HackBlue

Tools · LLM application security · 16 / 23

Temperature on the request is not a confidence score

Temperature is a sampling setting on the request, if the log recorded it. It is not a measure of how sure the model was, and a zero does not make the reply a record.

11 min read · practice only with authorization

The number is a request setting

Some request logs store a temperature, a sampling setting the caller chose. Zero means the caller asked for the least random sampling the API offers. A higher number means the caller asked for more variation. Neither number is a confidence percentage, and neither number is stored inside the generated sentence.

If the field is missing, write “temperature not in the log.” Do not assume zero because the reply sounds steady.

The reply is still generated text

A reply produced at temperature zero can still name a document that was not retrieved, or describe a tool result that the trace does not show. The setting does not change what you are allowed to cite. The service log and the retrieval ids remain the records of those facts.

Two replies at the same temperature can disagree. The setting explains how the request was made. It does not pick which sentence is true.

What to file

File the request id, the temperature if present, and the response id. Label temperature as a sampling setting. Do not file “confidence 0” or “confidence 100” from it. If you compare two runs, say whether the setting was the same.

Worked case: zero filed as certainty

The lab hours bot was called with temperature 0. Response r-600 says the library closes at 6. The hours page for that day says 8. A draft writes “confidence 100, closes at 6” because the temperature was zero.

The note quotes temperature 0 as the sampling setting and r-600 as the reply. The closing time in the finding comes from the hours page, not from the reply. Zero is not a confidence score, and the reply does not override the page.

Snippet
request: req-600  temperature: 0  (sampling setting)
response: r-600  text: library closes at 6
hours page: closes at 8
write: setting and reply are separate
not: confidence 100

Diagram

A sampling setting and a confidence score

Only one of these is on the request.

Temperature

Is. A sampling setting, if the log has it

Zero means. The caller asked for the least random sampling

Does not mean. The reply is certain or correct

Not on the request

A confidence percent. You would be inventing it

A source of truth. The hours page or the service log

Agreement. Two zero-temperature replies can still differ

Check yourself

1. Temperature is 0. What does that tell you?

2. The field is absent. What do you write?

3. Two replies at temperature 0 disagree. What does the setting decide?