Output Filtering — Don't Trust the Model's Words

~14 min · security, output-filtering

Level 0Apprentice

0 XP0/100 lessons0/14 achievements

0/120 XP to next level120 XP to go0% complete

Even when the prompt is right, the output can be wrong

The model can be successfully attacked, exhibit a rare failure, or simply produce content that violates your policies. Output filtering is the layer that catches what the prompt didn't.

Patterns to scan for

Sensitive data — emails, phone numbers, SSNs, credit cards, internal API endpoints.
Embedded resource URLs that could exfiltrate (image src, link href).
Markdown / HTML constructs the UI will render and the user will trust.
Profanity, hate speech, policy-restricted topics for your context.
Prompt-injection markers ("ignore previous instructions," tool-call syntax in unexpected places).

How to enforce

Regex / classifier on raw output before it reaches the user.
HTML/markdown sanitizer that strips dangerous constructs.
Second-pass LLM judge for high-risk content.
Block, redact, or alert depending on severity.

Code

Output sanitizer chain·python

def sanitize(text: str) -> tuple[str, list[str]]:
    flags = []
    text, flag = strip_credentials(text)
    flags += flag
    text, flag = strip_exfil_urls(text)
    flags += flag
    text, flag = sanitize_markdown(text)
    flags += flag
    return text, flags

out, flags = sanitize(model_text)
if "credential_leak" in flags:
    alert_security(out)
return out

External links

Exercise

Add an output filter that scans for one specific exfiltration vector (e.g., image src to an external host). Test against a known-good and a synthetic-bad output.

Progress

Progress is local-only — sign in to sync across devices.

← PreviousJailbreak Patterns — What They Look Like Next →Privilege Boundaries — What the Model Can and Can't Do

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.