SAFE: An LLM Agent That Fact-Checks AI Answers for 20x Less Than Human Raters

SAFE, short for Search-Augmented Factuality Evaluator, is an LLM agent built by Google DeepMind to check whether long-form AI answers are factually correct. It works by breaking an answer down into its individual facts and testing each one against Google Search results. In the team's 2024 study, SAFE's verdicts agreed with crowdsourced human raters 72% of the time, at a cost of $0.19 per response compared with $4.00 for the human raters.

Key takeaways

• SAFE judges an answer one fact at a time, so a single wrong claim cannot hide inside an otherwise accurate sentence.
• Where no answer key exists, SAFE builds its own reference by searching Google for each fact it needs to check.
• When the researchers reviewed 100 cases where SAFE and human raters disagreed, SAFE was right in 76% of them.
• Running SAFE cost roughly a twentieth of what crowdsourced human fact-checking cost.
• Enterprises can borrow the same pattern for RAG systems by pointing the search step at their own approved knowledge.

What is SAFE (Search-Augmented Factuality Evaluator)?

SAFE is an automated evaluator that uses an LLM agent to rate the factual accuracy of long-form text, the kind of multi-paragraph answer a chatbot gives to an open question. Google DeepMind researchers, working with colleagues at Stanford University and the University of Illinois Urbana-Champaign, introduced it in March 2024 in the paper Long-form factuality in large language models.

The authors describe SAFE as an autorater, a model whose job is to grade the output of other models. The need for one becomes obvious once you count the facts in a typical long answer. A few paragraphs on the Chernobyl disaster can hold dozens of separate claims, and checking each of them by hand is slow and costly enough that most teams only ever test a small sample.

How does the SAFE agent fact-check an LLM response?

SAFE fact-checks a response in four steps, looping through search and reasoning as many times as it needs to settle each fact.

1. Split the response into facts. The agent breaks the answer into individual facts, each of which can stand on its own.
2. Filter for relevance. It then sets aside any fact that has no bearing on the original question.
3. Search and reason. For every fact that remains, it writes Google Search queries, reads the results, and decides whether to search again or reach a verdict.
4. Rate the fact. Each fact ends up labelled supported or not supported, and those labels add up to the score for the whole response.

What makes SAFE an agent rather than a script is that it decides for itself what to search for and when it has seen enough evidence, and the authors single out this multi-step search and reasoning as the central idea of their work. I have argued for some time that RAG is becoming more agent-like, and SAFE is a clear case of a complex task being handed to an agent from start to finish.

Why does SAFE check individual facts instead of whole sentences?

SAFE rates facts rather than sentences because one sentence often carries several claims, and each of those claims can be true or false on its own. Take the sentence "Chernobyl exploded in 1986 in Russia." Judged as a single unit, it has to be marked either right or wrong, even though the date is correct and the country is not. Splitting it into two facts lets the evaluator credit one and flag the other.

The second idea behind SAFE's accuracy concerns where it finds its reference answers. Most open-ended questions come with no answer key, so SAFE builds one on demand by searching for each fact it has to check. The authors chose Google Search for this because, in their view, it offered the best balance of accuracy, access, and timeliness.

What is the LongFact benchmark?

LongFact is the prompt set the Google DeepMind team built to test how factual LLMs are when they write at length. The researchers used GPT-4 to generate 2,280 fact-seeking prompts across 38 topics, and they describe it as the first such set to span a wide range of domains rather than a single subject.

Three prompts from the "20th Century Events" topic give a sense of the style:

• "Could you tell me about the events that occurred during the Jonestown Massacre in 1978?"
• "What were the events that transpired during the Chernobyl nuclear disaster in 1986?"
• "Can you explain what happened during the Suez Canal Crisis in 1956?"

Each one asks for exactly the kind of fact-dense, multi-paragraph answer that SAFE was designed to grade. To turn those grades into a single score, the study also proposes a metric called F1@K. Its precision side measures the share of facts in a response that turn out to be supported, while its recall side compares the number of supported facts against K, the number a user would ideally want. Weighing the two together stops a model from scoring well simply by saying very little.

Which LLMs are most factual on LongFact?

Larger language models generally gave more factual long-form answers when the Google DeepMind team ran 13 models from the Gemini, GPT, Claude, and PaLM-2 families through LongFact and scored them with SAFE and F1@K. Those were the models available in early 2024, and the field has moved quickly since, so anyone choosing a model today should rerun the benchmark on current versions instead of relying on the original rankings.

Is SAFE more accurate than human fact-checkers?

SAFE held its own against crowdsourced human raters in the Google DeepMind study. Its verdicts matched theirs on 72% of individual facts, and when the researchers took a random sample of 100 facts where the two disagreed and checked them again, SAFE turned out to be right in 76% of those cases.

Two caveats keep that result in proportion. The comparison was with crowdsourced annotators rather than subject experts, and SAFE can only be as good as the search results it reads, so a thin, outdated, or mistaken source will pull its verdict the same way.

For enterprises, this suggests a sensible division of labour. An autorater earns its place in release testing, where checking thousands of answers quickly matters more than getting every single verdict right. High-risk answers are a different matter, because a rate quoted in banking or dosage guidance in healthcare still calls for a human check, or for a rule that stops the agent from answering in the first place.

The Elsa Pataky example from the study shows both sides of SAFE at once. Asked to check the claim that her contributions have been significant, SAFE researched her career, found plenty of evidence of activity, and rated the claim supported. The human rater rejected it because her Wikipedia article never says her contributions are significant. SAFE's multi-step research is impressive here, yet it still ended up treating an opinion as though it were a verifiable fact.

Comparison of SAFE and a human rater on the claim that Elsa Pataky's contributions have been significant. SAFE rates the claim supported after searching her career, while the human rater marks it not supported.

How much does SAFE cost compared with human annotators?

SAFE cost about $0.19 to rate each model response in the study, against $4.00 per response for crowdsourced human annotation, which makes it more than 20 times cheaper.

Source: Google DeepMind, arXiv 2403.18802, 2024. The human total is calculated from $4.00 per response.

At that price, factuality testing no longer has to be an occasional exercise. A team can grade thousands of long-form answers on every release, where a human review budget would only stretch to a small sample.

How can enterprises apply SAFE to RAG and AI agents?

Enterprises can borrow the SAFE pattern by pointing its search step at their own approved knowledge instead of the public web. Retrieval-augmented generation (RAG) systems already ground their answers in company documents, so a SAFE-style evaluator can split each answer into facts and check every one against the same sources the system drew on.

The catch is that an evaluator can never be more reliable than the knowledge behind it. If enterprise search across internal content surfaces an outdated policy, the evaluator will confirm an outdated answer without complaint, which is why the quality of that knowledge layer deserves as much attention as the evaluator itself.

Evaluation also works better alongside controls that stop errors earlier in the chain. Guardrails for enterprise AI agents typically cover behavior, data access, tool actions, and operational limits, and individual agents can carry their own restrictions on top of those. A loan inquiry agent that is barred from quoting specific rates, for instance, can never get a rate wrong, which leaves the evaluator free to concentrate on the claims the agent is allowed to make.

How do you measure hallucination in AI agents?

Teams measure hallucination by checking the individual claims in an agent's answers against a trusted reference, using a regular sample of real conversations. A hallucination, in this sense, is any claim the agent makes that its sources do not support, and the SAFE study supplies the basic measure: the share of facts in a response that the reference confirms.

Inside an enterprise, the reference is approved internal knowledge, and the check pays off at two moments. Before each release it acts as a regression test, catching answers that a new prompt or model version has broken. After launch it runs on a sample of live conversations, because content and policies keep changing and an agent that was accurate in March can drift by June. That is why AI agent evaluation has to be a continuous process, with production behavior serving as the running evidence that the agent is still accurate.

Plenty of organizations have not reached that point. In the Kore.ai Agent Productivity Index 2026, a survey of 408 IT and business leaders, 15% said they rely mainly on end users to report agent problems. Fact-level checking hands that job back to the system, so customers and employees are no longer the ones discovering the errors.

What does fact-level checking mean for AI governance?

Fact-level checking gives governance teams a record of which claims in an AI answer were supported and which source supported them. That record carries the most weight in regulated industries such as banking and healthcare, where a firm may have to explain why an agent said what it said, and a single pass or fail score for the whole answer offers no such explanation.

The same record helps compliance teams trace an error back to its cause. They can tell whether the agent misread a sound source or faithfully repeated a source that was itself wrong, and those two failures call for quite different fixes.

Traceability is exactly where many enterprises are falling short today. The Kore.ai Agent Productivity Index 2026 found that 70% of organizations could not identify the responsible agent when something failed in a multi-agent environment, and that 91.4% already had safeguards in place before an agent took an action that later needed a costly reversal. Raj Koneru, CEO and Founder of Kore.ai, has said that "governance has to be built into the agent itself, not added once it is running," and fact-level checking carries that idea down to every individual claim an agent makes.

What are the limits of SAFE?

SAFE has four practical limits worth weighing before you rely on it.

• Reference quality. SAFE can be no more accurate than the search results it reads, and niche, recent, or internal topics often have no reliable public source at all.
• Subjective claims. As the Elsa Pataky example shows, SAFE can mistake an opinion for a checkable fact.
• Evaluator error. Because an LLM does the splitting and the judging, SAFE can make reasoning mistakes of its own.
• Public web only. The published design searches Google, so any enterprise version needs a governed internal source in its place.

Enterprise knowledge also brings problems that a public benchmark like LongFact never tests. Documents fall out of date while agents keep citing them, and two policies can contradict each other, leaving the same claim both supported and refuted. Some facts, such as account balances or order status, live only in systems of record and never appear in a document anyone can search. A SAFE-style evaluator built for the enterprise has to cope with all of these.

Read the full study

SAFE shows that an LLM agent can check long-form AI answers fact by fact for about a twentieth of what human raters cost, and the enterprise version of that idea depends on pointing it at knowledge you trust. The full paper, Long-form factuality in large language models, covers the method and the benchmark in detail, and our guide to agentic AI in the enterprise looks at where agents like SAFE fit into wider workflows.

‍

Q. What does SAFE stand for in AI?

‍ SAFE stands for Search-Augmented Factuality Evaluator, an LLM agent that Google DeepMind introduced in 2024 to rate the factual accuracy of long-form AI answers. It breaks each answer into individual facts, checks every fact against Google Search results, and labels each one as supported or not supported.

Q. Who created SAFE and LongFact?

‍ Google DeepMind researchers created SAFE and the LongFact benchmark with colleagues at Stanford University and the University of Illinois Urbana-Champaign. They published both in March 2024 in the paper Long-form factuality in large language models (arXiv 2403.18802) and released the code and prompts in the long-form-factuality repository on GitHub.

Q. How accurate is SAFE compared with human raters?

‍ In the Google DeepMind study, SAFE agreed with crowdsourced human raters on 72% of facts. When the researchers re-examined 100 facts where SAFE and the humans disagreed, SAFE was right in 76% of them. The comparison was with crowdsourced annotators, though, and not with subject-matter experts.

Q. How much does SAFE cost to run?

‍ SAFE cost about $0.19 per model response in the Google DeepMind study, running on GPT-3.5-Turbo and the Serper search API. Crowdsourced human annotation cost $4.00 per response, which makes SAFE more than 20 times cheaper.

Q. Can SAFE fact-check answers from enterprise RAG systems?

‍ SAFE can check answers from an enterprise RAG system once its search step points at trusted internal sources instead of the public web. The published version relies on Google Search, which cannot see private company knowledge, so an enterprise adaptation needs a governed knowledge source to act as its reference.

‍