Natural-language search: turn a sentence into reviewable conditions

1. Preserve composition, not just keywords

Consider the translated query “Find a woman in a red shirt holding a box around 13:00”. A keyword bag containing person, red and box loses the relationships that make the request meaningful. A red box beside a person wearing a blue shirt should not satisfy it. The proposed interpretation must connect the shirt to the relevant person and holding to that same box.

Treat the person category as user-described apparent presentation, not evidence of gender identity or sex. A system should not infer protected traits or identify a person from this request. If visual interpretation is uncertain, retain that uncertainty and require authorized manual review; do not turn a retrieved appearance into punitive automation. Descriptions are hypotheses about visible evidence, not claims about a person’s identity or private characteristics.

2. Ask for missing time context before execution

The clock expression 13:00 does not specify a day, timezone or tolerance. “Around” might mean a narrow interval or a broader period, depending on the task. Ask the user to confirm the date, timezone and approximate window rather than silently choosing today or an arbitrary margin. A confirmed interval should refer to source capture time, with clock uncertainty and delayed ingestion visible when they affect coverage.

Resolve cameras and other structured filters using identifiers from an authorized catalog, not names invented by a language model. Numerical-value constraints require a known field, unit, comparison operator and valid-value status. Null or invalid measurements cannot be treated as zero to make a filter pass. Hard time, camera and value constraints remain mandatory throughout retrieval and ranking; an appealing semantic match cannot compensate for being outside them.

{
  "intent": "search_events",
  "person_description": {"apparent_presentation": "user_described_woman", "state": "requires_review"},
  "attributes": [{"subject": "person", "field": "shirt_color", "value": "red"}],
  "relations": [{"subject": "person", "predicate": "holding", "object": "same_box"}],
  "time": {"clock": "13:00", "date": null, "timezone": null, "window_minutes": null},
  "camera_ids": [],
  "execution_state": "needs_user_confirmation"
}

3. Distinguish supported, contradicted and unknown

A search plan should specify how each condition can be checked. Shirt color needs the appropriate region and usable lighting; holding needs a relationship observation or a reviewable sequence. A model score may prioritize candidates but cannot itself demonstrate logical AND across attributes. Store or return evidence states separately so a strong match for red does not hide an unknown holding relationship.

Negative conditions require care. “Not carrying a box” is not established merely because a detector missed one during occlusion. Distinguish visible contradictory evidence from absence of an annotation and from a view where the condition cannot be assessed. For ambiguous requests, show what needs clarification rather than quietly relaxing conditions. If only partial matches are offered, label the unmet and unknown parts explicitly and do not present them as exact answers.

• Bind each attribute to a named subject; do not accept a color found elsewhere in the frame.
• Bind the relation to its subject and object, then check that the evidence concerns the same box.
• Keep unknown separate from false, including occluded hands, ambiguous clothing and unsupported negation.
• Expose changes to interpreted scope; a relaxed camera, time window or relation needs explicit confirmation.

4. Execute a validated plan, not direct generated SQL

Language interpretation should produce a constrained intermediate plan. Validate its schema, field names, operators, ranges, types and maximum query size in ordinary application code. Map only approved operations to parameterized, allowlisted read-only queries. A model should not emit SQL that is executed directly, choose arbitrary tables or bypass a tenant condition. If the plan is invalid, return a controlled clarification or error instead of guessing a replacement.

Authorization is independent of the model and the user’s wording. Restrict sources before retrieval and before candidate ranking, including semantic branches, and recheck access before playback. A request to “search every camera” cannot expand permission. Avoid leaking counts, thumbnails or snippets from excluded sources. Confirmation of a search interpretation confirms intent only; it does not create a right to view the underlying footage.

5. Treat queries and retrieved evidence as untrusted inputs

Prompt injection can arrive in the user query, OCR text on a sign, a stored caption or a retrieved description. Text saying to ignore access rules or execute a command remains evidence content, not an instruction. Keep the interpreter’s role narrow and tool authority outside generated prose. OWASP describes why retrieval and prompt wording alone do not eliminate this class of risk; application-level validation and permission enforcement are still needed.

A language-generated explanation should cite the authorized event and evidence interval that support each condition. It must not invent a holding action, fill a missing timestamp or treat an embedded instruction as a reason to change the search plan. Limit unnecessary query and evidence retention because the wording itself may contain personal information. These are design considerations, not promises that a particular planned implementation has already mitigated every attack.

6. Return an answer that can be inspected and corrected

An understandable response separates the confirmed interpretation, the candidate events and the limitations of the search. Distinguish no matching authorized event from incomplete indexing or unavailable coverage, while avoiding disclosures about inaccessible sources. Let authorized reviewers inspect the relevant sequence, not only a flattering thumbnail. Evidence should show whether shirt color and holding were supported together, and any temporal gap should remain visible.

Test paraphrases, Thai phrasing, mixed-language terms, contradictory conditions and missing dates before relying on an interpreter. Measure whether the plan preserves the user’s intended relationships as well as whether the final results are relevant. The planned AIFacon Detection direction includes NLP search over stored event fields and image or video meaning; this article explains the interpretation problem, not an available interface, benchmark or guarantee of understanding every request.