Guardrails as analog circuits: a design for correcting without breaking the conversation

Research and architecture proposal. October 2026. Differential feedback, graduated intervention, and failure modes inspired by analog electronics.

Imagine someone trying to explain a difficult situation. An expression triggers the system's defense, the response changes to standardized text, and the conversation loses the subject the person was trying to build. The protection layer may have a good intention; the interruption still needs to be examined as part of product behavior.

The design presented here starts from another priority: correct what needs correcting while preserving the useful part of the interaction. The inspiration comes from amplifiers and control systems: measure a difference, act on it, and observe the result of the action.

This is a guardrail design conceived by Kuaapy's founder and still conceptual. The analogy organizes the mechanism and engineering questions; the intended properties must be demonstrated in the implemented system.

The problem with using interruption as the first response

One possible guardrail design receives a candidate response, applies rules or a classifier, and decides whether to release, block, or replace the text. In this arrangement, a classification error can have abrupt consequences: interrupting a legitimate request or allowing an inappropriate response through.

This does not describe every guardrail. Programmable dialogue flows, contextual checks, response review, and cascaded classifiers already exist. NeMo Guardrails, for example, organizes conversation paths and actions; Constitutional Classifiers++, presented in 2026, uses contextual evaluation and sends suspicious cases to a second, more expensive stage. NeMo Guardrails [1], Constitutional Classifiers++ [2].

The question in this design is more specific: how can the intensity and form of intervention follow the detected problem, instead of applying the same rupture to different situations?

A response may contain useful information and a passage that needs correction. Context may be missing to decide. A sensitive word may appear in a perfectly legitimate explanation. The design needs to distinguish these cases. Studies such as XSTest show ways to evaluate improper refusals with bounded examples; it is not enough to measure how many requests were blocked. XSTest [3].

What the amplifier offers as a reference

In a circuit with negative feedback, part of the output returns to the input through a feedback network. In a simplified representation:

erro = referência − saída realimentada
e = r − βy

r is the reference, y is the output, and β represents the network that returns a fraction or transformation of that output. The amplifier responds to the difference between its inputs. In the linear region, with sufficient loop gain and an appropriate design, feedback reduces the closed-loop gain's sensitivity to certain amplifier variations. Analog Devices: gain and feedback [4].

The useful lesson is that output does not need merely to be accepted or discarded: it participates in the measurement that guides the next action.

The differential pair offers a second idea. A signal equal at both inputs can be rejected as common mode, while the difference between them is amplified. In real components, this rejection is finite and depends on operating conditions and frequency. It does not automatically cancel every noise, thermal drift, or asymmetric error. Analog Devices: CMRR [5].

When transferred to language, this inspires a question: which variations should matter to the decision and which are only confusing the measurement? A paraphrase, a quotation, or a different way of expressing oneself should not, by itself, turn a legitimate purpose into a dangerous one. Identifying that difference requires evaluation; it does not appear automatically because we call the comparator differential.

Class AB: do not leave a gap in the transition

In a class-B push-pull stage, the transition of conduction between devices can produce crossover distortion, especially near the zero crossing. Class-AB bias keeps a small quiescent conduction and reduces that problematic region. There is a tradeoff involving dissipation, temperature, load, and bias adjustment; distortion does not disappear by definition. Analog Devices: class B and class AB [6].

The analogy for conversation is in the transition. If the system leaves a normal response and enters a protection mode, there may be a gap between them: it stops responding to the original need without offering a useful continuation.

In this design, continuity is also a requirement during that passage. Content may need to change, a question may be necessary, and certain information may not be provided. Even so, there should be a way to proceed with what can be done in that interaction.

Class AB does not prove that this will work in software. It helps make a design point visible: behavior between regimes deserves as much attention as behavior within each regime.

What the proposed loop could look like

One way to operationalize the idea would have five parts:

1. Contextual reference: record what was requested, the purpose stated by the person and confirmed for that interaction, relevant constraints, and what remains uncertain. 2. Measurement: evaluate the candidate response against that reference, distinguishing risk, suitability, and preservation of the legitimate task. 3. Graduated action: correct a passage, reduce detail, ask for necessary information, or choose another way to help. 4. New observation: check the corrected response and monitor whether the next turn clarifies or worsens the problem. 5. Operating limits: define when to stop reviewing, how to handle uncertainty, and what continuation to offer when the request cannot be met in that form.

The conceptual circuit would be:

pedido, finalidade e restrições → referência para a medição

resposta candidata → medição → ajuste → resposta revisada
                         ↑                      │
                         └──── reavaliação ──────┘

This flow is an organizational proposal, not an implementation already tested. The new measurement matters: merely rewriting the text without checking the effect of the change does not show that the error decreased.

The reference remains separate from the responses the system is trying to correct. It is updated only by the person's clarifications or by relevant, verified information; the review itself cannot rewrite it merely to make the response pass the measurement.

In a streaming interface, when the check happens also matters. Correcting after delivery does not take back text the person has already received. The design would have to define what is evaluated before display, what can be reevaluated during generation, and what delay the process adds.

The reference also needs to be explicit. There is no single “desired response” deducible from every conversation. The person's stated purpose, available facts, and system constraints can point to different questions. If the system invents a purpose and corrects the response to fit it, it has put its own assumption in place of the reference.

The controlled error should be a deviation in the system's behavior. The person and their way of expressing themselves are not the error to eliminate.

Measure without confusing semantic proximity with safety

Embeddings can be one component of measurement: they represent texts and allow relations among them to be calculated. For nonzero vectors, cosine similarity in the same space is symmetric and bounded between −1 and 1. This facilitates numerical operations; it does not show that the measure recognizes contextual risk or suitability.

A response can remain very close to the subject and still be inappropriate. A response that asks a necessary question can move away from the original wording and still help. The learned geometry and the task for which the model was trained matter. Research on the limits of cosine similarity in embeddings [7].

For that reason, in this design similarity would be a candidate signal, not a certificate. It would need to be compared with other measures and checked on cases involving negation, quotation, ambiguity, and context change.

It is also useful to separate signals. A single number can hide that a correction reduced a risk and destroyed the usefulness of the response. The evaluator needs to perceive both. Lowering the score while the result becomes worse is a measurement-instrument failure, not a controller victory.

A delicate conversation cannot become only an exchange of automatic messages

There is a human concern at the center of this design: a person in distress may need a response that follows what they are saying, and an abrupt switch to a protocol may leave that need unanswered.

The interaction goal is to preserve care, context, and an appropriate continuation, including when a boundary or referral needs to be presented. A help resource can be part of the conversation without being used as an automatic substitute for the whole conversation.

This does not turn keeping dialogue going into a validated clinical technique. Asking about interests, continuing to produce text, or increasing the number of turns does not demonstrate reduced risk. The quality and suitability of support need to be evaluated by their own criteria; claims of clinical benefit would require another kind of study. WHO guidance on AI in health is a governance and evaluation reference, not validation of this specific design. WHO: generative AI and health [8].

The same concern about continuity can be examined outside health. In a technical incident report, for example, recognizing a sensitive term should not be enough to erase the stated defensive purpose. The system needs to follow the actual request and identify exactly which part it can address.

Reduce unnecessary signals about the defense

There is another hypothesis in the design: less abrupt interventions might offer fewer accidental clues about the system's decision points.

A standardized blocking message can provide a very clear observation. A correction integrated into the response can make that observation less direct. But content, response time, consistency, and changes across queries remain observable. The absence of an explicit warning does not make the policy invisible.

Adversarial evaluation research shows why responses and interfaces need to be examined under adaptive queries, not only in a fixed list of examples. These studies do not measure the proposal presented here. Evaluation of adaptive attacks on LLMs [9].

The hypothesis to test, therefore, is the reduction of particular signals and its effect under defined conditions. We cannot conclude that the attempt-and-observe cycle disappeared or that discovering a flaw necessarily became more expensive.

External discretion should not produce internal blindness. To investigate a failure, operations need to reconstruct what was measured and changed while respecting conversation privacy. Hiding internal controller details is different from hiding its errors from those who need to evaluate them.

The loop can also err, saturate, and oscillate

Electronics offers a warning as useful as its inspiration: negative feedback does not guarantee stability by itself. Delays and gain and phase relationships can produce overcorrection, oscillation, and a long time to settle. At output limits, the amplifier leaves the linear region and no longer corrects as predicted by that approximation. Texas Instruments: amplifier stability [10].

In software, a sequence of reviews can alternate between excessively restrictive and excessively permissive responses. It may remove important context or repeat the same error with different wording. These are behaviors to look for in evaluation, without assuming that they follow the circuit equations exactly.

The proposal would need, for example, to limit the number of reviews, avoid large changes from unreliable signals, and check whether a correction introduced another problem. A small score perturbation should not trigger an unnecessary rewrite of the whole response. How to achieve this behavior is part of controller engineering.

The failure mode is central: when measurement is poor, can the system still ask a useful question? When it cannot conclude, does it communicate uncertainty? When it needs to limit an action, does it preserve the parts it can address? Continuing to emit text, by itself, answers none of these questions.

Where the design meets existing research

Feedback-based review already appears at different levels. Constitutional AI uses critiques and revisions in a training process. Self-Refine explores generation, feedback, and revision during execution. CRITIC adds observations from external tools to guide revision. Constitutional AI [11], Self-Refine [12], CRITIC [13].

These are useful precedents, with their own objectives and evaluations. None of them, from this description, proves the stability, proportionality, or lower-observability properties intended here.

It is also not enough to ask the same model to judge itself repeatedly. A study of reasoning self-correction found difficulties and regressions without external feedback under the conditions examined. This does not prove that every review fails; it shows why measuring corrections and introduced errors is part of the work. Limits of intrinsic self-correction [14].

This post's design brings together a specific priority: measure intervention by the deviation it corrects and the useful continuity it preserves. Its intended contribution must be described and tested in that combination, without claiming that all iterative review was invented here.

How to know whether the proposal works

The next research step would compare the controller with defined alternatives: the same model without this layer, a classification-and-replacement design, and iterative review with an equivalent budget. Changes in model, data, or cost need to be recorded so that an effect from another variable is not attributed to the controller.

An evaluation should observe separately:

Containment — Question to answer: What inappropriate responses are still produced, and with what severity?

Improper intervention — Question to answer: Which legitimate requests were interrupted or changed without need?

Preserved usefulness — Question to answer: Does the correction retain the attendable part of the task?

Proportionality — Question to answer: Do small context or signal variations cause unnecessarily large changes?

Stability across turns — Question to answer: Are there oscillations, repeated reviews, or progressive loss of context?

External observability — Question to answer: Which intervention signals remain inferable in the test scenario?

Cost — Question to answer: How many passes, how much time, and which resources does each response require?

Calibration data should remain separate from evaluation data. Language needs to vary, legitimate situations with sensitive terms should be included, and changes across several turns should be tested. When there is variability, repeating measurements and presenting dispersion helps distinguish a favorable case from a consistent result.

Human evaluation should examine the delivered response in addition to the system's own score. NIST's generative AI profile offers references for risk measurement and follow-up during use; it does not replace the criteria specific to this experiment. NIST AI 600-1 [15].

The goal is not to build a system that never admits a limit. It is to design a defense capable of adjusting what is necessary, noticing when its own correction failed, and continuing to offer useful help. In electronics, circuit quality also appears in the transition between regimes. In a conversation, that may be precisely when the person most needs the system to keep paying attention.