Deterministic Pair-Completion Guardrails for Streaming LLM Output

A new preprint on arXiv (2608.10279) introduces a reliable method for moderating outputs from large language models that are streaming. It addresses the challenge of moderation timing, where issues arise when text has already been streamed. The proposed guard mechanism uses a specific design that involves two lexical predicates to create danger signatures. Before releasing any output, the guard checks the accumulated text and stops the first segment that meets both predicates. In various tests with four signature types, eight chunk sizes, and 32 trials, the results matched those of a buffered scanner, effectively blocking all problematic chunks while allowing eight single-predicate controls. A separate comparison showed that full-prefix scanning identified all configured pairs, with a 512-character window detecting 96 out of 128, and chunk-local scanning found 38 out of 128. Importantly, no false positives were observed from 338 human-derived safe responses, making this approach a solid and cost-effective option for real-time content moderation in streaming LLM outputs.