Output Guardrails — References

The framing of a model's output as untrusted input to whatever renders it, and the published treatment of checking both sides of a conversation with one component.

Output as untrusted input

• OWASP Top 10 for Large Language Model Applications — the entry covering handling of model output by downstream components, whose argument is that generated text reaching a browser, a shell, a query planner, or a template engine is indistinguishable from any other unvalidated input. Cited by name; the entry has been renamed between editions.
• OWASP Cheat Sheet Series — the cross-site scripting prevention and output encoding sheets, which are the operative guidance for the sanitisation stage, since the question of which encoding applies is decided by the context the text lands in.
• Content Security Policy Level 3 — the W3C specification governing which origins a rendered document may fetch from, and therefore the control that makes an image reference in generated markup inert regardless of what the text classifier concluded. Cited by name.

Checking generated text

• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations — Hakan Inan, Kartikeya Upasani, Jianfeng Chi and colleagues at Meta, 2023. The explicit argument for one classifier applied to both the prompt and the response, and for separating the taxonomy from the model that applies it. Cited by name.

No verified reference is recorded for retractable streaming windows, for measured rescue rates of informed regeneration, or for verdict propagation across egress channels. These are implementation practices that the published literature on safety classification does not address, because it assumes a complete response is available to score.