Input Guardrails — References

The arithmetic that governs any detector running on all traffic, the specification behind canonicalising text before matching it, and the catalogues that enumerate what arrives.

Why operating points matter more than accuracy

• The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection — Stefan Axelsson, ACM Conference on Computer and Communications Security, 1999. The result that when the events you are looking for are rare, the limiting factor is the false alarm rate rather than the detection rate, which is the single most useful piece of arithmetic for anyone setting a threshold on production traffic. Cited by name.
• On Calibration of Modern Neural Networks — Chuan Guo, Geoff Pleiss, Yu Sun and Kilian Q. Weinberger, International Conference on Machine Learning, 2017. Evidence that a classifier's reported scores are not probabilities, which is why an operating point has to be derived from your own traffic rather than read off the score. Cited by name.
• Model Cards for Model Reporting — Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji and Timnit Gebru, Conference on Fairness, Accountability, and Transparency, 2019. The argument for declaring the conditions under which a model was evaluated, which is what a bought-in guard classifier usually does not tell you. Cited by name.

Text before matching

• Unicode Standard Annex #15, Unicode Normalization Forms — the specification of the canonical and compatibility forms, and the reason a decision made on unnormalised text is a decision about one encoding of the input rather than about the input. Cited by name.

Catalogues

• OWASP Top 10 for Large Language Model Applications — useful here for its enumeration of the paths by which content reaches a model, which is the checklist against which the scope of an admission check should be audited. Cited by name; the project has been renumbered between editions.
• OWASP Cheat Sheet Series — the input validation and canonicalisation sheets, whose central point, that validation must happen on the canonical form and at a single place, transfers unchanged to this setting.

No verified reference is recorded for latency budgets specific to pre-generation checks, for request-envelope reduction as an alternative to refusal, or for session-level signal accumulation in language-model products. These are engineering practices with no published measurement.