Your LLM sounds confident even when it is wrong, and most enterprise teams still have no automated way to catch it before a user acts on the answer. On 3 November 2026 the USPTO granted Cisco a patent for exactly that checker, and the design tells us where the next attack will land.
AG Tech Consulting view: if you are adding an automated fact-check layer to your LLM apps, treat its knowledge base as a security asset with an owner, access control and change logging, not as a convenience folder of PDFs.
What Cisco was granted
US 12,783,856 B2, "Method to detect and fix hallucinations in generative Large Language Models", is assigned to Cisco Technology, Inc. The inventors are David C. White, Jr. and Mohammed Izzat Hamzeh. It was filed on 25 July 2023, claims priority to a provisional application of 17 May 2023, and was granted on 3 November 2026.
The idea is simple to state. A separate detector watches both the prompt and the output of a generative model. It decides "Hallucination" or "Not_Hallucination". When it flags a hallucination, it sends the model back to regenerate, with the verified fact added as context and, optionally, with changed sampling settings.
Last month we looked at a Hippocratic AI patent where a supervisory model runs in parallel during a live conversation. Cisco's design is different. It is a post-generation audit: take the finished answer, break it into facts, check those facts against trusted sources, then decide.
How the pipeline works
The patent describes a flow in four stages.
Topic creation. Long output is split into chunks and clustered. Each chunk goes through an ML extractor and summariser, then Latent Dirichlet Allocation (LDA) topic extraction. A topic-to-fact mapping step pulls the surrounding sentence so each topic carries checkable facts. The patent says this stage is optional when the checker's context window is large enough.
Fact checking. For each fact, the system searches trusted public knowledge bases, trusted private knowledge bases, or both. For a medical question the patent names sources such as the U.S. National Institutes of Health, PubMed Central, Infermedica and WebMD. For a question about software bugs it would search an internal knowledge base. The results are aggregated into one "consolidated ground truth context".
Two classifiers. First, a hallucination pattern detection model looks at the input and output for patterns that signal hallucination, even when the problem is not purely factual, such as badly formatted text. If that model does not flag anything, a second LLM acts as a zero-shot classifier. It receives the answer, the consolidated ground truth context and a system prompt asking it to return each class with a probability. The patent's own example: "Leonardo da Vinci painted the Mona Lisa in 1815" comes back as Hallucination 0.9, Not_Hallucination 0.1.
Regeneration. On a hallucination, the original model is prompted again with the correct fact and with a lower temperature or a larger top-k.
The clever part: a detector trained on a model forced to lie
The most interesting claim language is how the pattern detector is trained. The same set of prompts goes to two models. One runs normally. The other is deliberately forced to hallucinate. The patent lists four ways to force it: raise the sampling temperature, lower top-k, use prompts that push for unusual content, or fine-tune on hallucinated or creative text.
Output from the forced model is labelled Hallucination. Output from the normal model is fact-checked first, and only the correct answers are labelled Not_Hallucination; anything that fails the check is also labelled Hallucination. The result is a binary classifier trained on a synthetic dataset, with no human labelling of hallucinations.
Let us be very clear on why this matters for scope. All three independent claims (1, 9 and 14) require this trained pattern detector and the regeneration step, on top of summarisation, topic extraction and fact checking. So the patent does not cover "using a second LLM to fact-check the first" in general. It covers this specific combination. Anyone building a checker should read the claims with their counsel rather than assume either "we are clear" or "we are blocked". This article is not legal advice.
Where the design is thin
Three points stood out on a careful read.
First, the patent is a 2023 design. LDA topic extraction and chunk clustering were sensible when context windows were small. The patent itself says the topic stage can be skipped with a large enough window, and many current checkers simply pass the whole answer plus retrieved evidence to the judge model.
Second, the text mixes two meanings of temperature. One passage describes forcing hallucination by increasing "temperature of the computing device(s) that run the model (e.g., 1.5 or 2.0 degrees)". Those values are clearly sampling temperatures, not hardware heat. A small drafting slip, but it shows how loosely sampling controls are described.
Third, the zero-shot classifier's probability is the judge model's own self-reported number. It is not a calibrated confidence. Treat Hallucination 0.9 as a ranking signal, not as a measured error rate.
The future security risk: the ground truth becomes the target
The point is simple. This design moves trust from the generating model to the knowledge base. Whoever can write into that knowledge base now decides what "true" means, and the checker will actively correct a right answer into a wrong one.
This is not theory. The PoisonedRAG paper (Zou et al., USENIX Security 2025) showed that injecting five malicious texts per target question into a knowledge database with millions of texts reached a 90% attack success rate, and that the defences the authors evaluated were insufficient. A fact-check layer that searches the same kind of store inherits the same weakness. OWASP's Top 10 for LLM Applications 2025 lists both Misinformation (LLM09) and Vector and Embedding Weaknesses (LLM08) for this reason.
Looking ahead, four risks deserve attention:
Poisoned ground truth. An attacker plants a document in a "trusted private knowledge base", such as a wiki page or a shared drive folder that gets indexed. The checker flags the correct answer as a hallucination and regenerates it with the attacker's "fact".
Injection through the correction prompt. Regeneration feeds retrieved text straight into the generating model's context. If that text carries instructions, the fix step becomes an indirect prompt injection channel.
Detector evasion. A pattern detector trained on high-temperature, low-top-k output learns what those artefacts look like. A fluent, low-temperature lie, or a planted false fact, may not look like that at all.
Confidence laundering. Once users know a checker sits in the loop, a "verified" badge carries more weight than the raw model did. A compromised checker is therefore more dangerous than no checker.
What this means for Indian and global enterprises
The need of the hour is not one more model in the chain. It is governance over the evidence that model reads. A hospital, a lender or a manufacturer that adds a fact-check layer should know exactly which sources count as ground truth, who can change them, and how a change is reviewed. The same rule applies whether the checker is bought from a vendor or built in-house on open models.
Checklist before you deploy an LLM fact-check layer
Name every knowledge base the checker treats as ground truth, and assign an owner to each one. Restrict write access to those sources, and log every change with who made it and when. Keep public sources and private sources separate in the evidence you pass to the judge, and record which one decided each verdict. Strip or neutralise instructions in retrieved text before it reaches the regeneration prompt. Test the checker with planted false documents, not only with high-temperature model output. Treat the judge model's probability as a ranking signal until you have measured it against your own labelled samples. Cap the number of regeneration loops and send repeated failures to a human. Store the prompt, original answer, retrieved evidence, verdict and regenerated answer for every flagged case. Show users which source an answer was corrected against, not only a "verified" label. Have counsel review US 12,783,856 B2 claims 1, 9 and 14 if you are building or selling a similar checker.
Sources
https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/12783856 https://exa.ai/library/legal/patent/pj224rq5692 https://www.uspto.gov/learning-and-resources/official-gazette/official-gazette-patents https://arxiv.org/abs/2402.07867 https://genai.owasp.org/llmrisk/llm092025-misinformation/ https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/
Also on our website: https://agtechconsulting.ai/insights/cisco-patent-llm-hallucination-checker.html
Planning an LLM fact-check or RAG layer and want a second pair of eyes on its design and security? Email avinash@agtechconsulting.ai, visit agtechconsulting.ai, or book a 30-minute call: https://calendly.com/avinash-dubey-30-min-catchup/meeting-with-ag-tech
Thanks to the work of Cisco , Cisco Security , OWASP® Foundation , OWASP GenAI Security Project , USENIX Association , USPTO , National Institute of Standards and Technology (NIST) , Hugging Face , OpenAI , Anthropic , Google DeepMind , Microsoft , Meta , NVIDIA , Hippocratic AI , LangChain , Pinecone
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
