Research Note

A Precision-First, Deterministic Post-OCR Corrector for Vietnamese Mathematics Answer Keys

July 20, 2026 · Harry Tran

Download formal paper here

Abstract

Normally tuned for recall, post-OCR correction focuses on repairing recognition errors. The field’s standard benchmark scores systems only on tokens that were already wrong, meaning that corrupting correct text incurs no penalty under this metric [S2]. This objective is a poor fit for documents saturated with mathematics, where turning a correct formula, grading marker, or geometry label into a plausible but incorrect one does more damage than leaving a real error untouched. We argue that in this regime correction should be inverted to put precision and do-no-harm first, and that the do-no-harm property should be audited rather than asserted. We present a fully deterministic, resource-light post-OCR corrector (standard-library code, no training, no GPU, and no language model in the correction path) for Vietnamese gifted-student mathematics answer keys converted from PDF by a math-aware OCR pipeline. Every edit is a reversible fixed-rule application constrained by three mechanisms: each protected region (mathematics, tables, labels) has exactly one rule licensed to edit it; edits inside mathematics are applied only when the result is certified to render identically; and a hard policy cap prevents an open-vocabulary candidate generator from ever reaching the automatic output. An audit of all 2,288 automatic edits over a 248-file corpus measures 99.913% precision (Wilson 95% confidence interval 99.68–99.98%), a 0.087% false-correction rate, and zero source-file mutations. A blind two-annotator human pass on a stratified 381-edit sample confirms these findings, yielding a population-weighted precision of 99.89% and finding no errors beyond the two already flagged. The annotators reached almost-perfect chance-corrected agreement (measured by Gwet’s AC1, a prevalence-robust agreement coefficient, at 0.899). Nearly 30% of these edits either leave the rendered mathematics unchanged or preserve the edited text byte-for-byte, making them content-preserving by construction. In a guard-isolation ablation measured by the same protected-span-violation metric, a corrector that reuses our own vocabulary but drops the guards commits 91,126 violations inside protected regions where our system commits none. Our contributions are the inverted objective together with its audit method, an empirical error taxonomy for math-bearing Vietnamese OCR, and a hard-gated design in which extending recall cannot regress precision. The precision figures are demonstrated on one labelled corpus; recall against real errors is out of scope, and we report the coverage cost of the inversion in full.

Keywords: post-OCR correction, do-no-harm, Vietnamese, mathematical OCR, LaTeX, precision, deterministic text correction, error taxonomy.

1. Introduction

Because optical character recognition rarely produces perfect text, a correction stage typically follows it. This paper addresses a setting where the conventional goal of post-OCR correction—recovering as much of the intended text as possible—is counterproductive, as incorrect edits silently damage the documents under repair. These documents are formatted in Markdown, produced by a math-aware OCR pipeline that renders formulas in LaTeX and layout in HTML. Every document contains mathematics, which is highly unforgiving of edits. Changing a correct exponent, a correct interval, or a correct point allocation does not merely leave a blemish; it replaces a true statement with a false one that looks equally plausible. In this domain, a false correction is worse than a missed error: a missed error remains visible as garbled text, whereas a false correction hides in plain sight. This asymmetry forms the premise of our work.

The conventional approach has two major limitations. First, post-OCR correction is studied primarily as a recall problem: systems aim to restore clean text from noisy input, and success is measured by the proportion of errors repaired [S1, S42]. Second, and more consequentially, the most widely used evaluation benchmark is structurally blind to over-correction. Specifically, in the ICDAR-2019 post-OCR correction benchmark, the score is a weighted edit distance between the system output and the gold transcription, computed only over tokens flagged as erroneous. Because already-correct tokens are excluded from this set, an edit that corrupts them does not penalize the score [S2]. A system can therefore over-correct, damaging text that needed no repair, without any measured penalty. Large language models exhibit a similar tendency to over-correct: when prompted to clean text, they often edit beyond the requested scope and perform self-correction unreliably [S47, S38, S48]. Because standard benchmarks overlook over-correction and common tools frequently commit it, any document class where over-correction is the primary risk requires a different objective and evaluation framework.

In this domain, over-correction is driven by the fact that identical surface strings routinely carry different meanings, distinguishable only by context. We call these notation collisions. A bracketed pair such as [0,25] is a grading marker representing 0.25 points on one line and a closed real interval on another. Similarly, an isolated ASCII letter can be a variable inside a formula or a corrupted syllable in prose. The symbol ∞ and the similarity relation ∼ are visually close enough that an OCR pass confuses them, even though one represents infinity and the other denotes geometric similarity. Because the appropriate correction depends on the intended meaning, a system that edits based on surface patterns alone will frequently corrupt the meaning rather than repair spelling. Figure 1 illustrates this problem, contrasting a raw answer-key fragment with the changes made by an unguarded language-model corrector and the output of our system.

To mitigate collision risks, we prioritize precision and do-no-harm over recall, enforcing this inversion by design rather than post-hoc tuning. The resulting corrector is fully deterministic, relying on a fixed set of rules from the Python standard library with no training data, GPU resources, or language models in the execution path. Three structural guarantees enforce this constraint. First, each protected region (such as mathematics spans, tables, or labels) is managed by exactly one dedicated rule, preventing general-purpose rules from modifying these areas. Second, edits within mathematical spans are applied only when a certifier confirms that the edited LaTeX renders identically to the original; uncertified proposals are discarded. Third, candidates proposed by the open-vocabulary generator are capped; they are queued for human review rather than applied automatically, regardless of their score. Proposals that do not satisfy these constraints are flagged for manual review. Crucially, this do-no-harm behavior is audited: we enumerate and verify every automatic edit rather than relying solely on design-time guarantees.

Empirical audit results support this approach. Across all 2,288 automatic edits on the corpus, precision is 99.913% (Wilson 95% confidence interval 99.68–99.98%), the false-correction rate is 0.087%, and source integrity is preserved with zero modifications. A blind, two-annotator human verification on a stratified sample of 381 edits confirms these findings, yielding a population-weighted precision of 99.89% with no additional errors. Furthermore, approximately 30% of the edits either preserve the rendered mathematics or leave the edited text byte-for-byte identical, making false corrections impossible on these cases. The significance of the protective guards is evident when compared to unguarded baselines. On the same corpus, a baseline corrector using our vocabulary but lacking guards commits 91,126 edits inside protected regions, including over 70,000 inside mathematics, where ViMath commits none. Off-the-shelf Vietnamese spell checkers and naive language-model correctors introduce even more over-corrections, frequently corrupting mathematical expressions. The primary cost of this precision-first stance is coverage: approximately one-third of all detected errors are routed to the review queue rather than repaired automatically.

This paper presents four main contributions. First, a precision-first, validator-gated, fully deterministic post-OCR corrector for Vietnamese gifted-student mathematics answer keys. The system achieves a measured precision of 99.913% (human-verified at 99.89%), zero source-file mutations over 2,288 edits, and zero catastrophic edits in the shipped corrector, demonstrating that do-no-harm post-OCR correction is achievable without training, GPUs, or language models. Second, an evaluation framework that treats the false-correction rate and source integrity as primary metrics, operationalized through four release gates and baseline comparisons to address the over-correction blind spot of standard metrics. Third, an empirical error taxonomy for Vietnamese mathematical OCR, establishing per-class frequencies and a severity-versus-policy mapping over the corpus. Fourth, a hard-gated candidate-scoring design where policy caps ensure that open-vocabulary candidates cannot regress automatic precision, allowing recall to be safely extended. We explicitly bound the scope of these contributions: precision is measured on a single labeled corpus, the generalization of the do-no-harm property is verified on an unlabeled out-of-distribution corpus, and absolute recall remains out of scope due to the absence of a gold-standard error inventory.

To ground our design, we first describe the document characteristics and explain why notation collisions defeat conventional correction.

2. Background: Vietnamese mathematics answer keys and math-aware OCR conversion

To understand our design decisions, we first outline the background of the document class, the Vietnamese language, and the OCR pipeline. This context establishes the notation-collision problem that governs our conservative correction policy.

2.1 The document class

The documents in our corpus originate from Vietnamese học sinh giỏi (HSG) competitions, the provincial and national examinations that select gifted mathematics students. We use the abbreviation HSG throughout. Specifically, we focus on answer keys, which provide a worked solution and a grading rubric distributing points across solution steps for each question. A rubric entry is represented in the text by a bracketed point marker such as [0,25 điểm] (denoting 0.25 points), formatted with a decimal comma and the word điểm (‘points’). These markers are critical because they encode credit assignment; any corruption misstates the grading criteria.

In addition to solutions and markers, the documents exhibit a recurring structure that defines the regions our corrector must protect. Questions are introduced by headings such as Câu N or Bài N (‘Question N’). Solutions interleave Vietnamese prose with inline and displayed mathematical formulas. Solid-geometry problems identify figures using compact labels like S.ABCD (representing a pyramid with a quadrilateral base ABCD), which resemble prose strings but function as mathematical objects. Multiple-choice questions include option labels (A, B, C, D), while layout elements—such as centered blocks, embedded images, and HTML tables—are introduced during document conversion. Because the corpus spans grade-nine olympiad geometry to national-level analysis, the corrector must handle a diverse syllabus containing extremal problems, spatial volumes, and vector algebra.

2.2 Vietnamese script and diacritics

Vietnamese uses a Latin-based alphabet with dense diacritics that perform critical semantic functions. These diacritics designate both vowel quality and tone; consequently, altering or omitting a mark changes the word’s meaning. For example, the adverb Vậy (‘thus’, ‘therefore’) differs from the verb Vây (‘to surround’) only by its tone mark, and they cannot be substituted for one another. OCR processes frequently damage these marks, producing corrupted forms like Chúng minh or Chứng mình instead of the intended mathematical instruction Chứng minh (‘prove’). Restoring Vietnamese diacritics is therefore an active area of research [S13, S14, S15].

A structural property of Vietnamese phonotactics enables conservative error detection. Vietnamese syllables follow a strict template comprising an optional onset, a nucleus, and a restricted set of codas, which we define as a syllable skeleton [S21, S22]. Consequently, arbitrary character corruptions often produce invalid syllables. This phonotactic constraint yields an asymmetry that our system exploits. While an invalid syllable skeleton provides strong evidence of corruption, a valid skeleton does not guarantee correctness, as an OCR error can easily transform one valid word into another. Therefore, skeleton illegality justifies flagging a suspected error, but spelling validity alone cannot license an automatic edit. This unidirectional inference shapes our design: error detection is safe, whereas automatic correction carries substantial risk.

2.3 Math-aware OCR conversion

The input text is not raw scanner output; rather, the source documents are scanned PDFs processed by a math-aware OCR pipeline that generates Markdown prose, LaTeX formulas, and HTML layout elements [S3]. This pipeline architecture determines the resulting error profile. Because the initial pass uses a math-aware system, the errors are structural conversion anomalies—such as mangled LaTeX commands, damaged document hierarchies, or prose segments absorbed into math spans—rather than character-level scanner noise. This characteristic limits the external validity of our findings: our corrector is evaluated on this conversion layer, and its performance on raw scanner noise remains untested.

The conversion failures fall into a few recognizable families, previewed here and enumerated with frequencies in Section 6. Diacritic and spelling damage in prose is the most common and the least dangerous. Symbol confusions inside mathematics — an infinity sign standing in for a similarity relation, an invalid command where a valid one was meant — are less common and more dangerous. Structural damage, such as a lost exponent or a merged heading, changes what a document says. Finally, in the worst cases the converter absorbs a whole Vietnamese sentence into a formula, encoding each accented letter as a stray LaTeX accent command, or hallucinates content that was never on the page, such as a table of Chinese column headers; these are unrecoverable by editing and can only be flagged.

Two properties of this error distribution shape our system design. First, the errors are heterogeneous: some are cosmetic and render identically to the intended text, while others silently alter mathematical meaning, occasionally on the same line. Consequently, the corrector cannot apply a uniform repair policy; it must classify candidate edits by their potential to introduce harm. Second, errors are concentrated within specific document structures, such as mathematical spans, grading markers, and headings. This distribution motivates partitioning the document structurally before applying any edits. While existing OCR error detection literature uses structural concentration to locate errors [S29, S31], we exploit this property to identify regions where editing must be restricted.

2.4 The notation-collision problem

The primary challenge in this domain is that identical surface strings frequently represent different semantic constructs. We define this phenomenon as a notation collision, of which three cases recur. First, a bracketed pair like [0,25] can represent a grading marker on a credit-assignment line or a closed real interval in a domain statement, such as f liên tục trên [0,2] (‘f continuous on [0,2]’). Second, a character sequence like xy represents a product of variables inside mathematics, but can be mistakenly corrected to the Vietnamese word xảy (‘to happen’) outside math spans. Third, the similarity relation ∼ between triangles is frequently misrecognized as the infinity symbol ∞, mapping a geometric relation to a calculus limit.

The consequence is that spelling and structural edits are highly context-dependent. Whether an edit to a collided string represents a correction or a corruption depends entirely on the local semantic context. Thus, any system that corrects based on surface patterns alone will occasionally apply the wrong correction rule, corrupting the document. When disambiguating context is available, correction is safe; when context is absent, the text must remain unchanged. This principle—disambiguating via local context and refusing to edit when context is missing—forms the foundation of our system.

Correcting such documents is a studied problem; we now situate our inversion of its objective.

3. Related work

Post-OCR correction, Vietnamese text correction, mathematical OCR, and the literature on over-correction inform our design, though each fails to address our specific domain constraints. Rather than compiling an exhaustive bibliography, we organize prior work into five thematic areas to locate the research gap, detailing why existing methods are insufficient for math-bearing answer keys.

3.1 Classical non-neural post-OCR correction

Classical post-OCR correction divides the task into two sequential stages: error detection and candidate correction [S1, S42]. Under this framework, candidates are generated using fast lookup methods against a fixed lexicon, such as symmetric-delete indexing [S9], Levenshtein automata [S6], or metric trees [S10]. Candidates are then ranked using a Bayesian noisy-channel model [S4] combined with glyph-confusion matrices [S5]. This approach is entirely training-free, aligning with our system constraints; we adapt its candidate generation and scoring framework. The primary limitation of these methods is that they maximize the recall of plausible corrections, lacking any mechanism to determine when a token should remain unmodified. Applying the top-ranked candidate is assumed to be safe. For math-bearing documents where this assumption is invalid, a conservative verification layer must be introduced.

3.2 Vietnamese diacritic restoration and spelling correction

Vietnamese spelling correction split into training-free and neural approaches. Training-free methods restore diacritics via per-syllable dictionary lookup [S13], feature classification [S14], or phrase-based statistical machine translation [S15, S16]. These methods demonstrate that statistical approaches remain competitive for Vietnamese, providing a framework of diacritic stripping and candidate selection. Conversely, neural approaches achieve higher accuracy using transformer models [S18, S19], but they require substantial training resources and lack deterministic rules. We utilize their documented error confusion sets without adopting their model architectures. Crucially, neither approach accounts for mathematical notation, and both prioritize spelling accuracy over the avoidance of false corrections. We adapt the training-free restoration workflow but subject candidates to a strict phonotactic legality check [S21, S22], requiring candidates to form valid Vietnamese syllables before evaluation.

3.3 The closest Vietnamese post-OCR precedents

Two studies are closely related to our work. The first is a reference-based post-OCR method for Vietnamese historical documents [S39]. This system assumes an external reference text to guide correction and allows arbitrary text rewriting. Neither assumption holds for answer keys, which lack reference templates and cannot tolerate mathematical modifications. The second study is a two-phase system for Vietnamese handwriting OCR that reports word-error-rate improvements [S20]. While its architecture provides a useful template, its input consists of handwriting recognition noise rather than the structured Markdown and LaTeX conversion errors analyzed here. We adopt the domain focus of the former and the two-phase structure of the latter, but reject the reference-text requirement and rewriting permissions; our target is the source document itself, which must be preserved. While neural models have been applied to spelling-error detection in administrative documents [S17], we treat these approaches as baseline context rather than direct architectural precedents.

3.4 Mathematical OCR and render-based evaluation

Mathematical OCR literature provides validation signals that can be adapted for correction. Formula recognizers utilize LaTeX grammar rules [S25], syntax trees [S26, S27], and compilability constraints [S24] as quality signals. A central concept is render-based evaluation: rather than evaluating LaTeX strings via edit distance, studies compare rendered output directly, as structurally distinct LaTeX strings can produce identical visual representations [S23, S44]. Although mathematical recognition evaluation utilizes expression-level match metrics [S43], these validation mechanisms are typically embedded within deep learning decoders. We isolate these signals as standalone deterministic checks, including structural LaTeX parsing [T1, T2] and a render-equivalence certificate. Consequently, mathematical edits are accepted only under a guarantee of identical rendering [S44].

3.5 Over-correction, language-model guardrails, and the metric blind spot

Recent studies demonstrate that aggressive spelling correctors frequently introduce errors to correct text, a phenomenon standard evaluations fail to capture. Specifically, the ICDAR-2019 correction metric evaluates performance only on tokens flagged as erroneous, making over-correction invisible [S2]. Large language models exhibit similar behavior: they over-correct by default [S47, S35], fail to self-correct reliably without external verification [S40, S48], and perform inconsistently across different languages [S38]. Existing mitigation strategies treat over-correction as post-hoc cleanup, employing detect-correct-verify staging [S33], entailment checks [S34], majority voting [S32], strict candidate filtering [S35], minimal-edit prompting [S36], or combiner filters [S49]. Although complementary metrics evaluate spurious insertions [S45] and character-level error rates [S41], these approaches maintain a recall-first focus, treating precision as a secondary filtering step. We invert this priority, requiring edits to clear deterministic validation gates before application.

3.6 Novelty position

No existing work addresses the intersection of Vietnamese language processing, LaTeX mathematics, and post-OCR correction. The closest Vietnamese spelling corrector focuses on historical documents guided by reference texts [S39], while mathematical OCR systems remain language-agnostic and training-heavy [S23, S24, S25]. Our work is distinguished by three key characteristics. First, we introduce the first corrector dedicated to math-aware OCR conversion of Vietnamese HSG answer keys. Second, our system enforces a precision-first objective using deterministic validators rather than post-hoc filtering. Third, we explicitly measure over-correction by reporting the false-correction rate and verifying source-file integrity. To operationalize this approach, we define the metrics and policies that support this precision-first objective.

4. Task formulation: do-no-harm post-OCR correction

We first formalize the optimization objectives and evaluation metrics. This section defines the correction objectives, the decision policies that operationalize them, and the metrics reported in our evaluation. These definitions are system-neutral to facilitate direct comparison across different correctors.

4.1 The objective inversion

We define do-no-harm as our primary correction objective: automatic edits must not corrupt correct source text. Under this formulation, a missed error is preferable to a false correction, reversing the conventional assumption that any applied correction represents progress. Recall, defined as the proportion of repaired errors, remains a secondary objective that is pursued only when it does not compromise precision.

This objective inversion is motivated by an asymmetry of harm that is particularly acute in mathematical documents. A missed error typically leaves garbled text that readers or downstream validation passes can flag. Conversely, a false correction replaces a correct expression with an incorrect, yet syntactically valid and plausible alternative, rendering the error invisible at the point of use. In mathematics answer keys, such modifications often target exponents, intervals, or point allocations, propagating errors downstream. Because users consult answer keys to establish ground truth, plausible false corrections are likely to be trusted and propagated. The expected cost of an incorrect automatic edit therefore far exceeds that of a conservative omission, justifying precision as the primary objective.

4.2 Input, output, and the three-way policy

The corrector takes a single converted Markdown document as input and outputs an edited copy alongside a complete, reversible change log. Each log entry records the original text, the replacement, the region type, and the active correction rule. Source files remain unaltered. We treat source preservation as a structural task requirement rather than an implementation convenience: since the source document is our only reference, it must remain intact to allow edits to be reviewed or reverted.

Each detected error (a detected instance) is assigned to one of three policies. AUTO instances are edited automatically in the output copy. VERIFY instances have a proposed edit but are queued for manual review. LEAVE instances represent detected hazards with no proposed edit; they are flagged with a severity rank for manual inspection. Together, the VERIFY and LEAVE instances comprise the review queue. This three-way policy operationalizes the do-no-harm objective: only high-confidence edits are applied automatically, while all uncertain instances are routed to the review queue.

4.3 Metrics

Our evaluation measures automatic edits, human review load, and source integrity. All edit-level rates are computed over the population of AUTO edits, denoted as \(n\) (quantified in Section 8). Edit-level precision is defined as the proportion of correct automatic edits:

\[\text{precision} = \frac{\#\{\text{correct AUTO edits}\}}{\#\{\text{AUTO edits}\}},\]

Correspondingly, the false-correction rate (FCR) measures the proportion of automatic edits that corrupt correct source text:

\[\text{FCR} = \frac{\#\{\text{AUTO edits that corrupted correct source}\}}{\#\{\text{AUTO edits}\}}.\]

Automatic edits are graded on a four-point severity scale: harmless (rendering or reading identically), suspicious (questionable but recoverable), meaning-changing (altering textual meaning), and catastrophic (corrupting mathematical content or destroying meaning). The catastrophic-edit rate is the proportion of AUTO edits graded as catastrophic. Together, precision, FCR, and the catastrophic-edit rate define system safety; a corrector minimizes harm as FCR and catastrophic-edit rates approach zero.

We define two additional metrics to evaluate file integrity and support baseline comparisons. Source integrity requires that input files receive zero modifications, verified by comparing cryptographic hashes before and after execution. A protected-span violation is defined as any edit within a protected region (such as mathematics spans, tables, or labels) lacking a render-equivalence guarantee. This guarantee is a deterministic certificate confirming that the edited LaTeX renders identically to the original (formalized in Section 7.4). Because this metric is system-neutral, the protected-span-violation count serves as our primary comparative unit: any corrector’s output can be evaluated against these regions, regardless of whether the system explicitly detects them. A safe corrector may modify text within a protected span only when the change is render-certified; uncertified edits in these regions constitute violations.

Finally, coverage posture measures the proportion of detected instances edited automatically versus those routed to the review queue. This metric does not represent recall. Computing recall requires a complete inventory of true errors within the corpus; because no such gold-standard dataset exists, absolute recall is out of scope. Instead, we report the system’s disposition of detected errors. Our only recall-related evaluation is a synthetic test evaluating the system’s capacity to recover machine-generated corruptions, which validates candidate ranking rather than coverage of real errors (Section 12).

4.4 Evaluation questions

Our evaluation is structured around four primary research questions. EQ1 (precision / do-no-harm): How frequently does an automatic edit corrupt correct source text, and does the system introduce catastrophic errors to mathematics or meaning? EQ2 (auditability): What proportion of accepted edits can be verified deterministically without relying on external adjudication? EQ3 (the do-no-harm advantage): Do conventional correctors introduce over-corrections in this domain where our system does not? EQ4 (coverage posture): What is the coverage cost of prioritizing precision, and are review-queue routing decisions aligned with the most hazardous error classes? Sections 9.1–9.2 address EQ1, Section 9.3 addresses EQ2, Sections 9.4–9.6 address EQ3, and Section 9.7 addresses EQ4. These metrics are evaluated on the corpus described in Section 5.

5. The corpus

All evaluation results are measured on a corpus of 248 documents, comprising Vietnamese HSG mathematics exam papers and answer keys from provincial and national competitions spanning multiple years. The source files are scanned PDFs processed by the math-aware OCR pipeline and normalized structurally (headings and tables) prior to correction. Because the documents span grade-nine olympiads to national competitions, the corrector must accommodate this structural and curricular diversity.

As shown in the profile in Table 1, every document contains inline mathematics. This highlights the necessity of our design: no prose-only documents exist where general-purpose correctors could operate safely. In addition, displayed equations, embedded images, HTML tables, and grading point markers are common, and thirteen documents contain stray non-Vietnamese glyphs introduced during conversion. The corpus includes exam papers, standalone answer keys, and combined documents, with the latter forming the majority. Importantly, because this corpus represents a normalized conversion layer rather than raw scanner output, raw scanner noise is out of scope. This boundary limits the external validity of our results (Section 12).

All correction runs and audits were conducted using a frozen, hash-manifested snapshot of this corpus. Although the corpus evolved after the initial audit, the audit-time snapshot was reconstructed and verified to ensure that re-running the corrector yields identical results. This setup ensures evaluation reproducibility, which we discuss in detail in Section 13.

What actually goes wrong in these files is the subject of the next section, which answers it with an empirical taxonomy.

6. An empirical error taxonomy

Our third contribution is an empirical taxonomy of OCR conversion errors, where each error class is defined by its textual pattern, severity level, and correction policy. This taxonomy establishes the terminology for our subsequent analysis: the corrector’s rules implement the taxonomy’s policy specifications, and results are reported by class. We introduce the class codes here for use throughout the remainder of the paper.

6.1 Construction

We constructed the taxonomy by reviewing representative documents from all three categories and profiling the corpus using automated scripts. Each class is anchored to a verbatim example from the corpus to ensure it represents an attested error. In our reporting, we distinguish between precise counts, derived from exact-substring or anchored-pattern matching, and coarse counts, which represent order-of-magnitude estimates derived from patterns that may occasionally match correct text. Regardless of the counting method, all class definitions are grounded in verified examples.

6.2 The eight class families

The taxonomy comprises eight error families, labeled A through H. Family A (Vietnamese diacritic and spelling errors on known words) is the most frequent and the safest to repair automatically. Edits are restricted to a closed mathematical lexicon, such as correcting Chúng minh to Chứng minh (‘prove’), vương góc to vuông góc (‘perpendicular’), or thắng hàng to thẳng hàng (‘collinear’). Class A7 is an exception: the collapse of diacritics in uppercase headers, such as HƯỚNG DẪN CHẤM (‘grading guide’), alters document structure and is classified as meaning-changing. Family B (variable-versus-word boundary errors) represents the greatest precision risk. In these cases, the OCR pipeline incorrectly restores diacritics to mathematical variables, translating the product xy to the Vietnamese word xảy (‘to happen’), or vice-versa. Automatic edits in this family are prohibited because they directly corrupt mathematical notation.

Family C (mathematical symbol confusions) includes infinity signs misrecognized as similarity relations (e.g., \infty instead of \sim between triangle labels) and mangled LaTeX commands (e.g., \sosim for \sim). It also includes divisibility symbols rendered as division signs, which are unsafe to correct automatically due to ambiguity with legitimate division. Family D (mathematical structure damage) ranges from harmless double-brace superscript artifacts (such as x^{{2}} rendering identically to x^{2}) and altered expression scopes to lost exponents where the original information is irrecoverable. Family E (prose absorbed into mathematics) is a structural conversion failure where prose sentences are swallowed into math spans, encoding accented Vietnamese characters as LaTeX accent commands. Family F (stray foreign glyphs and hallucinated content) includes non-Vietnamese glyphs replacing mathematical variables and entirely hallucinated tables.

The last two families concern structure. Family G (Markdown structure) covers headings merged into preceding lines, indeterminate headings, and arbitrary heading-depth changes. Family H (answer-key structure) covers grading rubric anomalies, such as point values orphaned on separate lines or point markers missing their units (e.g., [1,00] instead of [1,00 điểm]). Table 2 summarizes the error classes observed in the corpus; the complete taxonomy with examples, severity levels, and policies is provided in Appendix A.

6.3 Severity governs policy

The assignment of AUTO, VERIFY, or LEAVE policies to an error class is governed by a conservative principle: policy tracks the worst-case outcome of an incorrect edit, rather than the average case. Error classes whose incorrect modification could corrupt mathematics are never assigned the AUTO policy. The only exceptions are the symbol-repair classes C1 and C2; these are automated because render-equivalence certificates (Section 7.4) prevent incorrect edits, not because their risk level is low. Consequently, the two most frequent error families sit at opposite ends of the policy spectrum: high-volume diacritic errors (Family A) are automated because their worst-case outcome is a minor spelling slip, while variable-versus-word errors (Family B) are never edited automatically due to the risk of silent mathematical corruption. Error frequency does not influence policy assignment.

6.4 Design implications

These taxonomic properties translate into five design constraints for our corrector. First, because mathematical notation occurs in every document, the system must partition text into protected regions and enforce strict rule-ownership. Second, diacritic errors (Family A) represent the primary automation target, repaired via a closed lexicon outside protected regions. Third, high-risk error families—including variable boundary errors, lost exponents, absorbed prose, and hallucinated content—must be flagged for manual review but never edited automatically. Fourth, document structure normalizations must be conservative and reversible, preserving original structural markers. Fifth, automatic mathematical edits are restricted to a small whitelist of certifiably safe corrections. The system implementation presented in Section 7 operationalizes these five constraints.

7. The ViMath corrector

We refer to our corrector as ViMath. This section describes the core system components that guarantee safety: the sequential pipeline, protected-span partitioning, rule-ownership constraints, the hard-gated scoring mechanism, and engineering invariants. For each component, we detail its inputs, operational logic, and safety guarantees.

7.1 Design principles and pipeline

Four design principles govern ViMath. First, the system is deterministic, utilizing a fixed rule set from the Python standard library with no external network dependencies, GPU requirements, or trained generative components. Second, it is source-preserving: edits are written to a copy alongside a reversible log, ensuring source files remain unaltered. Third, the system is policy-stratified, routing detected errors to AUTO, VERIFY, or LEAVE categories. Fourth, it is auditable, enabling each edit to be reconstructed from its rule ID and document offset. These properties are enforced by the codebase and evaluated in Section 9.

Document processing follows a fixed sequence of stages. First, Unicode normalization maps the text to canonical composed form (NFC) to ensure consistent character comparisons. Second, the protected-span detector partitions the document structurally. Third, automatic rules execute sequentially (the render-safe math whitelist followed by the closed lexicon), followed by open-vocabulary candidate generation (capped at VERIFY), and structural rule applications. Finally, the system executes two detect-only passes: mathematical balance validation and hazard detection. This execution order is deliberate: protected regions are identified before any text modification occurs, preventing rules from acting outside their designated scopes. Detect-only passes run last, evaluating the finalized text. Figure 2 illustrates this pipeline and the policy outcome of each stage. For expository clarity, the subsections below are grouped by the safety guarantees of the rules rather than their execution sequence.

7.2 Protected spans and rule ownership

Prior to edit evaluation, a deterministic detector segments the document into ten non-overlapping, priority-ordered protected regions: displayed mathematics, inline mathematics, HTML, image references, tables, code, point markers, geometry labels, multiple-choice option labels, and enumeration labels. To handle unmatched delimiters, a fail-safe rule triggers when a single math delimiter ($) is detected: the system protects the remaining text on that line and flags the instance for manual review, preventing rules from inadvertently modifying unclosed formulas.

Under this architecture, protected spans remain editable by authorized rules. Specifically, each region type is managed by exactly one rule: the mathematics whitelist modifies math spans, the point-marker rule manages point markers, and any cross-region modification is prevented by design. This ownership model enforces the protected-span invariants defined in Section 4.3. While the system-neutral metric flags any uncertified edit within a protected span, ViMath enforces a stricter condition: edits within a protected region must be applied by the owning rule and accompanied by the corresponding validation certificate. Consequently, the audit flags any unauthorized cross-region edit, recording zero violations across all runs.

7.3 The closed Vietnamese lexicon

High-confidence spelling corrections are managed by a closed lexicon of fourteen entries, mapping attested mathematical corruptions to their correct forms (e.g., Chúng minh to Chứng minh [‘prove’], vương góc to vuông góc [‘perpendicular’]). This closed map is applied via whole-word matching outside protected spans and bypasses the scoring engine entirely. Three properties ensure the safety of this rule. First, the mapping targets are disjoint from the sources, making the operation idempotent. Second, single-letter tokens are excluded from diacritic restoration, eliminating the risk of converting isolated variables into prose words. Third, because replacements are restricted to a pre-defined lexicon, the rule cannot generate illegal syllables. Its only residual risk is contextual—applying a valid replacement where the corrupted string was mathematically intentional—which we evaluate empirically in Section 9.

7.4 The render-safe mathematics whitelist

We permit only three correction rules inside mathematical spans, each requiring a render-equivalence certificate. First, double-brace superscripts are collapsed (e.g., ^{{2}} to ^{2}). Second, invalid similarity commands are restored (e.g., \sosim to \sim). Third, infinity symbols (\infty) are corrected to similarity relations (\sim) only when positioned between verified triangle labels, addressing the notation collision described in Section 2.4. The render-equivalence certificate serves as a strict gating mechanism: modified LaTeX is accepted only if its rendered output is identical to the original or, in the case of invalid commands, renders the intended symbol where the source failed to compile. Uncertified candidates are discarded. This approach rejects string edit distance as a validation metric, as minor string changes in LaTeX can introduce major visual or semantic corruptions [S44].

This certification is deterministic and customized for each rewrite rule, keeping the math whitelist restricted and safe. For double-brace collapse, the certifier verifies that the original and edited forms parse to identical syntax trees, ensuring that braces are structurally redundant rather than load-bearing grouping elements. For command repairs, the certifier confirms that the source command is invalid (failing compilation) and that the replacement matches the standard syntax for the target symbol. This prevents the system from substituting one valid symbol for another. The system places the burden of proof on acceptance: candidates leaving any ambiguity are rejected. Because the whitelist is restricted to three families under separate certificates, automatic edits within mathematics are enumerable and verifiable, enabling their classification as provably do-no-harm during auditing.

7.5 Structural rules

Two automatic structural rules normalize document layout without modifying text content. First, heading depth is normalized across sibling sections, preserving heading text byte-for-byte to resolve non-semantic nesting artifacts. Second, point-marker units are restored (e.g., [1,00] to [1,00 điểm]). This rule is governed by two guards: it is disabled within math spans, and it is suppressed when immediately preceded by interval or set-membership cues (such as \in or the Vietnamese prepositions trên or thuộc). These guards prevent corrupting mathematical intervals that use identical bracket notation. The guard check is restricted to the immediate look-behind context to ensure that genuine line-start grading markers are updated. More complex structural edits, such as splitting merged headings or re-attaching orphaned scores, are restricted to the VERIFY policy and never apply automatic deletions.

7.6 Open-vocabulary candidates and the hard-gated scorer

For errors not covered by the closed lexicon, we introduce a gated open-vocabulary generator. When a token fails spelling and phonotactic checks, the candidate generator searches the corpus-derived lexicon using weighted Levenshtein distance. Candidates within an edit distance of two are retrieved via metric-tree lookup, following filters that exclude proper nouns, uppercase terms, and mathematical variables. Upper-case header corrections are generated by a parallel template matcher. The resulting candidates are scored to prioritize their position in the manual review queue.

The scoring function aggregates five indicators: lexicon validity, syllable legality, weighted edit cost, structural context, and render equivalence. Letting \(s_i\) denote the active signals, \(w_i\) their weights, and \(\rho(c)\) a per-class risk penalty, candidate confidence is:

\[\text{conf} = \frac{\sum_i w_i\, s_i}{\sum_i w_i} - \rho(c),\]

Renormalization is performed over active signals to prevent penalizing candidates for inapplicable indicators. Thresholds partition this confidence score to assign AUTO, VERIFY, or LEAVE policies. Crucially, precision safety is guaranteed by four cap-only hard gates that can demote candidates but never promote them: specifically, candidates in high-risk classes or non-render-equivalent mathematical edits are demoted to LEAVE, math-command edits outside the whitelist are capped at VERIFY, and all candidates generated via open-vocabulary search are capped at VERIFY.

This final cap forms the system’s primary safeguard: because open-vocabulary candidates cannot be applied automatically, modifications to the candidate generator only affect review-queue recall without risking automatic precision. We note that the shipped scorer omits a planned n-gram frequency prior due to the absence of a clean Vietnamese mathematical corpus; candidate confidence is renormalized over the remaining five indicators, and the cap gates ensure that exact weights do not affect automatic precision.

7.7 Detect-only hazards and the review queue

High-risk error classes are flagged and queued for manual inspection without modification. For example, variable-versus-word conflicts, prose segments in math spans, stray foreign glyphs, and unbalanced delimiters are identified, assigned a severity ranking, and logged in the review queue alongside their context. Rather than attempting uncertified corrections in high-risk zones, the system routes these instances to the manual review queue. The distribution and volume of these flagged errors define the coverage posture analyzed in Section 9.7.

7.8 Engineering invariants

All automatic edits are logged reversibly, and the corrector is idempotent, producing zero changes on subsequent executions. A suite of 47 unit tests enforces these safety invariants as executable specifications. These tests verify that no rule modifies spans outside its ownership, that idempotence holds, that point-marker rules skip mathematical spans, that open-vocabulary proposals are held at VERIFY, and that all mathematical edits pass render-equivalence checks. Collectively, they automate verification of the safety constraints described above.

8. Evaluation methodology

To validate our evaluation, we describe the audit protocol, the two-stage edit adjudication process, the statistical treatment, comparison baselines, and predefined release gates. This methodology establishes the validity of our results. We also address a key methodological constraint: the evaluation of the complete edit census was performed by a language model. We explain the resulting threats to validity and the two independent validation steps that mitigate them.

8.1 Audit protocol and the edit census

We ran the corrector over the frozen corpus snapshot, calculating cryptographic hashes for every source file before and after execution. This hash comparison confirmed that the source files remained unaltered. The correction run generated an edit census containing all 2,288 automatic edits across 242 documents (six files received no edits). Each edit was logged with its offset and verified against the system’s invariants, including span ownership, render-equivalence, and idempotence.

We distinguish between two versions of our system: the audited snapshot and the shipped corrector. The audit was executed on the frozen snapshot, while the shipped version differs by a single modification: it implements the interval-cue guard described in Section 7.5, which disables the two false corrections identified during the audit. Consequently, all claims of zero catastrophic edits refer to the shipped corrector. The audited precision represents a lower bound for the shipped version, as the only differing edits are those suppressed by the shipped version. We verified this byte-for-byte: the automatic output of the shipped corrector is identical to the audited snapshot’s output, except for the two suppressed edits.

8.2 Primary adjudication and its disclosed limitation

Certain edits, such as evaluating whether a valid dictionary substitution is contextually appropriate, require human-like judgment and cannot be verified deterministically. Edits not provable by construction were evaluated against a strict rubric by a large language model (Claude), which assigned one of four verdicts: correct, false correction, catastrophic, or ambiguous. Relying on model-based evaluation introduces a potential validity threat, as the model could share systemic blind spots with the system designers. To address this concern, we implement two validation steps: a blind manual verification pass by human annotators (Section 8.3) and a deterministic lower bound that minimizes reliance on automated adjudication (Section 9.3).

8.3 Human verification protocol

To validate the model-based verdicts, two human annotators independently blind-labeled a stratified sample of 381 edits, oversampling high-risk error classes. The sample strata prioritized high-risk categories, covering them near-exhaustively. The sample includes all 158 point-marker insertions [H2], all 11 edits from mathematical command repairs [C1, C2], 100 from the largest diacritic class [A8], 82 across other diacritic classes [A1–A6], and 15 from each of the two provably safe classes (double-brace collapses [D2] and heading-depth normalizations [G3]). Annotators evaluated edits without access to system verdicts or other annotations. A 72-edit subset was double-annotated to measure inter-rater agreement.

We estimated corpus-wide precision by reweighting stratum-specific precision values to match their true proportions in the 2,288-edit population. Pooling raw sample counts directly would distort estimates due to oversampling of high-risk classes. Consequently, rare classes contribute minimally to the aggregate estimate regardless of their sample size, whereas frequent classes are weighted proportionally. Variance calculations utilize stratified-sampling formulas with a finite-population correction. This correction reduces the variance contribution of strata sampled near-exhaustively, as their populations are almost fully observed. This approach yields narrow confidence intervals because high-risk strata were almost fully enumerated, leaving residual uncertainty concentrated in high-volume, safe categories where precision is 100%. One annotator abstained on the 15 heading-depth edits because they were not locally verifiable. Since heading depth normalization is content-preserving by design and carries no precision risk, its exclusion from the precision estimate does not bias safety evaluations.

Inter-annotator agreement must account for the prevalence paradox: when one category dominates the sample (here, ‘correct’ edits), Cohen’s kappa (\(\kappa\)) is deflated despite high raw agreement (Feinstein & Cicchetti, 1990). We define a committed verdict as a non-abstention judgment (correct or incorrect, excluding ‘ambiguous’ labels). We report committed-verdict agreement alongside prevalence-robust metrics, including Gwet’s AC1 (Gwet, 2008) and the Brennan-Prediger coefficient (Brennan & Prediger, 1981), alongside standard kappa (Cohen, 1960). Kappa is accompanied by these metrics to contextualize raw agreement rates.

8.4 Statistical treatment

The unit of analysis is an individual automatic edit. Binomial proportion confidence intervals are calculated using the Wilson score method (Wilson, 1927), which remains robust for proportions near zero or one where normal approximations fail. Because edits are clustered within files (e.g., repeated spelling corrections in a single document), edit-level analysis assumes artificial independence. To address this clustering, we report a seeded file-level cluster bootstrap (10,000 resamples) that resamples documents rather than individual edits (Cameron et al., 2008). Small error classes are reported with their full confidence intervals to prevent overinterpreting low-volume results.

8.5 Baselines and fairness

We evaluate three baseline correctors against the system-neutral protected-span violation metric defined in Section 4.3. This isolates system behavior within protected spans from vocabulary differences. The first is a guard-isolation baseline: a dictionary corrector that shares ViMath’s lexicon and candidate generator but removes the protected-span, render-equivalence, and capping guards. Because the vocabulary is identical, differences in violations directly measure the efficacy of the guards. A secondary variant of this baseline retains math-span avoidance (using standard $ delimiters) to isolate the specific value of fine-grained ownership guards compared to simple delimiter avoidance.

The second is an off-the-shelf baseline utilizing a Vietnamese Hunspell spell checker with a standard dictionary. Two evaluation constraints apply: the dictionary’s limited size means that some over-flagging stems from vocabulary gaps rather than system behavior, and its corruption count is extrapolated from sample evaluations rather than measured directly. The third is a naive language-model baseline evaluated on a pilot scale: a large language model (GLM-5, distinct from the Claude evaluator in Section 8.2) is provided raw text lines containing both prose and formulas, with instructions to correct OCR errors without math masking. This pilot was restricted to eight documents on cost grounds; the results illustrate the safety risks of unconstrained language model usage, though they do not represent the performance of a pipeline utilizing specialized prompts or guards.

8.6 Release gates

Four predefined thresholds serve as release gates: the false-correction rate must not exceed 2%, diacritic-class precision must be at least 98%, the catastrophic-edit rate must be zero, and the render-equivalence of whitelisted math edits must be 100%. These gates operationalize the do-no-harm objective, establishing clear binary success criteria. Their observed values are presented in Section 9.1. We describe these thresholds as predefined specifications rather than formally pre-registered criteria due to repository version-control limitations (Section 12).

8.7 Out-of-distribution protocol

To evaluate if system safety generalizes beyond our primary corpus, we run the corrector on an out-of-distribution dataset comprising 241 documents from a different digitization pipeline and grade band. As this dataset lacks human annotations, we do not estimate precision; instead, the evaluation tests whether the zero-protected-span-violation rate is maintained under distribution shift. Section 9 reports our findings by research question.

9. Results

The following subsections present the experimental setup, observations, interpretations, and caveats for each research question, utilizing data from the frozen audit and analysis artifacts.

9.1 Do-no-harm precision (EQ1)

Across the 2,288 automatic edits in the census, overall precision is 99.913% (2,286 correct edits), with a 95% Wilson score interval of 99.682%–99.976% (Figure 3). The false-correction rate is 0.087% (2 edits; 95% CI: 0.024%–0.318%). Cryptographic hash validation confirmed that no source file was altered. Furthermore, all four release gates were satisfied: the false-correction rate remained below the 2% threshold, diacritic-class precision was 100%, the catastrophic-edit rate for the shipped corrector was zero, and all whitelisted math edits maintained exact render-equivalence (comprising 331 double-brace collapses and 11 certified symbol-command repairs, Section 7.4). Table 3 details precision by error class, and Table 4 summarizes release gate outcomes. To control for within-file edit clustering, we report the file-level cluster bootstrap: the cluster-robust 95% confidence interval is 99.711%–100.000%. Because this cluster-robust lower bound is consistent with the edit-level Wilson lower bound (99.682%), treating within-file edits as independent does not artificially inflate our precision estimates. However, because both false corrections occurred in a single document, the bootstrap resampling distribution is highly discrete, and this interval should be interpreted as an approximation.

The distribution of errors across classes reveals that both false corrections were isolated to point-marker unit insertions (Class H2, 98.73% precision); all other eleven active classes achieved 100% precision (Figure 3). While the small sample sizes for mathematical command repairs (C1, C2) yield wide confidence intervals, their observed precision remains 100%. The catastrophic-edit rate of zero applies to the shipped corrector under the scoping detailed in Section 8.1. The two false corrections in the audited snapshot were classified as catastrophic under human adjudication; both are suppressed in the shipped version by the interval-cue guard. Because this guard was introduced in response to the audit, the zero catastrophic-edit rate represents an in-sample result on this corpus (further analyzed in Sections 10 and 12). We analyze the two edits in Section 10.

¹ The audited snapshot had a catastrophic rate of 0.087% (2 of 2,288 edits) under the stricter human grading; these two errors are resolved in the shipped corrector.

9.2 Human verification (EQ1, upgraded)

The double-blind human annotation pass validates the model-based results. The population-weighted human precision estimate is 99.89% (95% CI: 99.87%–99.91%), which is consistent with the model-adjudicated precision of 99.913%. The human annotators identified no errors beyond the two documented point-marker cases. Raw agreement between human labels and model verdicts is 94.0%, and inter-annotator agreement is 90.3%. Crucially, on all edits where both raters committed to a verdict, agreement is 100%; thus, all disagreements stem from abstentions rather than contradictory classifications. Prevalence-robust agreement metrics indicate high consistency: Gwet’s AC1 is 0.938 against the model and 0.899 between human annotators, while the Brennan-Prediger coefficient is 0.920 and 0.870. Conversely, Cohen’s kappa (\(\kappa\)) is deflated to 0.076 and 0.205 due to the extreme prevalence of correct edits, illustrating the paradox described in Section 8.3. Table 5 presents the complete agreement battery.

While a sample size of 381 yields a narrow confidence interval, this is a direct result of our stratified sampling methodology. Because high-risk strata were sampled almost exhaustively, their precision is estimated with minimal sampling uncertainty, and the estimator is finite-population-corrected. Two caveats apply to this precision estimate. First, the interval narrows since strata with 100% observed precision contribute zero sampling variance under normal approximations. This underestimates the uncertainty that boundary-aware intervals would retain. For this reason, we report the wider census-level Wilson intervals and the wide confidence intervals for small error classes (Table 3). Second, low-risk classes were sampled lightly (e.g., 100 out of 605 edits in Class A8), meaning near-exhaustive coverage is limited to high-risk strata. These results confirm that automatic edits are human-verified in the categories where over-correction risks are highest, addressing the model-adjudication threat discussed in Section 8.2. Heading-depth edits, which are content-preserving and carry no precision risk, are excluded from this estimate.

9.3 What the precision rests on: the deterministic floor (EQ2)

While the human verification pass addresses potential model bias, we establish a second, independent safeguard through a deterministic lower bound. Every edit in the 2,288-edit census is fully reproducible via deterministic rules, containing no machine-learning or generative models in the correction pipeline. Of these edits, 689 (30.1%) are structurally prevented from corrupting text. This safety guarantee operates in two ways. First, the 331 render-identical mathematics collapses (14.5%) preserve the rendered PDF output byte-for-byte, eliminating the possibility of semantic alteration. Second, the 358 heading-depth normalizations (15.6%) preserve heading text byte-for-byte outside of math spans. The only modified attribute is heading depth in the document tree; since depth normalization is a non-local structural choice rather than a textual edit, one annotator abstained from grading these cases (Section 8.3). Additionally, 1,441 edits (63.0%) are restricted to fixed-dictionary and whitelist substitutions that are guaranteed to yield valid Vietnamese syllables, leaving only their contextual suitability subject to adjudication. The remaining 158 edits (6.9%) represent math-guarded point-marker unit insertions; this category contains both false corrections. Table 6 summarizes these verifiability categories. These findings empirically validate the gating architecture defined in Section 7.6: the cap gates function as intended, preventing all open-vocabulary candidates from entering the automatic output path. Consequently, evaluation accuracy is only critical for the 6.9% guarded insertion tier where errors can occur, rather than the entire automatic edit census.

9.4 The do-no-harm advantage and guard ablation (EQ3)

This baseline comparison evaluates the current corpus where the system applies 2,022 automatic edits, compared to the 2,288 edits in the frozen audit snapshot (Sections 5 and 13). The system’s safety properties remain identical across both versions. Under the protected-span violation metric, ViMath records zero violations; its only operations inside mathematical regions are 342 certified edits (331 render-identical collapses and 11 command repairs) that are verified to preserve compilation and layout. In contrast, the guard-isolation baseline makes 105,412 edits and introduces 91,126 protected-span violations. Among these, 72,484 violations occur within math spans, corrupting formulas, HTML syntax, geometry labels, and tables. An off-the-shelf Hunspell spell checker introduces an estimated 169,656 violations. Ablation analysis isolates the contribution of each safety mechanism. Restricting the naive corrector to avoid $ math spans eliminates in-formula corruptions but still leaves 18,642 violations, primarily in HTML layouts (14,410), tables, image references, and geometric markers. Thus, fine-grained region ownership guards—rather than simple math-span avoidance—are required to prevent document corruption. Table 7 and Figure 4 present these comparison results.

² The baseline comparison is run on the current, drifted corpus (2,022 system auto-edits) rather than the frozen audit snapshot (2,288 edits). ³ Comprising 331 render-identical collapses and 11 command-repairs certified by intended-symbol recovery.

This evaluation serves as a guard-isolation ablation rather than a benchmark against a specialized OCR correction engine. Because the naive baselines share our lexicon, they represent a controlled setting that isolates the effect of the guards from vocabulary differences. The Hunspell metric is an extrapolated estimate rather than a census. Nevertheless, the ablation demonstrates that fine-grained ownership guards are the primary mechanism enabling a zero-corruption rate.

9.5 A naive language model is not do-no-harm (EQ3)

In the eight-document pilot evaluation, the naive language-model baseline modified 392 lines and introduced 238 protected-span violations, including 204 violations within mathematical spans (averaging 30 total violations and 25 mathematical violations per document). These violations include a semantic corruption: the model regrouped an exponent, transforming the expression (\sqrt{3})^2 x^2 + 9x into (\sqrt{3})^{2x^2+9x} (Figure 1). The baseline model also introduced invalid LaTeX accent commands while modifying mathematical regions. Under identical conditions, ViMath introduced zero violations. These results are bounded by two experimental constraints: the pilot evaluated a single model with a generic prompt across eight documents. Consequently, this comparison demonstrates the risks of unconstrained language model usage, rather than establishing an upper bound on the safety of engineered language-model pipelines. A full-corpus run was omitted due to API cost constraints.

9.6 Out-of-distribution check (EQ3, external validity)

On the 241-document out-of-distribution corpus, ViMath applied 1,457 automatic edits with zero protected-span violations. By comparison, the naive baseline applied to a 60-document sample of this dataset generated 42,822 violations. Table 8 presents these results. These findings indicate that the zero-violation property is a function of the system’s guard architecture rather than a artifact of the primary corpus, as safety is maintained under changes in digitization pipeline and grade difficulty. Because the out-of-distribution corpus lacks ground-truth labels, we do not evaluate edit precision or false-correction rates on this dataset.

9.7 Coverage posture (EQ4)

Prioritizing precision restricts the system’s overall recall. Out of 3,485 detected candidates, 65.7% (2,288 edits) were processed automatically, while the remaining 34.3% (1,197 instances) were routed to the manual review queue to prevent potential errors. The distribution of these uncorrected instances is concentrated in high-risk categories flagged as LEAVE: 256 catastrophic-class hazards and 545 meaning-changing corruptions. These are primarily composed of variable-versus-word confusions (305), prose merged into mathematical spans (236), delimiter balance failures (240), and hallucinated content (20). The remaining instances comprise structural edits: 221 merged headings proposed for splitting under the VERIFY policy and 18 orphaned scores proposed for re-attachment (with 50 additional cases flagged for review without proposals). An additional 87 harmless annotations are logged for completeness. Table 9 and Figure 5 summarize these distributions. These findings demonstrate that manual review routing aligns with high-risk categories rather than random error detection. The review queue represents the trade-off of a safety-first architecture, directing edits where structural ambiguity is highest. We note that overall system recall remains unmeasured; these metrics describe the disposition of detected candidates rather than the coverage of all corpus errors.

In summary, the four evaluation questions establish a consistent performance profile. Overall precision is high and human-validated (EQ1), with the majority of edits protected by deterministic rules that do not require heuristic adjudication (EQ2). Ablation and out-of-distribution analyses confirm that this safety profile is a function of the system guards rather than vocabulary characteristics (EQ3), with manual review routing restricted to high-risk categories (EQ4). Our evaluation focuses specifically on safety metrics—namely, false-correction and protected-span-violation rates—rather than overall repair recall. These results demonstrate that a safety-first architecture can achieve high precision through systematic verification. The two false corrections identified in the audit highlight the importance of enforcing conservative defaults when local context is ambiguous. Section 10 analyzes these two false corrections alongside representative cases of correctly rejected candidates.

10. Error analysis

The system’s error profile consists of exactly two false corrections, both sharing a single failure mechanism. Analyzing these errors, their corresponding guards, and the candidates correctly rejected by the system provides key insights into the safety-first architecture.

Both false corrections occurred when the point-marker rule erroneously targeted mathematical intervals written in plain prose, rather than actual grading indicators. Specifically, the bracketed expression [0,2] appeared in \(\forall x \in [0,2]\) (‘for all \(x\) in \([0,2]\)’) and \(f\) liên tục trên \([0,2]\) (‘\(f\) continuous on \([0,2]\)’). The point-marker rule inserted the unit điểm (‘points’), transforming the mathematical interval into [0,2 điểm] and corrupting the syntax. The automated and human adjudicators evaluated these edits differently: the language model classified them as false corrections, whereas the human annotators classified them as catastrophic. The human annotation represents the more accurate interpretation, as appending a grading unit to a mathematical interval alters the fundamental meaning of the expression. While overall precision remains unaffected because both verdicts represent errors, this discrepancy highlights the necessity of the guard mechanisms.

The underlying issue is structural: the point-marker rule was guarded only against marked-up math spans (delimited text blocks). Consequently, mathematical intervals written in plain prose without delimiters bypassed these span-level guards. This illustrates the limitation of region-restricted guards, which cannot detect mathematical context in surrounding prose. To resolve this, we implemented a local look-behind: the point-marker rule is suppressed if the bracket is immediately preceded by an interval or set-membership cue. This mechanism filters out mathematical intervals while allowing genuine grading markers to be corrected (for instance, 13 of the 156 correct cases occur at the start of a line and are correctly preserved). These failing cases were added to our regression suite, and the shipped corrector resolves both errors. We note that because this guard was implemented in response to the audit, the zero catastrophic-edit rate for the shipped corrector is an in-sample result on this corpus. Although the look-behind cue list generalizes the failure mechanism rather than hard-coding the two strings, it has not been validated against all possible out-of-sample phrasing variations. This look-behind guard guarantees that the audited precision represents a lower bound for the shipped corrector on the audited edits (Section 8.1); performance on novel interval-bearing prose remains an area for future evaluation.

These two errors illustrate a general failure-mode taxonomy for conservative text correctors in structured domains. The first category is the ambiguous-notation collision, where a string is structurally identical across different semantic roles (e.g., bracket notation representing both grading markers and closed intervals). The second is the invisible-context edit, where a guard restricted to marked-up spans cannot detect semantic context in adjacent prose. The third is the vocabulary-ambiguous substitution, where a valid dictionary replacement is contextually incorrect. For example, restoring diacritics to convert Vây to Vậy would be incorrect if the source was the noun Vây (‘fin’). However, this risk did not materialize in the audit: human verification confirmed that all 100 sampled A8 edits were correct. These three failure modes reinforce our core design principle: corrections must be disambiguated by local context, and in the absence of sufficient contextual information, the text must remain unmodified.

Complementing these two errors are the candidates rejected by the system’s safety guards. The system handles ambiguous cases conservatively: for instance, it flags ASCII tokens that could represent either mathematical products (e.g., xy) or un-diacritized Vietnamese words (e.g., xảy), since they cannot be distinguished without semantic context. It also identifies mathematical spans containing letter-by-letter encoded prose for manual reconstruction, rather than attempting to inject diacritics into math commands. Similarly, hallucinated tables containing foreign characters are left unchanged and flagged for review. Instead of failing silently, each rejection is logged in the review queue with a severity rank and diagnostic metadata. This structured logging enables the coverage posture analyzed in Section 9.7. These results and failure modes extend to other structured text-correction domains under specific constraints.

11. Discussion

Although the specific correction rules implemented in ViMath are tailored to Vietnamese mathematics answer keys, the underlying architectural concepts are domain-agnostic. We identify four design principles that generalize to high-stakes correction environments where the cost of false corrections exceeds that of missed errors.

First, region ownership rather than blanket freezing allows targeted modifications in protected zones. Simply declaring mathematical spans off-limits is overly restrictive, as some corrections within math regions are beneficial. Instead, the system assigns exactly one rule to each region type, treating unauthorized edits as architectural violations detectable during auditing. Second, we advocate for verification certificates rather than heuristic checks. Edits in high-risk zones must provide a positive certificate of safety—such as confirming that modified LaTeX renders to identical output. This ensures that modifications inside mathematical regions are supported by compiling proofs rather than heuristic assertions. Third, cap-only gating ensures that precision remains monotonic under system extensions. By restricting recall-oriented components (such as open-vocabulary candidate generators) to the manual review queue, improvements in recall do not degrade automatic precision. Finally, conservative defaults for ambiguous context dictate that when local context is insufficient for disambiguation, the text must remain unmodified. The two errors identified in this study represent cases where this safety default was not yet fully implemented.

Beyond numerical precision, the system’s primary contribution is structured auditability. The reported precision is supported by a verifiable tier structure: a content-preserving tier where false corrections are structurally impossible, a sanctioned-output tier where output forms are guaranteed, and a bounded, guarded tier where errors are confined. This categorization allows reviewers to quantify the proportion of edits relying on heuristic adjudication (6.9% in this study), with the remaining 93.1% verified by deterministic properties. Exposing this verification structure provides a more transparent safety guarantee than aggregate accuracy metrics alone.

Furthermore, our safety-oriented evaluation methodology reframes the correction task. Traditional post-OCR correction metrics focus on recall (the proportion of errors corrected), which is inappropriate when the primary risk is corrupting correct text. Prioritizing false-correction rates and source integrity over simple error correction alters the success criteria for automated pipelines. Under this framework, a system must demonstrate that it does not introduce corruptions, independently of its repair volume. This safety-first approach allows correction pipelines to be audited prior to deployment rather than evaluated post-hoc. We do not suggest that false-correction rates should replace recall-oriented metrics when recall is paramount; rather, for high-stakes, structure-rich documents, safety metrics must be reported alongside recall to verify document integrity. Generating these safety metrics is computationally straightforward once an edit census is established.

Our results also clarify the role of large language models (LLMs) in structured text correction. While LLMs are a common choice for OCR correction, our pilot study demonstrates their tendency to introduce semantic corruptions. Rather than using post-hoc guardrails to filter LLM outputs, we propose integrating LLMs as proposal generators within a gated architecture. Specifically, LLM proposals can be routed through deterministic validators and capping gates, ensuring their suggestions enter the manual review queue rather than applying automatically. We note that this LLM-proposal pipeline remains unimplemented and is excluded from our current evaluations.

Finally, the scope of this approach is restricted to closed domains characterized by enumerable safety rules, high asymmetry in error costs, and manual review capacity. It is not suited for open-vocabulary prose correction where recall is primary, nor for raw scanner noise correction or unstructured text domains. We also note that the closed Vietnamese mathematical lexicon is small (14 entries) and hand-authored. The primary contribution lies not in lexicon scale, but in the gating architecture, audit protocol, error taxonomy, and precision-first optimization that collectively make near-perfect correction safety verifiable. The limits of these findings are detailed in the following section.

12. Limitations and threats to validity

This section presents the primary threats to the validity of our findings, along with their corresponding boundaries and mitigation strategies, ordered by severity.

Adjudication provenance. Evaluating the complete edit census using a language model introduces a potential validation threat, as the model could share systemic blind spots with the system designers. This threat is mitigated by the double-blind human validation pass, which estimated a population-weighted human precision of 99.89% with zero new errors and high prevalence-robust agreement. Furthermore, the deterministic lower bound restricts model-dependent evaluation: approximately one-third of edits are content-preserving by construction (render-identical collapses or heading depth normalizations) and carry zero precision risk. Although the human annotators abstained from grading heading depth edits, these changes are content-preserving and do not alter document text. Finally, the low Cohen’s kappa (\(\kappa\)) value is a prevalence-paradox artifact (Section 8.3) and does not indicate low annotator consistency.

Single-corpus evaluation and composition dependence. Edit precision was measured on a single 248-document corpus. The out-of-distribution evaluation verified only the preservation of the zero-violation safety property, as this secondary dataset lacked ground-truth labels. We did not test raw scanner noise or other academic subjects, meaning cross-corpus precision remains unquantified. Additionally, the observed precision is conditional on corpus composition. Both false corrections occurred in a single document where the point-marker rule targeted mathematical intervals written in plain prose. The low false-correction rate thus reflects the low density of plain-prose intervals in this dataset. A corpus with a higher density of such constructions would challenge the point-marker rule (Class H2, 98.73% precision) more severely. Consequently, precision is a joint property of the system and the evaluation corpus.

Post-normalization scope. The system targets conversion-layer errors following initial document normalization, rather than raw scanner outputs. The results may not generalize to raw OCR engines. This boundary condition is discussed in Sections 2.3 and 5.

Baseline comparisons. The baseline evaluations measure the efficacy of our guards rather than benchmarking against specialized, state-of-the-art OCR correction systems. The naive baselines share our system vocabulary by design, the Hunspell metrics rely on sample extrapolations, and the language model baseline is restricted to a pilot study using a generic prompt. These comparisons do not represent performance against customized, domain-specific correctors.

Absence of recall quantification. We evaluate only the system’s coverage posture. Because a comprehensive gold-standard error inventory of the corpus is unavailable, we cannot calculate overall recall or corpus-wide error rate reductions. Developing such an error inventory remains a key direction for future work. Our precision metric measures safety (non-corruption) rather than repair utility. Since a trivial system that applies zero edits would achieve 100% precision, the coverage posture metrics in Section 9.7 are necessary to demonstrate that the system processes a substantial volume of errors. We also conducted a synthetic recall evaluation where candidate rankings recovered simulated corruptions with high accuracy. However, because these corruptions were generated using the system’s own confusion model, this test only validates the candidate-ranking algorithm and does not measure recall on real-world OCR errors.

Low-volume error classes. Two mathematical command repair classes contain only nine and two edits, yielding wide confidence intervals. These results are reported for completeness but should not be interpreted as definitive precision estimates.

Statistical constraints. Because both false corrections occurred in a single file, the cluster bootstrap distribution is highly discrete, making its confidence intervals approximate. Additionally, the population-weighted human confidence interval is narrower than the census-level interval because strata with 100% precision contribute zero variance under normal approximations. This interval must be interpreted alongside the wider census-level Wilson intervals and low-volume class intervals.

Version scoping and in-sample corrections. All claims of zero catastrophic edits refer to the shipped corrector. This safety level was achieved by implementing the interval guard in response to the two failures surfaced during the audit. The zero catastrophic-edit rate is therefore an in-sample result. While the look-behind guard generalizes the failure mechanism rather than memorizing specific strings, it has not been validated out-of-sample against all possible phrasing variations of mathematical intervals.

Provenance limitations. The project lacks a complete version-control history for its initial development phases. To ensure reproducibility, we verified the data provenance using cryptographic hash manifests and a reconstructed audit snapshot. Similarly, our release gates are described as predefined specifications rather than formally pre-registered trial criteria.

What we can guarantee is the reproducibility of the evidence itself.

13. Reproducibility and artifact availability

To facilitate third-party verification, we specify the reproducibility of each system artifact. We provide the corrector code (dependent only on the standard library), the frozen edit census with its corresponding adjudication labels, human annotation sheets, analysis scripts, cryptographic hash manifests, and the reconstructed audit-time corpus snapshot. This snapshot is verified to reproduce the frozen output when evaluated with the shipped corrector, excluding the two edits suppressed by the interval guard. Corpus redistribution is subject to licensing constraints discussed in Section 14.

The quantitative results presented in this paper reproduce deterministically: precision metrics are derived byte-for-byte from the frozen census, human verification statistics compile directly from the annotation sheets, all tables are generated by provided scripts, and the 47 unit tests verify the safety invariants. These computations do not rely on stochastic model executions.

Conversely, we document non-reproducible components. The language-model adjudication is a static artifact, as model responses are stochastic and non-replayable; reproducing the audit requires re-scoring the frozen labels rather than executing fresh API calls. Additionally, the active corpus drifted following the audit. Because end-to-end runs on the active corpus yield different edit counts, the frozen census serves as the primary dataset of record. Environment specifications (such as console encoding and interpreter versions) are documented alongside the artifacts.

14. Ethical considerations

The design objective of preserving mathematical and semantic content carries an operational obligation. Deploying this system on examination materials requires maintaining the manual review queue, as the 34.3% of candidates routed to VERIFY or LEAVE cannot be resolved automatically. We do not support fully automated deployments; bypassing the manual review queue would compromise the system’s safety guarantees.

The evaluation dataset consists of public examination materials, and no personally identifiable information was processed. Human annotators followed documented guidelines; details regarding annotator compensation and relationships to the authors are disclosed in accordance with venue requirements. The copyright and licensing terms for exam content redistribution must be resolved prior to corpus release. The dual-use risks of this system are minimal, as the corrector is designed to reject uncertified changes rather than generate or modify text content.

15. Conclusion

Post-OCR correction of math-bearing documents requires a safety-first approach that prioritizes precision over recall. Because false corrections to mathematical formulas or grading indicators degrade document utility, correction pipelines must ensure that modifications do not introduce semantic errors. We designed a deterministic, resource-efficient corrector (ViMath) that enforces safety constraints by design using protected-span ownership, render-equivalence certification, and cap-only policy gates. We validated this system through a complete census of all automatic edits.

Our empirical results demonstrate the effectiveness of this architecture. ViMath achieved 99.913% precision over a census of 2,288 automatic edits, validated by double-blind human annotation at 99.89% on a stratified sample. The shipped corrector introduced zero catastrophic edits and zero source-file alterations, with approximately 30% of all edits being structurally content-preserving. In baseline comparisons, ViMath committed zero protected-span violations, compared to 91,126 violations for the guard-isolation baseline and an estimated 169,656 violations for an off-the-shelf spell checker. This zero-violation safety property generalizes to an out-of-distribution dataset under distribution shift. These results indicate that verifiable, safe text correction can be achieved using deterministic rules without requiring model training, specialized hardware, or language model dependencies. The proposed verification tiers—provable, sanctioned, and guarded—establish a framework for evaluating and auditing safety-critical document correction pipelines.

These findings are subject to specific limitations. The precision metrics were evaluated on a single labeled corpus of normalized documents, and out-of-distribution tests verify only the preservation of the safety property rather than precision rates. Furthermore, our evaluation focuses on safety rather than absolute recall or repair utility. Future research should focus on: developing a gold-standard error inventory to measure recall and character error rate reductions; integrating LLMs as candidate generators within the gated architecture; evaluating performance on raw OCR outputs; and establishing full-corpus LLM baselines. Ultimately, rather than treating error correction as an unconstrained text-generation task, high-stakes document pipelines must prioritize the preservation of semantic structure through verifiable, deterministic bounds.

Acknowledgments

The author gratefully acknowledges AWS for providing funding support for this research.

References

Entries marked “(arXiv)” are preprints; their existence and metadata were checked, and their preprint status is retained deliberately.

Statistical methods.

Brennan, R. L., & Prediger, D. J. (1981). Coefficient kappa: Some uses, misuses, and alternatives. Educational and Psychological Measurement, 41(3), 687–699.

Cameron, A. C., Gelbach, J. B., & Miller, D. L. (2008). Bootstrap-based improvements for inference with clustered errors. Review of Economics and Statistics, 90(3), 414–427.

Cohen, J. (1960). A coefficient of agreement for nominal scales. Educational and Psychological Measurement, 20(1), 37–46.

Feinstein, A. R., & Cicchetti, D. V. (1990). High agreement but low kappa: I. The problems of two paradoxes. Journal of Clinical Epidemiology, 43(6), 543–549.

Gwet, K. L. (2008). Computing inter-rater reliability and its variance in the presence of high agreement. British Journal of Mathematical and Statistical Psychology, 61(1), 29–48.

Wilson, E. B. (1927). Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158), 209–212.

Appendix A. Full error taxonomy

The main-text taxonomy (Section 6) summarizes the classes that fire; this appendix records the full set with a verbatim example, severity, and policy for each. Frequency labels follow the convention of Section 6.1: precise counts come from exact-substring or anchored matching, coarse counts over-match and are order-of-magnitude only. Examples are copied from real corpus files.

A. Vietnamese diacritic and spelling errors (prose). A1 Chúng minh → Chứng minh (“prove”); A2 vương góc → vuông góc (“perpendicular”); A3 tư giác → tứ giác (“quadrilateral”); A4 thắng hàng → thẳng hàng (“collinear”); A5 đằng thức → đẳng thức (“identity”); A6 phần biệt → phân biệt (“distinct”); A7 uppercase-header diacritic collapse (e.g. HUÓNG DẪN CHÁM → HƯỚNG DẪN CHẤM, “grading guide”), meaning-changing, VERIFY; A8 miscellaneous closed-lexicon (Vây → Vậy, cũa → của), harmless to suspicious, AUTO. Families A1–A6 and A8 are AUTO; the same word is corrupted differently across files, which rules out a single find-and-replace and argues for a lexicon plus syllable-legality scoring.

B. Variable-versus-word boundary errors. B1 a variable string diacritized into a word (xy read as xảy), meaning-changing, LEAVE; B2 an angle hat rendered as a vector arrow (\overrightarrow{BAC} for \widehat{BAC}), meaning-changing, VERIFY; B3 a vector arrow reversed, meaning-changing, LEAVE.

C. Mathematical symbol confusions. C1 \infty used for the similarity relation between triangles (\Delta BHC \infty \Delta BID), AUTO only on the anchored triangle pattern; C2 \sim corrupted to an invalid command (\sosim), catastrophic-to-render, AUTO under the whitelist; C3 divisibility written as division (\div for the “divides” relation), meaning-changing, LEAVE (ambiguous with real division); C4 a non-membership symbol rendered as another glyph, meaning-changing, VERIFY.

D. Mathematical structure damage. D1 a lost or altered exponent variable, catastrophic, LEAVE (the information is gone); D2 a double-brace superscript artifact (x^{{2}}), harmless, AUTO (render-identical normalization); D3 changed square-root or parenthesis scope, meaning-changing, LEAVE; D4 a dropped multiplication out of math mode, suspicious, VERIFY; D5 an unbalanced inline $ delimiter, meaning-changing, LEAVE (flag, do not auto-close); D6 unbalanced mathematics delimiters, meaning-changing, LEAVE.

E. Prose absorbed into mathematics. E1 a whole Vietnamese sentence swallowed into a $…$ or $$…$$ block with each accented letter encoded as a stray LaTeX accent command, catastrophic, LEAVE; E2 the same with an interspersed stray glyph; E3 a scored parenthetical encoded inside math, suspicious, VERIFY.

F. Stray foreign glyphs and hallucinated content. F1 a stray non-Vietnamese glyph replacing a word inside mathematics, catastrophic, LEAVE; F2 an entirely hallucinated table of Chinese column headers, catastrophic, LEAVE (flag the whole block).

G. Markdown and document-structure errors. G1 a heading merged into the previous line (a Câu N glued onto prose), meaning-changing, VERIFY (split, never delete); G2 an indeterminate heading (Câu (không xác định)), suspicious, LEAVE; G3 escalating heading depth with no semantic meaning, harmless, AUTO (normalize sibling headings); G4 a duplicated bracketed question, suspicious, VERIFY; G5 mixed image encodings, harmless, LEAVE; G6 continuation markers, harmless, LEAVE.

H. Answer-key and solution-structure errors. H1 an orphaned score on its own line, suspicious, VERIFY (re-attach with anchor evidence); H2 a point marker missing its unit ([1,00] → [1,00 điểm]), harmless, AUTO; H3 a score embedded inside a math block, suspicious, VERIFY; H4 a question restated before its solution that diverges from the original, meaning-changing, LEAVE.

Appendix B. Rule inventory

Protected-span kinds (ten), in priority order. Displayed mathematics, inline mathematics, HTML, image references, tables, code, point markers, geometry labels, multiple-choice option labels, and enumeration labels. The detector is non-overlapping: higher-priority kinds claim their text first. The odd-$ fail-safe protects an unmatched delimiter to end-of-line and raises a VERIFY flag.

Closed lexicon (fourteen entries; representative). Each entry maps an attested corruption of a closed mathematical word to its unique correct form, matched whole-word outside protected spans at fixed confidence and bypassing the scorer: Chúng minh → Chứng minh, vương góc → vuông góc, tư giác → tứ giác, thắng hàng → thẳng hàng, đằng thức → đẳng thức, phần biệt → phân biệt, Vây → Vậy, cũa → của, among others. No target is also a source, so the map is idempotent; single-letter tokens are never diacritized.

Render-safe whitelist (three rewrites). Double-brace collapse (^{{2}} → ^{2}, render-identical); invalid similarity-command repair (\sosim → \sim); infinity-to-similarity restoration (\infty → \sim) only between two triangle labels. Each candidate is admitted only under a positive render-equivalence certificate; uncertifiable candidates are dropped.

Interval-cue guard. The point-marker unit rule is suppressed when the bracket is immediately preceded by a set-membership or interval cue — a membership symbol, or trên (“on”), thuộc (“belonging to”), khoảng (“open interval”), đoạn (“closed interval”) — checked locally so a genuine line-start marker still receives its unit.

Scorer. Five signals with weights — lexicon validity 0.30, syllable legality 0.20, inverse edit cost 0.15, structural fit 0.10, render equivalence 0.15 — combined and renormalized over the signals a candidate carries, minus a per-class risk penalty of 0.40. Two thresholds partition AUTO (confidence ≥ 0.95) from VERIFY (≥ 0.70) from LEAVE. Four cap-only hard gates can only demote: dangerous classes to LEAVE; any non-render-equivalent mathematics edit to LEAVE; a small set of math-command and structural repair classes (C1, C2, D4) reaching the scorer to at most VERIFY; and any open-vocabulary candidate to at most VERIFY, regardless of score. The design’s n-gram prior term is omitted in the shipped scorer; the cap gates make the exact weights immaterial to automatic-edit precision.

Appendix C. Human annotation materials

Verdict rubric. Each edit was graded correct, false correction, catastrophic, or ambiguous (abstention). A committed verdict is any non-abstention judgment.

Stratum design (381 edits). All 158 point-marker insertions (H2); all 11 risky mathematics command-repair edits (C1 and C2); 100 of the largest diacritic class (A8); 82 across the remaining diacritic classes (A1–A6); 15 render-identical collapses (D2); and 15 heading-depth re-levelings (G3). A 72-edit subset was double-annotated for agreement.

Agreement coefficients. Raw agreement is the proportion of edits on which two raters give the same verdict. Cohen’s κ corrects for chance agreement under the raters’ marginal label rates and is deflated when one label dominates. Brennan–Prediger and Gwet’s AC1 correct for chance under prevalence-robust assumptions and remain informative at high prevalence. Committed-verdict agreement is raw agreement restricted to edits where both raters committed a verdict.

Disagreements. All 23 human-versus-model disagreements were abstentions except the two known point-marker errors, which the human graded catastrophic and the model graded false correction; no disagreement was a correct-versus-error contradiction.

Appendix D. Baseline configuration

Guard-isolation baseline. The naive dictionary corrector reuses the system’s own closed lexicon and open-vocabulary generator with the protected-span, render-equivalence, and cap guards removed; a second variant retains only avoidance of $ mathematics. Both are measured against the system-neutral protected-span-violation metric.

Off-the-shelf baseline. A Vietnamese Hunspell dictionary flags tokens absent from its word list; its would-corrupt count is estimated by measuring, on a 300-token sample, the rate at which its suggestion function offers a replacement (about 84%) and extrapolating to all flagged tokens inside protected spans. This figure is labelled an estimate wherever it appears.

Naive language-model baseline. A strong general-purpose language model was given raw lines of prose and mathematics with a generic instruction to fix OCR errors and no mathematics masking, on eight files. The pilot consumed roughly 141,594 tokens; a full-corpus run was estimated at about thirty-one times that and withheld on cost grounds.

Appendix E. Extended results

The compact main-text precision table (Table 3) already carries every class’s Wilson interval. Two additional statistical notes: the file-level cluster bootstrap (10,000 seeded resamples) gives a precision interval of 99.711% to 100.000% and a false-correction-rate interval of 0.000% to 0.289%, and because both errors sit in a single file the resampling distribution is discrete — a large share of resamples contain no error — so the interval is reported as approximate. The out-of-distribution run breaks down by rule as 1,303 lexicon edits, 88 heading-depth normalizations, 64 render-gated whitelist edits, and 2 point-marker insertions, with zero protected-span violations.

Appendix F. Reproducibility manifest

The released artifacts are the corrector (standard-library, CPU-only), the frozen edit census with its adjudication labels, the human-annotation sheets, the analysis scripts, the hash manifests, and the reconstructed audit-time corpus snapshot. Headline metrics re-derive byte-for-byte from the frozen census and labels; the human-verification statistics re-derive from the frozen sheets; every table regenerates from its script; and the 47 unit tests re-check the do-no-harm invariants. The language-model adjudication is a frozen one-time artifact: reproduction means re-scoring the frozen labels, not regenerating them. The live corpus has drifted since the audit, so the frozen census — not a live re-run — is the evidence of record; the reconstructed snapshot round-trips against the shipped corrector’s output except for the two documented interval-guard fixes.

Source code and repository access. The standalone, front-facing implementation of ViMath-OCR Repair, including the corrector runtime, offline audit harnesses, baseline evaluation scripts, and test suites, is publicly available on GitHub at thenewcodingera2023/VietAlpha_Research/vimath-ocr-repair.

---

Project stage: Cadmus Pipeline — Post-OCR Correction. Research note compiled from the ViMath corrector audit inventory; figures and tables generated July 2026.