Anticipate failure modes

Tiny text is unreadable, sampled video skips the decisive frame, ASR misses an accent, image metadata is treated as visual evidence, modalities contradict each other, and the model invents objects outside the crop. Prompt injection can appear inside an image or document. These are not all “hallucinations.” Give each failure a stage, trigger, observable symptom, consequence, and response. Precise names produce precise tests.

Use the chain trigger → earliest evidence → user impact → containment → prevention. The earliest evidence is especially valuable. If a user complaint is the first signal, detection arrived late. For an insurance claim assistant, inspect intermediate artifacts so a bad input, retrieval, model judgment, validation, or action can be distinguished.

| Failure class | Early signal | Immediate containment | Longer-term repair | |---|---|---|---| | Input or data shift | Segment distribution changes | Narrow scope | Improve parser/data contract | | Model or scoring error | Offline slice regresses | Fallback or review | Prompt/model/data change | | Resource exhaustion | Queue, memory, or p95 spike | Shed load | Capacity/control redesign | | Policy or privacy breach | Forbidden field/action appears | Stop and revoke | Minimize access and retest | | Coordination defect | Duplicate/stale artifacts | Freeze action | Version state and ownership |

Populate the rows with topic-specific signals, not generic red/yellow labels. A threshold should include a time window, minimum sample, segment, and owner.

Multimodal input means reasoning over more than one modality; OCR only converts image text; ASR converts speech; computer vision may classify pixels without language; media generation creates a modality. Converting everything to text can simplify a pipeline but may erase spatial or acoustic evidence. Confusing neighboring concepts leads teams to repair the wrong layer. A polished answer can conceal missing evidence; a valid schema can contain false values; a successful tool call can perform the wrong authorized action. Validate content, structure, and consequence separately.

Correlated failures deserve special attention. Model-based judges may favor the same style as the model they score. Several agents may share one false assumption. Overlapping chunks may look like independent evidence. Repetition is not corroboration unless sources and failure paths are independent.

For each severe failure, define a stop condition and safe state. Rollback works only if old prompts, indexes, weights, and schemas remain available and compatible. A fallback must be tested under load. Human review needs queue capacity and enough context to decide; “send to a human” is not a complete control.

Practice one tabletop scenario: inject a realistic defect, verify detection, identify the owner, execute containment, and measure recovery time. Preserve the trace for a blameless review. The goal is not to claim failures are impossible but to reduce their frequency, blast radius, and time to recovery.