.org>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-safety,evaluation,hallucination,llm,llm-as-a-judge,prompt-engineering,rag
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.10
+Requires-Dist: python-dotenv>=1.0
+Requires-Dist: requests>=2.31
+Provides-Extra: anthropic
+Requires-Dist: anthropic>=0.40; extra == 'anthropic'
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: twine>=5; extra == 'dev'
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.3; extra == 'langchain'
+Provides-Extra: openai
+Requires-Dist: openai>=1.40; extra == 'openai'
+Description-Content-Type: text/markdown
+
+# llm-layered-defense
+
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.23768596.svg)](https://doi.org/10.5281/zenodo.23768596)
+
+A small, dependency-light framework and experiment harness for the paper
+*"A Layered Defense Framework for Mitigating Hallucinations in Large Language
+Models"* (Govindarajan, 2026). It implements the four security layers as
+composable pieces and runs the cumulative ablation of Table 5 against any
+OpenAI-compatible chat endpoint.
+
+| Layer | Module | What it does |
+|---|---|---|
+| L1 verifier | `layered_defense.pipeline.DefensePipeline.verify` | LLM-as-a-Judge extracts atomic claims, labels them supported / contradicted / unverifiable and rewrites the draft. |
+| L2 metadata-filtered RAG | `layered_defense.corpus` | Lexical top-k retrieval over a document store; a `MetadataPolicy` (domain, recency, trust score) is applied as a hard filter before re-ranking. A poisoned index with 5 % adversarial documents is supported for the context-poisoning experiment. |
+| L3 prompt engineering | `layered_defense.prompts` | System instruction, 3-shot grounded examples and negative constraints (context-aware: closed-book prompts get anti-fabrication constraints instead of a forced refusal). |
+| L4 alignment | `layered_defense.prompts.ALIGNMENT_PERSONAS` + `--base-model/--aligned-model` | Approximated on hosted models by persona + temperature, or faithfully by pointing each level at a different checkpoint. |
+
+The harness **never simulates model output**. A failed provider call is
+recorded on the run with an `error` field and excluded from every statistic.
+An offline `mock` provider exists for tests and dry runs; its results are
+tagged and refused by the LaTeX reporter unless `--allow-mock` is passed.
+
+## Use it inside your agent
+
+```python
+from layered_defense import LayeredDefense, GuardPolicy
+
+# any LLM: "openrouter:google/gemini-2.5-flash", "openai:gpt-4o", "custom:model"
+# (with base_url), a callable fn(messages) -> str, OpenAILLM(client, model),
+# AnthropicLLM(client, model) or LangChainLLM(chat_model)
+guard = LayeredDefense("openrouter:google/gemini-2.5-flash",
+                       verifier="openrouter:anthropic/claude-sonnet-4.5",
+                       system_prompt="You are the support assistant for ACME.")
+
+out = guard.answer("Is this customer eligible for a refund?",
+                   context=[kb_passage, crm_ticket])   # tool outputs as evidence
+out.text      # grounded answer (rewritten / refused / flagged per policy)
+out.action    # accepted | rewritten | refused | flagged | unverified
+out.claims    # [Claim(text, judgment, evidence_ids), ...]
+
+await guard.aanswer(...)                 # async
+for ev in guard.stream(...): ...         # token events, then verify/decision/answer
+guard.verify(question, answer, context)  # audit an answer produced elsewhere
+```
+
+`GuardPolicy(on_contradicted="refuse", on_unverifiable="flag",
+allow_parametric=True, verify_when=lambda q, docs: is_high_risk(q))` controls
+what happens per claim class and when the verifier runs. Pass a
+`retriever=` (any `retrieve(query, k=, domain=)` object or `fn(query, k)`),
+`metadata_policy=` for Layer 2 filtering, and `on_event=` for tracing.
+Tool-calling adapters live in `layered_defense.adapters`
+(`OPENAI_VERIFY_TOOL`, `ANTHROPIC_VERIFY_TOOL`, `make_verify_tool(guard)`,
+`as_runnable(guard)` for LangChain/LangGraph).
+
+## Install
+
+```bash
+pip install llm-layered-defense
+```
+
+Requires Python 3.10+. A bundled synthetic corpus (120 documents) and QA set
+(500 questions, six domains) ship with the package, so no download is needed.
+
+## Quick start
+
+```bash
+# offline dry run with the deterministic mock provider
+layered-defense demo --n-per-domain 2 --ablation extended
+
+# live run through OpenRouter
+export OPENROUTER_API_KEY=...
+layered-defense run --provider openrouter --model google/gemini-2.5-flash \
+    --verifier-model anthropic/claude-sonnet-4.5 --n-per-domain 5 --out results.json
+
+# any OpenAI-compatible server (vLLM, Ollama, LM Studio, a local proxy, ...)
+layered-defense run --provider custom --base-url http://127.0.0.1:8787/v1 \
+    --api-key "$LLM_API_KEY" --model my-model --pricing my-model=1:5
+
+# render LaTeX tables (+ data-driven observations) or a Markdown summary
+layered-defense report results.json --out results_tables.tex
+layered-defense report results.json --format markdown
+```
+
+Providers: `openrouter`, `openai`, `gemini` (OpenAI-compatible endpoint),
+`groq`, `ollama`, `local` (`$LOCAL_LLM_BASE_URL` / `$LOCAL_LLM_API_KEY`),
+`custom` (`--base-url`), `mock`. A `.env` file in the working directory is
+loaded automatically.
+
+### Ablations
+
+`--ablation table5` runs the five cumulative rows of the paper. `--ablation
+extended` adds two Layer-2 controls between rows 1 and 2, *vanilla RAG on a
+clean index* and *vanilla RAG on the poisoned index*, so the context-poisoning
+effect that motivates metadata filtering is measured rather than assumed.
+`--attack-strength` (0..1) sets how retrieval-optimised the adversarial
+documents are; at 1 they tie with the best clean document.
+
+### What a results file contains
+
+`provenance` (models, seed, policy, pricing, timestamps), `summary` (per row:
+`n`, `errors`, hallucination rate with a 95 % Wilson interval, refusal rate,
+verifier-correction rate, share of prompts that contained an adversarial
+document, mean latency, cost per 1k queries, mean helpfulness) and `raw_runs`
+(every prompt's context ids, draft, final answer, verifier claims, judge
+verdict and rationale).
+
+## Library use
+
+```python
+from layered_defense import DefensePipeline, DocCorpus, LayerConfig, MetadataPolicy, make_provider
+
+corpus = DocCorpus.from_csv("documents_corpus.csv").inject_adversarial()
+llm = make_provider("openrouter", model="google/gemini-2.5-flash")
+pipe = DefensePipeline(corpus, llm, policy=MetadataPolicy(min_quality=0.7, recency_years=5))
+full_stack = LayerConfig("full", rag="filtered", prompt="full", alignment="aligned", verifier=True)
+result = pipe.answer("What is inflation?", "Finance", full_stack)
+print(result.final_answer, result.corrected, result.latency_s, result.cost_usd)
+```
+
+## Honest scope
+
+* Layer 4 cannot fine-tune anything. With a single hosted model the "base"
+  and "aligned" rows differ only by system prompt and temperature. Use
+  `--base-model` / `--aligned-model` with real base vs. instruct checkpoints
+  for a faithful L4 comparison.
+* Hallucination is judged by an LLM, not by human annotators. Use a judge at
+  least as strong as the generator and a different model where possible.
+* Retrieval is lexical (token overlap with stop-word removal), not embedding
+  based. Swap `DocCorpus.retrieve` for your own retriever if needed.
+* Small samples give wide intervals. The reporter prints the Wilson interval
+  and refuses to claim a trend the data do not show.
+
+## Paper
+
+Preprint: Govindarajan, R. (2026). *A Layered Defense Framework for Mitigating Hallucinations in Large Language Models.* Zenodo. https://doi.org/10.5281/zenodo.23768596
+
+`paper.tex` includes `results_tables.tex`, which `layered-defense report`
+generates from `results.json`. Build with `latexmk -pdf paper.tex`.
+
+## Development
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+pytest
+ruff check src tests
+python -m build && twine check dist/*
+```
+
+## License
+
+MIT. The bundled corpus and QA set are synthetic (CC0-style educational use).

llm_layered_defense-0.2.0/README.md

@@ -0,0 +1,151 @@
+# llm-layered-defense
+
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.23768596.svg)](https://doi.org/10.5281/zenodo.23768596)
+
+A small, dependency-light framework and experiment harness for the paper
+*"A Layered Defense Framework for Mitigating Hallucinations in Large Language
+Models"* (Govindarajan, 2026). It implements the four security layers as
+composable pieces and runs the cumulative ablation of Table 5 against any
+OpenAI-compatible chat endpoint.
+
+| Layer | Module | What it does |
+|---|---|---|
+| L1 verifier | `layered_defense.pipeline.DefensePipeline.verify` | LLM-as-a-Judge extracts atomic claims, labels them supported / contradicted / unverifiable and rewrites the draft. |
+| L2 metadata-filtered RAG | `layered_defense.corpus` | Lexical top-k retrieval over a document store; a `MetadataPolicy` (domain, recency, trust score) is applied as a hard filter before re-ranking. A poisoned index with 5 % adversarial documents is supported for the context-poisoning experiment. |
+| L3 prompt engineering | `layered_defense.prompts` | System instruction, 3-shot grounded examples and negative constraints (context-aware: closed-book prompts get anti-fabrication constraints instead of a forced refusal). |
+| L4 alignment | `layered_defense.prompts.ALIGNMENT_PERSONAS` + `--base-model/--aligned-model` | Approximated on hosted models by persona + temperature, or faithfully by pointing each level at a different checkpoint. |
+
+The harness **never simulates model output**. A failed provider call is
+recorded on the run with an `error` field and excluded from every statistic.
+An offline `mock` provider exists for tests and dry runs; its results are
+tagged and refused by the LaTeX reporter unless `--allow-mock` is passed.
+
+## Use it inside your agent
+
+```python
+from layered_defense import LayeredDefense, GuardPolicy
+
+# any LLM: "openrouter:google/gemini-2.5-flash", "openai:gpt-4o", "custom:model"
+# (with base_url), a callable fn(messages) -> str, OpenAILLM(client, model),
+# AnthropicLLM(client, model) or LangChainLLM(chat_model)
+guard = LayeredDefense("openrouter:google/gemini-2.5-flash",
+                       verifier="openrouter:anthropic/claude-sonnet-4.5",
+                       system_prompt="You are the support assistant for ACME.")
+
+out = guard.answer("Is this customer eligible for a refund?",
+                   context=[kb_passage, crm_ticket])   # tool outputs as evidence
+out.text      # grounded answer (rewritten / refused / flagged per policy)
+out.action    # accepted | rewritten | refused | flagged | unverified
+out.claims    # [Claim(text, judgment, evidence_ids), ...]
+
+await guard.aanswer(...)                 # async
+for ev in guard.stream(...): ...         # token events, then verify/decision/answer
+guard.verify(question, answer, context)  # audit an answer produced elsewhere
+```
+
+`GuardPolicy(on_contradicted="refuse", on_unverifiable="flag",
+allow_parametric=True, verify_when=lambda q, docs: is_high_risk(q))` controls
+what happens per claim class and when the verifier runs. Pass a
+`retriever=` (any `retrieve(query, k=, domain=)` object or `fn(query, k)`),
+`metadata_policy=` for Layer 2 filtering, and `on_event=` for tracing.
+Tool-calling adapters live in `layered_defense.adapters`
+(`OPENAI_VERIFY_TOOL`, `ANTHROPIC_VERIFY_TOOL`, `make_verify_tool(guard)`,
+`as_runnable(guard)` for LangChain/LangGraph).
+
+## Install
+
+```bash
+pip install llm-layered-defense
+```
+
+Requires Python 3.10+. A bundled synthetic corpus (120 documents) and QA set
+(500 questions, six domains) ship with the package, so no download is needed.
+
+## Quick start
+
+```bash
+# offline dry run with the deterministic mock provider
+layered-defense demo --n-per-domain 2 --ablation extended
+
+# live run through OpenRouter
+export OPENROUTER_API_KEY=...
+layered-defense run --provider openrouter --model google/gemini-2.5-flash \
+    --verifier-model anthropic/claude-sonnet-4.5 --n-per-domain 5 --out results.json
+
+# any OpenAI-compatible server (vLLM, Ollama, LM Studio, a local proxy, ...)
+layered-defense run --provider custom --base-url http://127.0.0.1:8787/v1 \
+    --api-key "$LLM_API_KEY" --model my-model --pricing my-model=1:5
+
+# render LaTeX tables (+ data-driven observations) or a Markdown summary
+layered-defense report results.json --out results_tables.tex
+layered-defense report results.json --format markdown
+```
+
+Providers: `openrouter`, `openai`, `gemini` (OpenAI-compatible endpoint),
+`groq`, `ollama`, `local` (`$LOCAL_LLM_BASE_URL` / `$LOCAL_LLM_API_KEY`),
+`custom` (`--base-url`), `mock`. A `.env` file in the working directory is
+loaded automatically.
+
+### Ablations
+
+`--ablation table5` runs the five cumulative rows of the paper. `--ablation
+extended` adds two Layer-2 controls between rows 1 and 2, *vanilla RAG on a
+clean index* and *vanilla RAG on the poisoned index*, so the context-poisoning
+effect that motivates metadata filtering is measured rather than assumed.
+`--attack-strength` (0..1) sets how retrieval-optimised the adversarial
+documents are; at 1 they tie with the best clean document.
+
+### What a results file contains
+
+`provenance` (models, seed, policy, pricing, timestamps), `summary` (per row:
+`n`, `errors`, hallucination rate with a 95 % Wilson interval, refusal rate,
+verifier-correction rate, share of prompts that contained an adversarial
+document, mean latency, cost per 1k queries, mean helpfulness) and `raw_runs`
+(every prompt's context ids, draft, final answer, verifier claims, judge
+verdict and rationale).
+
+## Library use
+
+```python
+from layered_defense import DefensePipeline, DocCorpus, LayerConfig, MetadataPolicy, make_provider
+
+corpus = DocCorpus.from_csv("documents_corpus.csv").inject_adversarial()
+llm = make_provider("openrouter", model="google/gemini-2.5-flash")
+pipe = DefensePipeline(corpus, llm, policy=MetadataPolicy(min_quality=0.7, recency_years=5))
+full_stack = LayerConfig("full", rag="filtered", prompt="full", alignment="aligned", verifier=True)
+result = pipe.answer("What is inflation?", "Finance", full_stack)
+print(result.final_answer, result.corrected, result.latency_s, result.cost_usd)
+```
+
+## Honest scope
+
+* Layer 4 cannot fine-tune anything. With a single hosted model the "base"
+  and "aligned" rows differ only by system prompt and temperature. Use
+  `--base-model` / `--aligned-model` with real base vs. instruct checkpoints
+  for a faithful L4 comparison.
+* Hallucination is judged by an LLM, not by human annotators. Use a judge at
+  least as strong as the generator and a different model where possible.
+* Retrieval is lexical (token overlap with stop-word removal), not embedding
+  based. Swap `DocCorpus.retrieve` for your own retriever if needed.
+* Small samples give wide intervals. The reporter prints the Wilson interval
+  and refuses to claim a trend the data do not show.
+
+## Paper
+
+Preprint: Govindarajan, R. (2026). *A Layered Defense Framework for Mitigating Hallucinations in Large Language Models.* Zenodo. https://doi.org/10.5281/zenodo.23768596
+
+`paper.tex` includes `results_tables.tex`, which `layered-defense report`
+generates from `results.json`. Build with `latexmk -pdf paper.tex`.
+
+## Development
+
+```bash
+uv venv && uv pip install -e ".[dev]"
+pytest
+ruff check src tests
+python -m build && twine check dist/*
+```
+
+## License
+
+MIT. The bundled corpus and QA set are synthetic (CC0-style educational use).

llm_layered_defense-0.2.0/pyproject.toml

@@ -0,0 +1,66 @@
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "llm-layered-defense"
+version = "0.2.0"
+description = "Layered defense framework (verifier, metadata-filtered RAG, negative prompting, alignment) for mitigating LLM hallucinations, with a reproducible ablation harness."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [{ name = "Rajesh Govindarajan", email = "rj@onboardai.org" }]
+keywords = ["llm", "hallucination", "rag", "llm-as-a-judge", "prompt-engineering", "ai-safety", "evaluation"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Science/Research",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Scientific/Engineering :: Artificial Intelligence",
+]
+dependencies = [
+  "requests>=2.31",
+  "python-dotenv>=1.0",
+]
+
+[project.optional-dependencies]
+openai = ["openai>=1.40"]
+anthropic = ["anthropic>=0.40"]
+langchain = ["langchain-core>=0.3"]
+dev = ["pytest>=8", "pytest-cov>=5", "ruff>=0.6", "build>=1.2", "twine>=5"]
+
+[project.scripts]
+layered-defense = "layered_defense.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/rgolabs/Mitigating-Hallucination"
+Issues = "https://github.com/rgolabs/Mitigating-Hallucination/issues"
+Paper = "https://doi.org/10.5281/zenodo.23768596"
+Changelog = "https://github.com/rgolabs/Mitigating-Hallucination/blob/main/CHANGELOG.md"
+
+[tool.hatch.build]
+artifacts = ["src/layered_defense/data/*.csv"]  # data/ is git-ignored at the repo root
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/layered_defense"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/layered_defense", "tests", "README.md", "LICENSE", "CHANGELOG.md", "pyproject.toml"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"
+
+[tool.ruff]
+line-length = 160
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B"]
+ignore = ["E501"]  # long prompt/data strings