Output Filtering

Threats: Insecure Output Handling (LLM02), Sensitive Info Disclosure (LLM06), Excessive Agency (LLM08), Overreliance (LLM09)
Standards: NIST AI 600-1 MANAGE-2.2, OWASP LLM02/LLM06/LLM08/LLM09, EU AI Act Art. 13/Art. 15, ISO 42001 A.6.2/A.9.2, GDPR Art. 25

Filter Pipeline

Stage	Control	Mechanism	Standards
1. Encoding	Context-aware encoding	HTML-encode for web, SQL-escape for DB, shell-escape for CLI, no raw eval	OWASP LLM02, NIST AI RMF MANAGE-2.2
2. PII Redaction	Named-entity recognition	spaCy / Presidio / Microsoft Presidio on output stream; configurable entity types	GDPR Art. 25, NIST AI 600-1 §2.4
3. Groundedness	Citation verification	Require inline citations for factual claims; verify against retrieval corpus	NIST AI 600-1 MEASURE-2.1, OWASP LLM09
3. Groundedness	Consistency check	Self-consistency sampling (n=3) — require majority agreement on factual claims	NIST AI 600-1 MEASURE-2.1
4. Refusal Enforcement	Policy-aware refusal	Detect "I cannot" / "I'm unable" patterns; ensure consistent refusal style	NIST AI 600-1 MANAGE-2.2
5. Action Validation	Tool output validation	Schema-validate tool results before returning to user or feeding back to LLM	OWASP LLM02, LLM07
6. Rate/Volume	Output throttling	Max tokens/sec per session; prevent exfiltration via high-volume output	OWASP LLM04, NIST AI 600-1 MANAGE-4.1

PII Redaction Detail

Entity Type	Action	Tooling
PERSON, ORG, LOC	Redact / hash	Presidio, spaCy, AWS Comprehend
EMAIL, PHONE, IBAN, CREDIT_CARD	Mask (****)	Presidio, regex
SSN, TAX_ID, PASSPORT	Hash + audit log	Presidio, custom
API_KEY, SECRET, TOKEN	Redact + alert SIEM	Custom regex + entropy filter

Groundedness Checks

Method	Cost	Latency	Best For
Citation verification	Low	~10ms	RAG, factual QA
Self-consistency (n=3)	3× inference	3×	High-stakes factual claims
Entailment classifier	Medium	~50ms	Legal, medical, financial
Retrieval re-ranking	Low	~20ms	RAG pipelines

Refusal Consistency

Standardised refusal — single canonical phrasing (e.g., "I'm not able to help with that request.")
No partial compliance — reject entire request, not just the harmful part
No lecturing — avoid moralising; keep refusal neutral and brief
Audit trail — log every refusal with trigger category (injection, policy, uncertainty)

Citation Register

Control	Standard	Provision	URL
Output encoding	OWASP LLM Top 10	LLM02	https://owasp.org/www-project-top-10-for-large-language-model-applications/
PII redaction	GDPR	Art. 25 (Data protection by design)	https://eur-lex.europa.eu/eli/reg/2016/679/oj
Groundedness	NIST AI 600-1	MEASURE-2.1	https://doi.org/10.6028/NIST.AI.600-1
Transparency	EU AI Act	Art. 13	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Robustness	EU AI Act	Art. 15	https://eur-lex.europa.eu/eli/reg/2024/1689/oj
Output validation	ISO 42001	A.6.2, A.9.2	https://www.iso.org/standard/81230.html
Sensitive info	OWASP LLM Top 10	LLM06	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Excessive agency	OWASP LLM Top 10	LLM08	https://owasp.org/www-project-top-10-for-large-language-model-applications/
Overreliance	OWASP LLM Top 10	LLM09	https://owasp.org/www-project-top-10-for-large-language-model-applications/