Research Program

Not a prompt. An architecture with peer-reviewed trust properties.

TriageCounsel is the product instantiation of a peer-reviewed research program: a deterministic execution boundary (ICCS 2026, Springer LNCS), extended into a formal trust-boundary architecture with threat modeling, runtime enforcement, and empirical evaluation (IEEE TPS 2026). The goal is not maximum chatbot fluency — it is reproducibility, auditability, and defensibility under legal and security review.

Accepted at ICCS 2026

Springer LNCS

Accepted at IEEE TPS 2026

Two peer-reviewed venues

Research Arc

From execution invariance to a trust boundary

One continuous line of work. First prove that deterministic authority is possible in hybrid pipelines. Then formalize the adversaries, trust properties, and runtime enforcement that legal and security teams need to rely on.

ICCS 2026 · Springer LNCS

Deterministic execution boundary

Introduced and evaluated the hybrid architecture: symbolic engine owns all state transitions; the LLM is a non-authoritative explainer. Measured execution invariance and traceability as first-class computational properties.

IEEE TPS 2026 · Accepted

Trust-boundary architecture

Extended that boundary into four explicit trust properties (reproducibility, traceability, decision–explanation separation, injection containment), a threat model, runtime enforcement checks, prompt-injection experiments, immutable evidence binding, and quantified data-minimization controls.

Product

TriageCounsel in production

The same philosophy ships as connected contract review: approved positions govern outcomes, findings stay evidence-bound, and AI never becomes the decision-maker.

Paper I

Accepted · ICCS 2026 Springer LNCS

Deterministic Execution Frameworks for Hybrid Symbolic–Probabilistic Computational Pipelines

Santhosh Guntupalli

International Conference on Computational Science (ICCS 2026) · Springer Lecture Notes in Computer Science (LNCS)

Abstract. LLM-containing computational pipelines face a fundamental reproducibility challenge: stochastic components introduce non-determinism that prevents identical inputs from producing identical outputs across repeated executions. This paper presents a deterministic execution framework for hybrid symbolic–probabilistic pipelines that enforces execution invariance by isolating deterministic modules from stochastic components. The architecture employs a deterministic symbolic engine for all state transitions and decision logic, while LLM components operate only as non-authoritative, post-hoc explainers of pre-computed deterministic outputs. Evaluated on 115 structured text documents: 100% execution determinism and 100% traceability, with zero output variance under stress testing — versus 0% determinism for a pure LLM baseline.

Download PDF

Springer DOI page will be linked here upon formal LNCS publication.

Paper II

Accepted · IEEE TPS 2026 Trust · Privacy · Security

Trust-Boundary Architectures for Auditable LLM-Assisted Contract Risk Analysis: Threat Model, Enforcement, and Empirical Evaluation

Santhosh Guntupalli

IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS 2026) · accepted

Abstract. Probabilistic LLMs are attractive for contract risk analysis but violate core trust requirements in regulated settings: outputs vary across identical runs, findings lack stable policy identifiers, clause-embedded instructions can influence downstream behavior, and full-document API calls expand confidentiality exposure. This paper specifies four trust properties (reproducibility, traceability, decision–explanation separation, and injection containment), maps them to adversaries and runtime enforcement, and evaluates a trust-boundary architecture that confines authoritative decisions to a versioned deterministic rule engine while restricting the LLM to non-authoritative explanation over structured findings only. On 200 agreements, the hybrid path achieves 100% reproducibility and 100% rule-level traceability versus 0% reproducibility under the evaluated pure-LLM baseline; instruction-class prompt-injection experiments preserve finding multisets in 16/16 cases; data minimization is quantified at approximately 135× reduction in information-theoretic exposure on the explanation path.

Download PDF

IEEE proceedings DOI and camera-ready citation will be posted when published by the conference.

What Legal & Security Teams Can Rely On

Four trust properties, enforced at the boundary

From the IEEE TPS 2026 paper. These are not marketing claims — they are falsifiable properties with mapped threats, enforcement mechanisms, and experimental checks.

TP1 · REPRODUCIBILITY

Same contract. Same ruleset. Same findings.

Authoritative outputs are identical across repeated executions on the same state. Replay integrity for audits, regression diffs, and historical defensibility.

TP2 · TRACEABILITY

Every finding binds to rule, span, and version.

Immutable evidence binding: each finding cites a versioned rule ID, severity, and exact text span — so reviewers reconcile outputs with explicit logic, not model lore.

TP3 · DECISION–EXPLANATION SEPARATION

AI explains. It does not decide.

Findings are frozen before any LLM call. Schema validation and no write-back mean explanatory text cannot invent, alter, or delete authoritative risk.

TP4 · INJECTION CONTAINMENT

Hostile clause text stays data, not instructions.

Instruction-like language embedded in contracts cannot change the authoritative finding set at the pattern-matching layer. Evaluated under bounded prompt-injection and obfuscation suites.

Empirical Evaluation

Results that survive scrutiny

Headline numbers from the IEEE TPS 2026 evaluation (200 agreements; NDA, MSA, employment, licensing), building on the ICCS 2026 determinism study (115 documents).

100%

Hybrid reproducibility

Pure-LLM reproducibility

200

Agreements evaluated

16/16

Injection containment

Trust-property verification (IEEE TPS 2026)

Metric Trust-boundary hybrid Pure LLM baseline

Reproducibility (200 docs) 100% 0%

Rule-level traceability 100% 0%

Ungrounded findings / doc 0.00 0.53

Stress test (15×20 runs) Zero variance 17.7 fingerprints / doc

Schema / RAG baselines (TP1) Pass 0% reproducible

Explanation-path exposure ~135× reduced Full document to API

The architecture prioritizes auditability over maximum recall. Reported detection F1 on labeled synthetics is deliberately conservative (0.66 in IEEE TPS); errors are explicit, typed, and remediable by rule ID — not hidden failures of a black-box model. Structured JSON and RAG baselines still failed reproducibility on both OpenAI and Anthropic configurations tested.

Architecture

How the trust boundary works

Detection, severity, and suppression are deterministic. The LLM explains pre-computed findings only. Probabilistic components cannot write back into authoritative state.

Authoritative path

Document ingestion & normalization

Versioned deterministic rule engine

Context logic & suppression (reason-coded)

Immutable findings snapshot (F)

LLM explanation over F only (non-authoritative)

✓

Attorney review & audit bundle

Design principles (IEEE TPS)

P1 — Authoritative determinism

Exactly one subsystem emits authoritative findings; no sampling on the decision path.

P2 — Decision–explanation separation

Natural-language generation is downstream of frozen findings; explanation is derived, never constitutive.

P3 — Immutable evidence binding

Every finding cites rule ID, severity, and exact span under a versioned ruleset σ.

P4 — Minimal information exposure

External inference receives structured findings where the explanation path applies — not raw contract text as the default decision channel.

For Legal Teams

Why this is a philosophy you can defend

Prompt-first AI review

Different findings on re-run of the same agreement

No stable policy identifier for auditors or insurers

Clause text can hijack model behavior (prompt injection)

Full-document API exposure as the default path

Trust-boundary architecture

SHA-256-identical fingerprints across repeated runs

Versioned rule IDs and spans on every finding

Injection containment evaluated under explicit threat model

Peer-reviewed at ICCS and IEEE TPS — not a vendor whitepaper

FAQ

Frequently asked questions

How do the two papers relate?

ICCS 2026 introduced and validated the deterministic execution boundary for hybrid symbolic–probabilistic pipelines. IEEE TPS 2026 is the direct continuation: it formalizes trust properties, adversaries, runtime enforcement, injection containment, evidence binding, and data-minimization controls around that same boundary.

What is ICCS? What is IEEE TPS?

ICCS (International Conference on Computational Science) publishes through Springer LNCS and focuses on rigorous computational methods. IEEE TPS (Trust, Privacy and Security in Intelligent Systems and Applications) is an IEEE venue focused on trustworthy AI, privacy, and security — the right home for the threat-model and enforcement contribution.

What does “deterministic” mean here?

Given the same document, ruleset, and version, authoritative findings do not change across runs. Pure LLM extractors in the papers’ baselines could not satisfy that property — including schema-constrained and retrieval-augmented setups.

Does TriageCounsel use AI at all?

Yes. AI assists with discovery and plain-language explanation. Authoritative policy and risk outcomes are produced by deterministic engines with evidence-backed fact admission. The IEEE TPS trust boundary keeps explanation non-authoritative on the evaluated decision path.

Can I read the full papers?

Yes. PDFs for both accepted papers are available above. Publisher DOIs will be added when Springer LNCS and IEEE proceedings pages go live.

See the architecture in a live review

Upload a contract and inspect evidence-backed findings produced under the same deterministic philosophy validated in ICCS 2026 and IEEE TPS 2026.

Start Free Review