A guard that detects contamination in AI-generated content, and an operating rule that never treats regeneration alone as "done"

Applicability of This Document

Ready-to-Run Commands

# 対象: テキスト生成パイプラインの出力ファイル・ログ
# 権限: 出力ファイルの読み取り権限
# 変更作業: なし（参照のみ）
# Production実行: 可能
#
# 既知の拒否・謝罪定型文、指示文の漏れ込みを出力テキストからスキャンする（例）
grep -RniE "(申し訳ございません|as an ai|以下の指示に従って|I cannot fulfill)" ./generated-output/

# 期待される末尾構造（結語・フッタ等）が欠けている＝途中切断の疑いがあるファイルを洗い出す
for f in ./generated-output/*.md; do
  tail -c 200 "$f" | grep -q "《期待する末尾の文言》" || echo "TRUNCATION SUSPECT: $f"
done

# 対象: 生成→配信の間に挟むゲート処理
# 権限: 生成パイプラインの設定・コード変更権限
# 変更作業: あり（配信前に検証ステップを追加し、失敗時は再生成をトリガーする）
# Production実行: 可能（自動再生成の上限回数を設定した上で）
#
# 1. 生成が終わったら、配信・保存の前に既知パターンのスキャンを実行する
# 2. 検出されたら配信をブロックし、プロンプトを調整して再生成する（上限N回）
# 3. 上限に達しても解消しない場合は人間のレビューに回す（自動配信しない）
# 4. 再生成が成功した場合も、処理ログの成功だけで完了と判断せず、
#    出力された本文を直接確認してから完了とする（ここが最も見落とされやすい）

How to Read the Results

When to Use This

• Scheduled reports sometimes contain text not meant for the reader — apology boilerplate, fragments of instructions
• Generation sometimes gets delivered/stored while cut off mid-way
• Regenerating the same section sometimes fixes it, sometimes does not
• Nobody notices the contamination until a human reads the body directly

Possible Causes (Most Likely First)

1. 01

   The assumption that "regenerating fixes it" was operated on without ever being verified

   The regenerated output was never checked directly — only whether processing completed normally was checked, and that was treated as "done." In reality the same contamination pattern can recur, or a different one can appear.

2. 02

   There was no mechanical check between generation and delivery

   The LLM's output was always treated as well-formed, correct text and delivered/stored as-is.

3. 03

   Contamination patterns are not uniform

   Refusal text, mid-generation cutoffs, leaked instructions, mixed-language contamination — there are multiple distinct types, and no single simple check covers them all.

4. 04

   With unattended scheduled execution, no human is present to notice anomalies

   Periodic batch jobs are not watched by a human right after they run, so the structure itself guarantees the problem is noticed only later.

Diagnostic Steps

1. 1

   Compile the known contamination patterns

   Read-only

   Gather real past examples of refusal text, mid-generation cutoffs, leaked instructions, and mixed-language contamination as the basis for detection rules.

2. 2

   Check whether scanning is feasible right after generation, before delivery

   Read-only

   Since noticing after delivery means more rework, check where in the pipeline a check can be inserted.

3. 3

   Check whether the operation actually reads the body directly after regeneration

   Read-only

   "It re-ran" and "it's fixed" are different things. Check whether the procedure looks at the actual text, not just the processing log.

Solutions

Differences by Version and Environment

If This Doesn't Resolve It

• Look back at recent "resolved" calls and check whether they actually involved checking the output

  Check for cases where something was marked done based only on a successful processing log.

• Check whether the same guard exists on other generation pipelines

  A problem found in one pipeline is likely to be common to similar generation processes elsewhere.

• Check whether the guard's trigger rate can be tracked over time

  If it cannot be tracked, you will be slow to notice a regression in the model or prompt.

Basis and Limitations of This Document

FAQ

Questions This Document Covers

• How to guarantee the quality of automatically generated AI reports
• How to deal with instruction fragments leaking into LLM output

What the Risk Labels Mean

• Read-onlyDoes not change data or settings.
• LowImpact is limited, but permissions and load should be checked.
• MediumMay affect performance, locking, or cost.
• HighMay cause an outage, data loss, or require recovery work.
• Expert Review RequiredRequires a separate review before applying to production.

GIIP's Scope of Support

For periodically generated reports and other AI-generated content, GIIP runs a check before delivery that detects known contamination patterns; when one fires, it triggers automatic regeneration and only marks the job done after directly checking the regenerated body. The policy is to include this check by default whenever a similar generation pipeline is newly built.

Related Services

• AI運用パイプラインのレビューを依頼する
• 自動化ジョブの承認・ロールバック設計を相談する