Paper deep dive
Withholding the Completing Chunk: Deterministic Pair-Completion Guardrails for Streaming LLM Output
Christopher M. Frost
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/13/2026, 5:04:20 AM
Summary
The paper introduces a deterministic pair-completion guardrail for streaming LLM output, which withholds the first chunk that completes a conjunction of two lexical predicates. Evaluated in the Bee engine, the method ensures exact release-boundary enforcement for fixed policies, matching buffered scanner results while avoiding the latency and cost of repeated semantic classification. It serves as a narrow, deterministic backstop rather than a general semantic moderator.
Entities (8)
Relation Signals (8)
Pair-Completion Guardrail → implements → Deterministic Conjunction
confidence 95% · each committed danger signature is the conjunction of two lexical predicates
Bee Engine → implements → Pair-Completion Guardrail
confidence 95% · The evaluated guard is implemented in Bee—The Progressive Quantum-Native Intelligence Engine
Pair-Completion Guardrail → withholds → Completing Chunk
confidence 95% · withholds the first chunk that makes both predicates observable
HEOSSI → developed → Bee Engine
confidence 92% · Bee—The Progressive Quantum-Native Intelligence Engine developed by HEOSSI
Pair-Completion Guardrail → comparedagainst → Llama-Guard-3-1B
confidence 90% · A calibrated official Llama Guard 3 1B baseline classified 310/338 safe responses
Pair-Completion Guardrail → evaluatedon → Aegis2.0
confidence 88% · On 338 held-out AEGIS2.0 responses... the scanner produced zero flags
SentGuard → uses → Sentence-level Buffering
confidence 85% · SentGuard buffers sentence-sized units and releases verified chunks
StreamGuard → uses → Forecasted Harmfulness
confidence 85% · StreamGuard instead forecasts the expected harmfulness of likely continuations
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Streaming language-model output creates a release-timing problem: complete-response moderation acts after streamed text has escaped, whereas repeated semantic classification of partial text can be costly and unstable. We study a narrow deterministic construction in which each committed danger signature is the conjunction of two lexical predicates. The guard scans the accumulated prefix before every release and withholds the first chunk that makes both predicates observable. Across four signature families, eight chunk sizes, and 32 mechanism trials, streaming decisions matched the buffered scanner and withheld every pair-completing chunk; eight single-predicate controls passed. In a separate 512-trial strategy comparison, full-prefix scanning and complete buffering detected all configured pairs, a 512-character window detected 96/128, and chunk-local scanning detected 38/128. Fixed pairs flagged 0/338 human-derived safe responses and detected 0/394 jury-labelled unsafe responses, confirming narrow rather than general harm coverage. A calibrated official Llama Guard 3 1B baseline classified 310/338 safe responses as safe and 202/394 unsafe responses as unsafe. Repeated-prefix scanner time on 16,384-character responses ranged from 13.261 ms to 829.640 ms across tested chunk sizes. Pair completion is therefore an exact release-boundary backstop for a small fixed policy, not a substitute for semantic moderation.
Tags
Links
- Source: https://arxiv.org/abs/2608.10279v1
- Canonical: https://arxiv.org/abs/2608.10279v1
Trouble viewing inline? Open PDF directly →
Full Text
72,363 characters extracted from source content.
Expand or collapse full text
Withholding the Completing Chunk: Deterministic Pair-Completion Guardrails for Streaming LLM Output Christopher M. Frost HEOSSI (Pte.) Ltd., Singapore ORCID: 0009-0002-1027-1149· christopher@heossi.com Manuscript word count (abstract through data statement): 9,798 This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Abstract Moderating streamed language-model output creates a timing problem: scanning a complete answer acts too late for already-released text, while classifying every partial token sequence can lack the context needed for a stable decision. In Bee—The Progressive Quantum-Native Intelligence Engine developed by HEOSSI—we study a narrower deterministic construction in which each output-danger signature is the conjunction of two lexical predicates. Before releasing each chunk, the guard scans the accumulated prefix and withholds the first chunk that makes both predicates observable. In a bounded mechanism evaluation covering four committed signature families, eight character-level chunk sizes, and 32 trials, the streaming decision matched the buffered scanner and withheld the pair-completing chunk in every trial. Eight single-predicate controls passed without a block. In a separate 512-trial comparison of four release strategies, full-prefix scanning and complete buffering detected all 128 configured pairs assigned to each strategy, a 512-character rolling window detected 96/128, and chunk-local scanning detected 38/128. On 338 held-out AEGIS2.0 responses drawn from conversations assigned a safe majority label by human annotators, the scanner produced zero flags (Wilson 95% interval for conditional flag incidence: 0%–1.12%). As an external scope check, it detected none of 394 AEGIS2.0 responses labelled unsafe by the dataset’s LLM jury, confirming that the fixed pairs are not a substitute for broad semantic moderation. A separate screen of 13,114 unlabelled internal training answers produced four literal matches, all defensive cybersecurity discussions and thus contextual false positives on manual review. The reference implementation rescans the complete prefix and exhibits the expected quadratic cost: across 50 repetitions of a 16,384-character response, median scanner time ranged from 13.261 ms with 512-character chunks to 829.640 ms with eight-character chunks. A separately calibrated local FP16 conversion of the authorised official Llama Guard 3 1B weights classified 310/338 human-derived safe responses as safe and 202/394 jury-labelled unsafe responses as unsafe, illustrating the semantic breadth and statistical error of a complementary learned layer. The construction is exact only with respect to its fixed predicates; it does not estimate general harmful-output recall, infer intent, or prevent release of the first predicate before the second appears. Keywords: streaming safety; large language models; output moderation; deterministic guardrails; online enforcement; security assurance; auditability 1 Introduction Streaming interfaces improve perceived latency by releasing model output before generation finishes. They also remove the atomic decision point available to a buffered response moderator. Once a chunk has crossed 1 arXiv:2608.10279v1 [cs.CR] 10 Aug 2026 the client boundary, a later refusal cannot recall it. This difference is easy to overlook when a non-streaming API is converted into a streaming API. In a buffered path, generation, moderation, and delivery can be treated as three sequential phases. The application receives a complete candidate answer, applies its output policy, and either returns the answer or substitutes a refusal. A streaming path interleaves these phases. Generation and delivery proceed concurrently, so moderation becomes an online decision over a prefix rather than an offline decision over a finished object. The semantic question may be unchanged, but the enforcement semantics are not: the system must decide what may cross the boundary before it knows what the model will say next. At least four engineering responses are possible. A system can disable output moderation for streams, accepting a safety gap in exchange for minimum latency. It can buffer the complete response, preserving the offline policy while losing the user-visible benefit of streaming. It can invoke a broad semantic moderator on tokens or small chunks, paying repeated inference cost and risking unstable decisions on incomplete language. Finally, it can exploit structure already present in a deterministic policy. This paper studies the fourth option for the special case where a policy declares a danger family only when two observable signals co-occur. The contribution is intentionally modest. We do not propose a new universal taxonomy, a learned safety model, or a benchmark claiming representative harm coverage. Instead, we isolate one release-boundary property that can be stated and tested exactly. If a fixed policy requires both predicates of a pair, and the accumulated prefix is scanned before every release, then the chunk that first completes that pair can be withheld. The result follows from ordering and shared policy state rather than from a model’s confidence score. This makes the mechanism useful as a backstop even when a semantic guard is also present. The distinction between mechanism correctness and policy adequacy motivates our evaluation design. A mechanism can implement every committed pair perfectly while the pairs themselves cover only a small fraction of harmful language. It can also produce contextually inappropriate blocks even when every regex match is literal. Combining those dimensions into a single headline accuracy score would obscure more than it reveals. We therefore report bounded pair-family coverage, labelled safe-response false positives, unlabelled corpus flag incidence, pre-block fixture residue, and scanner cost separately. Recent work approaches the problem with learned streaming classifiers. SentGuard buffers sentence- sized units and releases verified chunks, while also introducing StreamSafe, a sentence-annotated safety benchmark [1]. StreamGuard instead forecasts the expected harmfulness of likely continuations from a partial prefix [2]. These systems target broad semantic safety coverage. Our question is deliberately narrower: when an existing production policy already defines danger as the conjunction of fixed signals, what can be guaranteed about the release boundary without forecasting? We make four contributions: 1. We state a deterministic pair-completion property: the first chunk that completes a committed predicate pair is withheld before release. 2. We provide a reference implementation in Bee and a bounded reproducible evaluation that separates this mechanism property from general safety recall. 3. We compare four release strategies across predicate order, separation, and chunk size, exposing the correctness cost of bounded or chunk-local context. 4. We measure both contextual failure and computational cost, showing that lexical conjunction does not infer intent and that naive prefix rescanning is impractical for sufficiently fine-grained long streams. 2 The practical conclusion is similarly narrow. Pair-completion scanning is a simple way to restore parity between buffered and streamed enforcement for a fixed lexical policy, provided that the application can tolerate moderation chunks large enough to control repeated-scan cost. It is not a reason to replace semantic moderation, authorization checks, red-team testing, or careful stream integration. 2 Background and related work 2.1 Input and output moderation Safety enforcement around language models occurs at several layers. Training and alignment attempt to shape the model’s default behaviour; prompt moderation classifies or transforms requests before generation; decoding-time methods intervene during token selection; and output moderation evaluates what the model produced. These layers answer different questions. A prompt classifier estimates whether the request is allowed. An output classifier estimates whether the answer is allowed, including cases where a benign prompt elicits an unsafe answer or an unsafe prompt receives a safe refusal. A production system often needs both because prompt intent and response content are correlated but not equivalent. Llama Guard framed input and output safeguarding as instruction-tuned classification under a config- urable risk taxonomy [4]. WildGuard broadened the moderation task to cover prompt harmfulness, response harmfulness, and refusal detection, and introduced WildGuardMix to support those tasks [5]. AEGIS2.0 combined a more detailed risk taxonomy with dialogue-level human annotations and a multi-model jury, explicitly targeting data usable in commercial guardrail development [3]. Its response labels have hybrid provenance: a safe conversation-level human majority vote is carried through to the response, whereas responses in unsafe conversations receive a separate multi-model-jury label [3]. These systems illustrate the benefits of semantic classification: they can reason about paraphrase and context in ways a lexical matcher cannot. They also introduce model inference cost, threshold calibration, taxonomy dependence, and ordinary statistical error. Our mechanism does not compete with those classifiers on broad coverage. It assumes that a deployment already has a small deterministic output policy whose rules are valuable precisely because they are cheap, inspectable, and stable. The research question is how to preserve the enforcement meaning of that policy when output is delivered incrementally. A semantic moderator can run alongside the pair guard, at a slower cadence, or at sentence boundaries. The two controls have different failure modes and can therefore be complementary. 2.2 Streaming moderation Streaming makes the timing of a moderation decision part of the safety design. SentGuard groups generated tokens into sentence-level chunks and releases only chunks that have been verified [1]. The sentence boundary supplies more context than a token while preserving a streaming experience, and StreamSafe provides per-sentence annotations for evaluating when risk emerges. StreamGuard treats the partial prefix as a forecasting problem: rather than waiting until a prefix is already unsafe, it estimates the expected harmfulness of likely future continuations using rollout supervision [2]. These approaches seek useful early decisions under semantic uncertainty. Pair completion occupies a different point in the design space. It makes no forecast about an unseen continuation. Until both predicates are visible, the specific fixed rule is false; once both are visible, that rule is true. The guard therefore acts on an observed state transition. This sacrifices semantic breadth for an exact relationship between the policy’s Boolean definition and the release decision. A learned streaming guard may stop a harmful response before any lexical pair appears, while the deterministic guard may catch a committed pair with no classifier invocation and no threshold variance. 3 Sentence buffering and pair completion can also be combined. A system can accumulate tokens into moderation chunks, run deterministic predicates on every chunk, and invoke a semantic guard at sentence boundaries or on a slower schedule. Increasing chunk size reduces repeated-scan overhead but increases the amount of not-yet-moderated text retained before a release decision. The choice is therefore not merely an optimisation parameter; it defines a latency, cost, and intervention-granularity trade-off. The approaches are therefore better understood as layers with different decision semantics than as interchangeable implementations: Table 1: Comparison of guardrail approaches and their streaming semantics. ApproachDecision basisStreaming actionPrincipal role and limitation Llama Guard, WildGuard, AEGIS-trained guards Learned semantic classification under a safety taxonomy Classify prompts or responses at selected checkpoints Broad semantic coverage; incurs inference, calibration, and statistical error SentGuardLearned sentence-level safety classification Buffer and verify complete sentences before release Context-rich streaming layer; adds sentence-level delay and repeated inference StreamGuardForecasted harmfulness of likely continuations Intervene before observed harm when expected future risk is high Earlier semantic intervention; depends on learned forecasts and rollout assumptions Pair completion (this work) Exact conjunction of fixed lexical predicates Scan each accumulated prefix and withhold the completing chunk Deterministic, threshold-free backstop; narrow coverage and contextual false positives A practical deployment can place semantic moderation at prompt, sentence, or response boundaries and retain pair completion as a low-variance enforcement backstop for a small set of committed signatures. The negative 0/394 unsafe scope check reported below reinforces this layered interpretation. Programmable-rail systems such as NeMo Guardrails likewise separate runtime controls from model training and emphasise interpretable application-level constraints [8]. Systematic guardrail design has consequently been framed as a socio-technical problem involving requirements, implementation, verification, and testing rather than the selection of one classifier [9]. Recent empirical work also shows that learned guard models remain vulnerable to mutations and adversarial attacks [10] [11]. These findings support a layered evaluation: the deterministic mechanism should be tested for exact conformance, while semantic guards should be evaluated statistically for coverage, calibration, and robustness. Large-scale benchmark work reinforces the need to separate datasets, risk taxonomies, model families, and operating points when comparing learned guards [13]. Model-specific approaches such as LS-Guard further challenge the assumption that one static guard transfers uniformly across target models [14]. Accordingly, the semantic comparison in Section 6 is a calibrated same-corpus baseline, not a claim that one aggregate score establishes universal safety. 4 2.3 Over-refusal and contextual false positives A safety mechanism is useful only if it preserves enough benign utility. XSTest demonstrated exaggerated safety behaviour using safe prompts that contain surface forms or topics associated with unsafe requests [6]. The test suite captures a recurring failure pattern: a system may react to a sensitive word or topic while ignoring the benign context in which it appears. Learned classifiers and lexical policies can both suffer from this problem, though for different reasons. Pairing signals is one pragmatic attempt to reduce single-keyword false positives. Requiring two independently chosen indicators is stricter than blocking on either indicator. However, conjunction does not equal contextual understanding. A defensive security explanation may legitimately discuss two indicators together because their co-occurrence is exactly what makes them useful for detection. Our internal stress screen contains four such examples. This observation is not an implementation bug: it is evidence that literal predicate truth and policy intent are distinct variables. The human-derived AEGIS safe-response subset and the contextual stress screen serve different purposes. The AEGIS subset estimates flag incidence conditional on selecting responses from conversations assigned a safe human majority label; it is not an independently response-level annotated sample. The internal screen intentionally includes specialist material and reveals domain-specific collisions that a general safe corpus may miss. We retain both instead of selecting the cleaner result. 2.4 Deterministic matching and online enforcement Streaming lexical enforcement is also related to classical online pattern matching. Multi-pattern algorithms such as Aho–Corasick can update matching state incrementally as characters arrive, avoiding a full rescan of every prefix [7]. Regular-expression engines can likewise preserve state or operate on bounded overlap windows when patterns have known maximum width. The reference implementation evaluated here does neither. It deliberately uses the simplest correct integration: append the chunk, run the existing buffered scanner, and release only after the scanner returns. That choice has two advantages for an initial production repair. First, the buffered and streaming paths share the same policy function, reducing semantic drift. Second, the proof obligation is small enough to test directly. Its cost is quadratic prefix work for constant-size chunks, which our measurements make visible. Incremental automata are therefore a clear engineering improvement, but they introduce a second implementation of matching semantics and require new equivalence tests. We treat them as future work rather than assuming that an optimisation preserves the current policy automatically. Regex implementation choice is itself security-relevant. Even nonbacktracking matchers can exhibit denial-of-service behaviour for some extended constructs, so incrementalisation does not remove the need for pattern-complexity review, input bounds, and adversarial performance tests [12]. 3 Design and construction 3.1 Design objectives The evaluated guard is implemented in Bee—The Progressive Quantum-Native Intelligence Engine devel- oped by HEOSSI and the host solution for this work. The study was executed through Bee’s version-controlled research and evidence pipeline: the Bee repository supplies the reference streaming integration, shared policy boundary, evaluation harness, verification gates, evidence records, figures, manuscript builds, and multi- model development corpus used by this study. The guard was designed under five constraints that commonly arise when a buffered service acquires a streaming endpoint. 5 First, the streaming path should preserve the buffered policy’s decision semantics. Duplicating or rewriting the detector inside the stream integration would create two sources of truth and make future rule changes risky. Second, the completing chunk must be gated before delivery. Scanning after a callback, socket write, or server-sent-event emission provides observability but not enforcement. Third, a caller that forgets to inspect auxiliary state should still receive no completing fragment; the primary return value must therefore be empty after a block. Fourth, the guard should expose enough terminal state for audit and incident analysis, including the generated prefix, released prefix, matched family, and canonical refusal. Fifth, the mechanism should be testable without a model, accelerator, network service, or heavyweight machine-learning runtime. These objectives favour a small stateful adapter around the existing scanner. They do not minimise asymptotic work. In this study, semantic parity and a clear release boundary take priority over optimisation, allowing the performance cost to be measured before a more complicated matcher is introduced. 3.2 Formal model Let a response arrive as chunks 푥 1 ,...,푥 푘 , and let 푃 푖 = 푥 1 ∥·∥ 푥 푖 be the prefix after receiving chunk 푖. A danger family 푗 is represented by predicates(퐴 푗 , 퐵 푗 ). Before releasing푥 푖 , the guard evaluates the committed pairs over 푃 푖 . It releases 푥 푖 only when no conjunction 퐴 푗 (푃 푖 )∧ 퐵 푗 (푃 푖 ) is true. Let 푡 be the first index for which a pair is complete. Because the decision on 푃 푡 occurs before 푥 푡 is released, 푥 푡 is withheld. This guarantee assumes that every chunk traverses the guard in order, the caller respects the guard’s release value, and the buffered and streaming paths share the same versioned predicate corpus. The construction does not claim that 푃 푡−1 is harmless in a semantic sense. It claims only that 푃 푡−1 does not satisfy a committed pair. This distinction is central: exactness is relative to the policy representation, not to the open world of harmful language. Let the buffered detector be a function 퐷(푃) returning either none or the first matched family according to a fixed rule order. Let the stream guard state after processing chunk 푖 be (푃 푖 , 푅 푖 , 퐿 푖 , 푍 푖 ), where 푃 푖 is all model text observed, 푅 푖 is text released to the client, 퐿 푖 is the matched label or none, and 푍 푖 is a Boolean blocked state. Initially all strings are empty, 퐿 0 = none, and 푍 0 = false. For a non-empty chunk 푥 푖 , the transition first constructs 푃 푖 = 푃 푖−1 ∥ 푥 푖 and evaluates 퐷(푃 푖 ). If the result is none, then 푅 푖 = 푅 푖−1 ∥ 푥 푖 and the returned release is 푥 푖 . If the result is label 푙, then 푅 푖 = 푅 푖−1 , 퐿 푖 = 푙, 푍 푖 = true, and the returned release is the empty string. All later calls remain blocked and return the empty string. Empty chunks are identity transitions. 3.3 Properties Proposition 1: completing-chunk non-release. Assume that the caller emits only the string returned by the guard, and let 푡 be the first chunk index for which 퐷(푃 푡 ) is non-empty. Then no character of 푥 푡 is released by the guard. This follows immediately from the transition order: 푃 푡 is scanned before the return value is chosen, and a non-empty label selects the empty release branch. Proposition 2: buffered/streaming terminal-label parity. If the streaming guard and buffered path call the same deterministic function 퐷 with the same domain and authorization parameters, then the stream’s first non-empty label is equal to 퐷(푃 푡 ) at its trip prefix. This proposition establishes parity at the observed trip prefix; it does not claim parity with a hypothetical continuation generated after the stream has terminated. On the bounded fixtures, which contain exactly one configured family, the final streaming label also equals the buffered label computed over the complete fixture. Proposition 3: released-prefix invariant. Before blocking, 푅 푖 = 푃 푖 . After blocking at 푡, 푅 푖 = 푃 푡−1 for every 푖 ≥ 푡. Thus the released text is always a prefix of generated text and never includes the completing 6 chunk. This invariant supports audit: the system can distinguish what the model generated from what the client received without reconstructing stream events. These propositions do not imply semantic safety. In particular, Proposition 1 does not say that 푃 푡−1 is non-actionable, only that the chosen Boolean rule was incomplete. They also depend on integration assumptions. If a framework emits x_i before calling the guard, ignores the return value, or exposes a parallel unguarded channel, the properties do not hold at the system boundary. 3.4 Rule ordering and simultaneous completion More than one pair can become true on the same prefix. The existing buffered scanner resolves that case by fixed rule order, and the streaming adapter inherits the same order by calling the same function. This makes labels stable but embeds policy priority in list order. A production governance process should treat reordering as a policy change, not as a harmless refactor, because it can alter audit labels and regulatory mappings even when the block decision remains the same. Signals can also appear in either temporal order. A pair(퐴, 퐵) is a logical conjunction, not a prescribed sequence. If 퐵 appears in an early chunk and 퐴 appears later, the later chunk still completes the pair and is withheld. Scanning the full prefix naturally handles both orders and arbitrary boundary splits, including a single lexical token divided across chunks. An incremental replacement must preserve those cases explicitly. Figure 1 summarises the release sequence. The first predicate can cross the boundary because the configured pair is not yet complete. The later chunk that introduces the second predicate is scanned first and withheld. Streaming decision sequence Each chunk is scanned before it crosses the client boundary. Chunk 1 No signal RELEASE Chunk 2 Predicate A RELEASE Chunk 3 More context RELEASE Chunk 4 Predicate B WITHHOLD Pair first becomes true at chunk 4 GuardClient Released prefix contains chunks 1-3; the completing chunk never crosses the boundary. Figure 1: Pair-completion release sequence. Chunks one through three are released; the fourth chunk completes the configured pair and is withheld before reaching the client. 4 Threat model and security analysis The protected boundary lies between a model runtime and an untrusted client. The adversary may know the guard’s design, choose prompts, and influence model output. The adversary may not bypass the guarded transport path, reorder chunks, or modify the scanner at runtime. 7 The following are out of scope: • semantic paraphrases and encodings not matched by the predicates; • harms outside the four evaluated families; • attacks exploiting an unguarded output path; • dangerous meaning expressible by only one predicate; • a guarantee that all text released before the block is non-actionable. An informed adversary can intentionally avoid fixed lexical signatures. The mechanism should therefore be treated as a deterministic backstop inside a layered system, not as a substitute for semantic moderation or authorization controls. 4.1 Assets and trust boundaries The primary asset is control over which generated bytes become observable to the client. Secondary assets are policy consistency, audit fidelity, and availability. The model runtime is not trusted to produce safe content. The client is not trusted to discard partial output or honour a later retraction. The guard process, its policy corpus, and the code connecting its return value to the transport are trusted. Logs and research captures are outside the live release path but must still be governed because they may contain generated material that was withheld from the client. The threat model distinguishes model-mediated adversaries from infrastructure adversaries. A model- mediated adversary influences the text but cannot modify the service. The pair guard provides a narrow guarantee against this actor when the output literally completes a configured pair. An infrastructure adversary who can disable the guard, change rule files, or write directly to the socket is outside the mechanism’s protection and requires ordinary software supply-chain, access-control, and deployment safeguards. 4.2 Evasion classes Fixed lexical policies expose several known evasion classes. A model can choose synonyms, paraphrase an operation, insert separators or Unicode variants, encode content, construct strings at runtime, or distribute related information across representations. It can also provide conceptual guidance that is useful without ever emitting the API or phrase fragments selected by a rule author. Pair completion does not make these attacks harder by itself; it only changes when an exact configured match is stopped. An attacker may also exploit the difference between text generation and tool execution. If dangerous behaviour is expressed as structured arguments, binary attachments, images, or side-channel metadata, a text-only guard will not see the relevant representation. A complete deployment must place controls at each egress path and apply representation-appropriate validation. 4.3 Residue and composability The pre-block residue deserves special attention because streamed bytes cannot be recalled. Requiring a pair is motivated by the judgment that either signal alone is insufficient to trigger the fixed rule. That policy judgment is not a proof that the released signal is harmless. The residue can include arbitrary earlier prose and may help an attacker combine information across requests, models, or external sources. The correct statement is therefore mechanical: the completing chunk is withheld. Descriptions such as "the dangerous content never reaches the user" would be too strong. 8 Cross-request composition is outside the current state model. Each response starts with a fresh accumu- lator, so one predicate in response r and the other in response r+1 will not complete a pair. Maintaining conversational matching state could address that case, but would raise retention, privacy, explainability, and false-positive questions. We leave cross-response enforcement to future work. 4.4 Availability and denial of service The naive full-prefix scan creates an availability concern. An attacker who can induce very long outputs with very small flush chunks can maximise repeated work, even when the text never matches. Output token limits, minimum moderation chunk sizes, time budgets, and incremental matching are therefore security controls as well as performance optimisations. The latency experiment quantifies this sensitivity but does not benchmark concurrent load or adversarial regular-expression backtracking. Rule authors should separately review regex complexity and cap input length. 5 Reference implementation 5.1 State and API The reference guard is a small state object with configuration fields for domain and authorization context, public audit fields for accumulated and released text, a matched label, a canonical refusal, and a private tripped flag. Its feed(chunk) method is the enforcement boundary. Calls after a trip return an empty string, making the blocked state sticky. A finish() method performs a terminal scan for callers with unusual buffering paths, while a wrapper-reason method maps the matched family into the same audit vocabulary used by the buffered service. The generated and released strings deliberately diverge at the block point. Keeping both costs memory proportional to response length but prevents a common audit ambiguity. Recording only generated text cannot establish what the client saw; recording only released text loses the withheld evidence needed to explain the decision. Production retention rules may require hashing, redaction, access control, or deletion rather than durable storage of either field. 5.2 Shared scanner semantics The guard imports the canonical buffered scan functions instead of copying the pattern corpus. The labelled scan identifies the family; the unlabelled scan returns the canonical refusal. This avoids three forms of drift: a rule appearing in one path but not the other, different rule priority, and different refusal text. It also makes the streaming module dependent on the scanner’s purity and performance. A future learned or remote scanner would change the cost and failure model substantially. Domain and authorization parameters are passed through unchanged. Some policies permit specialist material in a governed research mode while blocking it in a general mode. Omitting those parameters in the stream wrapper would create a false parity: both paths might call functions with the same name but under different policy contexts. Tests therefore cover the contextual bypass as well as ordinary blocking. 5.3 Integration contract A correct caller follows a strict order: obtain a model chunk, call feed, inspect the blocked state, and emit only the returned release. If blocked, it emits the canonical refusal or terminates according to product policy. The caller must not optimistically write the raw model chunk and then consult the guard. This ordering 9 should be visible in code review and integration tests because an otherwise correct guard cannot repair an emit-before-scan caller. Backpressure and asynchronous scheduling add another risk. If multiple chunks are processed con- currently, a later safe-looking chunk must not be released while an earlier chunk is still awaiting a scan. The evaluated implementation assumes serial ordered calls. Parallel moderation would require sequence numbers, commit ordering, and cancellation semantics beyond this paper. 5.4 Complexity Let the final response length be 푛, the chunk size be 푐, and the number of chunks be approximately 푘= 푛/푐. If scanning a prefix is linear in its length, the total work is proportional to 푐+ 2푐+·+ 푘푐, or 푐푘(푘+ 1)/2. Substituting 푘= 푛/푐 yields 푂(푛 2 /푐), equivalently 푂(푛푘). For fixed 푐, this is quadratic in 푛; for a single chunk, it collapses to one linear scan. Space use is linear in generated output because the reference state retains the accumulated string and released string. In languages with immutable strings, repeated concatenation may add copying cost beyond regex scanning. The benchmark measures the implementation as deployed rather than separating these components. An optimised version could use a builder, retain only the matcher state and an audit buffer, or stream audit records to protected storage. 6 Evaluation 6.1 Research questions The evaluation is organised around eight questions whose answers have different interpretations. • RQ1: Boundary correctness. Does the guard detect every committed pair fixture across deliberately varied chunk boundaries? • RQ2: Path parity. Does streaming produce the same family label as the buffered detector on those fixtures? • RQ3: Non-release. Is the chunk that completes a pair actually withheld, rather than merely logged after release? • RQ4: Benign utility. How often does the fixed scanner flag responses drawn from conversations assigned a safe majority label by human annotators, and what uncertainty remains at the observed sample size? • RQ5: External scope. How often does the fixed scanner detect responses labelled unsafe in an external dataset, without treating jury labels as independent human ground truth? • RQ6: Operational cost. How do scanner time and concurrent throughput change with final response length, chunk granularity, and stream count? • RQ7: Strategy trade-offs. How do cumulative, bounded-window, chunk-local, and complete-buffer strategies differ in configured-pair detection and released residue as predicate order, separation, and chunk size change? 10 • RQ8: Semantic complementarity. How does a separately calibrated learned output guard behave on the same safe and unsafe AEGIS subsets, without treating its statistical decisions as the same mechanism as pair completion? We intentionally do not ask for a general harmful-output recall value. The four pair families were not sampled from a target harm distribution, and the synthetic fixtures were constructed from the rules themselves. Reporting their detection rate as if it were an external safety benchmark would create a circular and misleading metric. RQ1–RQ3 are conformance questions: they test whether the implementation does what the fixed policy says. 6.2 Mechanism matrix We crossed four committed pair families with chunk sizes of 1, 2, 4, 8, 16, 32, 64, and 256 characters. For each of the resulting 32 trials, we checked the final label against the buffered scanner and verified that the chunk completing the pair returned an empty release. We also evaluated eight controls containing only one member of a pair. All 32 pair trials were detected, all 32 labels matched the buffered scanner, and all 32 completing chunks were withheld. All eight single-predicate controls passed. The median number of fixture characters released before a block was 48, with a maximum of 73. These compact fixtures do not establish a general leakage bound. Each fixture contains both predicates of one committed family. Chunking is performed at the character level rather than on model tokens so the experiment can force boundaries inside words and matched fragments without depending on a particular tokenizer. The eight chunk sizes range from one character, a severe fragmentation case, to 256 characters, which usually produces one chunk for the short fixtures. The guard stops feeding a fixture once it blocks, matching a production caller that terminates generation or switches to a refusal. The single-predicate controls exercise the policy’s stated motivation for using pairs. Each control contains one recognisable indicator in a benign sentence but not its partner. Both buffered and streaming scanners must return no label. The controls are conformance fixtures, not a representative benign dataset, so their 8/8 result is reported separately from AEGIS. For every pair trial the harness records expected and observed labels, chunk size, chunks consumed before the block, whether the completing chunk was withheld, characters generated through the block, and characters released before it. The complete matrix is preserved in JSON rather than compressed into the aggregate table. This supports later regression analysis if a rule or stream integration changes. 6.3 Streaming-strategy comparison We compared four release strategies without changing the production guard. The cumulative strategy scans the full generated prefix before each release and is the reference mechanism studied in this paper. A bounded strategy scans the current chunk together with at most 512 preceding characters. A chunk-local strategy scans only the current chunk. A complete-buffer strategy withholds the entire answer and scans once after generation. The deterministic matrix crosses four configured pair families with both predicate orders, separations of 0, 64, 256, and 1,024 neutral characters, and moderation chunks of 8, 32, 128, and 512 characters. This produces 128 trials per strategy and 512 trials overall. Every fixture contains exactly one complete configured pair. The matrix measures conformance to those configured pairs; it does not estimate harmful-output recall. The full-prefix and complete-buffer strategies detect every configured pair, but they make opposite delivery choices. Complete buffering provides no incremental release. Full-prefix scanning preserves 11 Table 2: Release-strategy conformance across 128 configured-pair trials per strategy. StrategyCorrect detections Detection rate Mean released chars Maximum released chars Cumulative full prefix128/128100.00%337.01,096 512-character rolling window96/12875.00%350.21,136 Chunk local38/12829.69%366.81,136 Complete buffer128/128100.00%0.00 streaming but repeatedly processes old text. The bounded window misses pairs separated by more context than it retains, while the chunk-local strategy also misses pairs fragmented across chunk boundaries. These outcomes are consequences of state retention, not classifier accuracy. Streaming release-strategy trade-offs Constructed conformance matrix: 128 trials per strategy; not harmful-output recall. 0% 25% 50% 75% 100% 100.0% Full prefix 128/128 75.0% 512-char window 96/128 29.7% Chunk only 38/128 100.0% Complete buffer 128/128 Release semantics Full prefix exact; quadratic 512-char bounded; misses long gaps Chunk only misses split evidence Complete exact; no streaming Correct detection of the configured pair in each constructed trial Figure 2: Configured-pair detection across four release strategies. Full-prefix scanning and complete buffering retain all required evidence; bounded and chunk-local strategies trade evidence retention for bounded work or minimal state. 6.4 Human-derived safe-response subset We used the held-out AEGIS2.0 test split [3], distributed under C BY 4.0. We pinned dataset revision cd 1abe041ba6f595fea47a67f650bcc0a809ea81 and retained the 338 non-empty responses for which the prompt label and response label were safe and the response-label source was human. The derived corpus SHA-256 is db0821a93c86cd7a73b6f7137c0e3bc77be2733b5816759f10d98c0d5f442ed2. AEGIS annotators labelled complete dialogues rather than prompts and responses independently. Each instance received at least three annotations from a team of 12 annotators, and AEGIS reports approximately 74% inter-annotator agreement [3]. When the conversation-level human majority vote was safe, AEGIS carried that label through to the response. The 338 records are therefore a human-derived safe-response subset, not 338 independently response-annotated items. The scanner flagged 0/338 responses, giving an observed conditional flag incidence of 0%. The two- sided Wilson 95% interval is 0%–1.12%; zero observed flags should not be interpreted as proof that the population incidence is zero. 12 The source Parquet file is pinned by full revision and SHA-256 rather than downloaded from a moving branch. A preparation script verifies the source hash and expected 1,964 test rows, then selects non- empty records satisfying three conditions: prompt label safe, response label safe, and response-label source human. The derived JSONL contains record identifiers, source row indexes, responses, and label provenance. Its deterministic encoder sorts keys and emits one record per line, producing the recorded derived hash. This selection rule is conservative about label provenance. AEGIS includes response labels inherited from safe conversation-level human votes and labels assigned by a multi-model jury for responses in unsafe conversations [3]. We exclude jury-labelled safe responses from the primary calculation, even though they would enlarge the sample, because the research question asks how the scanner behaves on the human-derived branch. The result should still not be generalised to all benign model output: AEGIS has its own sampling process, taxonomy, language distribution, model sources, and annotation disagreement. For zero observed flags, the naive sample proportion alone hides uncertainty. We therefore report a two-sided Wilson score interval. With x = 0, n = 338, and the standard 95% normal quantile, the interval has lower bound zero and upper bound 1.12%. This is more informative than writing "100% specificity" without a confidence interval. It indicates that the experiment is consistent with a small non-zero conditional population flag incidence and motivates a larger, independently response-annotated multi-domain safe corpus in future work. 6.5 Contextual stress screen We additionally scanned 13,114 synthetic or distilled training answers from Bee’s Class 1 model-development corpus. The records were produced through Bee’s distillation pipeline for model training rather than safety evaluation. This corpus is not independently labelled benign and is not used to estimate a false-positive rate. Four answers were flagged (0.0305%), all within 987 cybersecurity records. The author reviewed each complete prompt and response using a predeclared three-question rubric: whether both lexical signals were literally present, whether the response supplied an operational attack, and whether the apparent purpose was defensive, analytical, or harmful. The review found defensive malware triage, detection rules, and threat-framework mapping that mentioned both lexical signals. These are true pair matches but contextual false positives. The screen demonstrates that conjunction reduces some incidental matches without solving intent classification. Because the author performed this contextual review, it is not an independent annotation study and no inter-rater agreement is claimed. The item-level record retains identifiers, literal labels, contextual dispositions, and the rubric so that an independent reviewer can reproduce or challenge each disposition before peer-reviewed submission. The 13,114-answer screen predates the external evaluation and covers 16 domains, including accounting, natural sciences, business, programming, infrastructure, quantum, and cybersecurity. The benchmark hashes file names, record identifiers, and response content in deterministic order. No prompt or response is sent to a remote service. Because the corpus was produced for training rather than safety evaluation, its class designation indicates production maturity and must not be misread as a harmlessness annotation. All four flags occur in the cybersecurity subset, yielding 4/987 flag incidence within that domain and 0/12,127 outside it. Contextual review examines the source prompts and complete answers locally. One answer explains suspicious imports during executable triage, two discuss writing detection rules, and one maps an observed behaviour sequence into a threat framework. The literal detector is working exactly as written: both indicators appear. The conversational policy judgment is nevertheless wrong because the material is defensive analysis. This result exposes an important evaluation trap. If we had screened only the 12,127 non-cybersecurity records, we could report zero incidental flags on a much larger corpus. Such a result would be true but less 13 informative. Specialist benign domains are precisely where lexical safety rules face hard negatives. Retaining the cybersecurity records provides evidence against an overly strong claim and identifies a concrete design requirement for future context-aware gating. Figure 3 keeps the two corpus questions visually separate. Panel A reports a labelled false-positive estimate and its uncertainty. Panel B reports only unlabelled flag incidence, preserving the distinction between literal matching and contextual policy judgment. Benign utility and contextual stress screen A Human-derived AEGIS safe responses Conditional flag incidence with Wilson 95% interval 0.0%0.5%1.0%1.5% 0/338 observedupper 1.1238% B Unlabelled internal corpus Flag incidence; not a false-positive estimate All records 0.0305% (4/13,114) Cybersecurity 0.4053% (4/987) Other domains 0.0000% (0/12,127) These panels answer different questions and must not be merged into one score. Figure 3: Corpus outcomes. The AEGIS panel shows zero observed flags and the Wilson upper bound on the selected human-derived safe subset; the internal panel reports unlabelled flag incidence. 6.6 External unsafe-response scope check The pinned AEGIS2.0 test split also contains 394 non-empty responses for which both prompt and response are labelled unsafe and the response-label source is llm_jury. It contains no corresponding human-labelled unsafe-response subset, so this analysis is an external scope check rather than an independent estimate of harmful-output recall. The derived corpus SHA-256 is 49e96b7baab092de79ea6cf78b193056daea1c 695229d39449c9e95b4bf909. The fixed-pair scanner detected 0/394 responses (observed detection rate 0%; two-sided Wilson 95% interval 0%–0.97%). This negative result is consistent with the design: four implementation-specific lexical conjunctions cover only a small region of the broad AEGIS taxonomy. It rules out interpreting the 32/32 conformance matrix or the safe-response result as evidence that the scanner is a standalone general moderator. 6.7 Calibrated semantic-guard comparison We evaluated the authorised official meta-llama/Llama-Guard-3-1B weights as a complementary learned output guard [15]. The source was pinned at revision acf7aafa60f0410f8f42b1fa35e077d705892029 and converted locally to MLX FP16 without quantisation. The harness records the official and converted weight SHA-256 hashes and sends no corpus text over a network. Before evaluation, the model passed four predeclared calibration cases: two ordinary safe exchanges, a safe refusal of a harmful request, and an unsafe compliant response. 14 The comparison uses the same 338 human-derived safe responses and 394 jury-labelled unsafe responses as the deterministic scope checks. The semantic guard classified 310/338 safe-subset responses as safe and flagged 28/338 (8.28%; Wilson 95% interval 5.79%–11.71%) [16]. It classified 202/394 unsafe-subset responses as unsafe (51.27%; Wilson 95% interval 46.35%–56.17%). It emitted no invalid decisions. Median per-record inference time was 142.851 ms on the safe subset and 154.240 ms on the unsafe subset; corresponding 95th percentiles were 166.096 and 176.064 ms. Table 3: Deterministic and semantic guard results on the held-out AEGIS2.0 subsets. Guard and subsetResultWilson 95% intervalMedian latency Fixed pairs, human-derived safe 338/338 retained (100.00%) 0%–1.12% flag incidence Scanner cost reported below Llama Guard 3 1B, human-derived safe 310/338 retained (91.72%) 5.79%–11.71% flag incidence 142.851 ms Fixed pairs, jury-labelled unsafe 0/394 detected (0.00%) 0%–0.97% detectionScanner cost reported below Llama Guard 3 1B, jury-labelled unsafe 202/394 detected (51.27%) 46.35%–56.17% detection 154.240 ms The two label branches have different provenance, so their combined confusion matrix is not an inde- pendently human-labelled benchmark and is not promoted as a universal accuracy score. The experiment instead answers RQ8: the learned guard covers substantially more of the broad unsafe subset than four fixed pairs, but it also produces statistical errors on the selected safe branch. The deterministic guard has the opposite profile: exact conformance and no observed general-corpus flags, but no broad unsafe coverage. They are complementary controls rather than interchangeable classifiers. 6.8 Scanner latency The reference implementation scans the full accumulated prefix on every chunk. For fixed-size chunks, the total scanned text is quadratic in final response length. We timed 50 warmed repetitions on Python 3.14.2 and macOS 26.6 arm64 on an Apple M4 Max MacBook Pro with 14 cores and 36 GB memory. Table 4: Repeated-prefix scanner latency compared with one buffered scan. Response chars Chunk chars Chunks Stream median Stream p95 Buffered once Stream/buffered 8,1928 1,024208.286 ms 214.308 ms0.391 ms532.7x 8,1923225652.305 ms 53.825 ms0.395 ms132.4x 8,1921286413.182 ms 13.525 ms0.396 ms33.3x 8,192512163.424 ms3.520 ms0.400 ms8.6x 16,3848 2,048829.640 ms 850.374 ms0.796 ms1,042.3x 16,38432512207.175 ms 209.106 ms0.794 ms260.9x 16,38412812852.157 ms 54.012 ms0.780 ms66.9x 16,3845123213.261 ms 13.419 ms0.778 ms17.0x Figure 4 shows the same latency measurements on a logarithmic axis. The nearly parallel separation between chunk-size series makes the repeated-prefix cost visible across response lengths. These are scanner-only microbenchmarks on one machine, not end-to-end model latency. They show that coarser moderation chunks can make the naive design cheap, while very fine chunks on long outputs 15 Repeated-prefix scan cost Median scanner-only time; logarithmic y-axis. 0.01 0.1 1 10 100 1000 5122,0488,19216,384 Response length (characters) Median total time (ms) 8-char chunks 32-char chunks 128-char chunks 512-char chunks Figure 4: Scanner latency scaling by response length and moderation chunk size. Total median scanner time rises sharply for long responses and fine-grained chunks. make repeated scanning material. The timing fixture is deterministic clean prose truncated to the requested character length. It contains no configured pair, so every chunk is processed and the measurement represents the worst repeated-prefix path for that length, not an early block. Each configuration is warmed once and measured 50 times with a monotonic high-resolution clock. We report the median and preserve the 95th percentile and per-chunk values in the evidence JSON. A one-time buffered scan is timed alongside each configuration as a reference. The scaling pattern is more important than small differences between runs. At 512 characters, all configurations remain below one millisecond. At 2,048 characters, eight-character delivery costs roughly 12.8 ms while 512-character chunks cost about 0.25 ms. At 8,192 and 16,384 characters, halving or quartering the number of scans has a large effect because every avoided scan would have processed a substantial prefix. The 16,384-character, eight-character condition requires 2,048 scans and exceeds 810 ms, roughly 1,017 times the one-off buffered scan, while 32 scans at 512 characters total about 12.9 ms. The buffered comparator is not a deployable streaming policy because it releases nothing until completion; it is included to isolate the cost of repeated prefix rescanning. These data contradict a blanket claim that rescanning is always negligible next to model generation. Whether the overhead matters depends on model speed, concurrency, hardware, output length, and flush behaviour. A slow remote model may hide hundreds of milliseconds in wall-clock generation time; a high-throughput local model or heavily multiplexed service may not. The implementation should therefore enforce a moderation chunk policy rather than inherit arbitrary transport flush sizes. 6.9 Concurrent scanner throughput We also measured scanner-only batch completion at one, four, and eight concurrent streams. Every stream processed an 8,192-character clean response in 128-character moderation chunks; each level was repeated 15 times. Aggregate throughput remains approximately 75 responses per second as concurrency increases. This is consistent with CPU-bound Python work under the reference implementation and is not an end-to-end LLM serving benchmark. It shows that application-level concurrency does not remove repeated-prefix cost; an 16 Table 5: Concurrent scanner-only throughput for 8,192-character responses in 128-character chunks. Concurrent streams Batch median Batch p95 Aggregate throughput 113.180 ms 13.543 ms75.87 responses/s 453.376 ms 54.956 ms74.94 responses/s 8106.278 ms 108.083 ms75.27 responses/s optimised implementation should use incremental matcher state, native code, process parallelism, or another architecture suited to its deployment budget. 6.10 Reproducibility controls The benchmark is deterministic except for timing noise and generation timestamp. It has no network path. Corpus acquisition is a separate explicit command with a pinned URL and hash; ordinary evaluation reads only local files. The benchmark exits non-zero if any pair trial, parity check, completing-chunk withholding check, or single-predicate control fails. False positives do not cause a failed process because they are measurements to be reviewed, not harness malfunctions. Contract tests verify the bounded matrix, corpus fingerprinting, domain stratification, human-label validation, Wilson interval behaviour, and wording that refuses a general-recall claim. Separate tests verify that the AEGIS selection excludes jury-labelled and unsafe responses. A public-draft scanner checks for private absolute paths, internal clearance language, and exact detector fragments before a source package can pass its automated gate. These controls, the evidence records, the figures, and the manuscript build are run from Bee’s repository, making Bee the provenance-bearing research environment for the reported results rather than merely a deployment label. 7 Results and interpretation 7.1 What the 32/32 result establishes The mechanism matrix provides evidence that the current integration handles pair order, chunk fragmentation, decision parity, and non-release for the four committed families. In this bounded setting, the observed implementation agrees with the formal state transition. The completing chunk returned by feed is empty in every trial, so the test exercises enforcement rather than post-hoc detection. The result is useful despite being constructed. Regression tests often use cases derived from a specifica- tion because their purpose is conformance. If a future refactor scans after release, resets accumulated state, drops domain parameters, changes rule order, or mishandles a split token, at least one matrix cell should fail. The number 32 is not evidence about the prevalence or diversity of real attacks. It is evidence about a finite cross-product of rules and chunk sizes. 7.2 What the strategy comparison establishes The comparison separates a detector’s policy from the amount of history made available to it. Chunk-local scanning is inexpensive but does not implement a pair policy when the two predicates arrive in different chunks. A fixed rolling window implements the policy only for pairs whose observable evidence remains inside that window. Complete buffering is exact but removes the delivery property that motivated streaming. Full-prefix scanning is exact for the fixed policy and supports progressive release, at the cost measured in Sections 6.8 and 6.9. 17 The mean and maximum released-character values are fixture properties rather than universal leakage bounds. They nevertheless show why detection rate alone is insufficient: two strategies can eventually reach the same decision while exposing different prefixes, and a buffered strategy can obtain perfect pair detection by releasing nothing. A deployment decision must therefore report release semantics alongside classification outcomes. 7.3 What the safe-response result establishes The AEGIS subset supplies the evaluation dimension absent from the fixture matrix: benign-output evidence derived from human dialogue labels. Zero observed flags is encouraging for general conversational responses and is consistent with the intuition that requiring two signals is more selective than a single keyword. The confidence interval and label construction prevent stronger conclusions. In particular, the result does not show that the guard has a false-positive rate below 1% with 95% confidence; the upper Wilson bound on conditional flag incidence is approximately 1.12%. The contrast between AEGIS and the specialist stress screen is itself a result. A general safe-response sample can produce zero flags while a defensive domain reveals repeatable contextual failures. Deployments serving cybersecurity, medicine, law, or other sensitive expert domains should stratify benign testing by domain rather than relying on an aggregate safe set. A policy can be well calibrated for everyday conversation and disruptive for the users who most need to discuss risk indicators precisely. 7.4 What the semantic comparison establishes The official FP16 baseline strengthens the paper without weakening its central claim. Llama Guard detects 202 unsafe-subset responses that the fixed pairs do not, but flags 28 responses in the human-derived safe branch. Pair completion therefore supplies a low-variance enforcement invariant for a small policy; the learned model supplies broader taxonomy coverage with empirical error and substantially higher per-record cost. Neither result justifies deploying either layer without domain-specific calibration and monitoring. 7.5 What the external unsafe-response result establishes The 0/394 scope-check result is evidence against generalising the mechanism. The fixed scanner should be described as a deterministic enforcement backstop for a committed lexical policy, not as a broad harmful- content classifier. The jury provenance prevents treating the interval as an independently human-rated recall estimate, but the result still demonstrates that broad unsafe responses usually do not contain these four exact conjunctions. 7.6 What the latency and concurrency results establish Repeated full-prefix scanning is acceptable only under bounded operating conditions. The data support three practical controls: cap response length, decouple moderation chunks from very small transport fragments, and migrate to incremental matching if long fine-grained streams are required. The benchmark does not identify a universal optimal chunk size. Larger chunks reduce scanning cost and classifier invocation frequency but also delay delivery and coarsen the intervention boundary. A deployment can choose separate generation, moderation, and transport units. For example, a model may generate tokens internally, the server may accumulate them into a 128-character moderation buffer, and the network may frame approved text differently. This avoids treating every token callback as a mandatory full policy scan. The release guarantee then applies to moderation chunks: the chunk that completes a pair is withheld, but more unapproved text may be held in the server before the decision. 18 The concurrency measurement adds a systems constraint: merely creating more threads does not increase aggregate throughput for this CPU-bound Python reference. Production scaling therefore requires a different execution model or incremental algorithm, not a larger thread count alone. 8 Human, organisational, and governance implications Streaming moderation is not only a classifier-selection problem. It allocates delay, interruption, explana- tion, and review burden among model providers, deploying organisations, operators, and users. Complete buffering places most of the delay on every user in order to preserve an atomic policy decision. Chunk-local scanning minimises state and latency but can expose organisations to an enforcement gap that is difficult to explain after an incident. Full-prefix pair completion makes a narrower trade: it retains exactness for a fixed policy while permitting progressive release, but its cost rises with response length and flush frequency. The appropriate mechanism therefore depends on who bears the consequences of delay and missed intervention, not on scanner throughput alone. Contextual false positives create an uneven burden. All four matches in the internal stress screen came from defensive cybersecurity material. A general conversational sample alone would have hidden this concentration. Security analysts, incident responders, educators, and researchers routinely need to name behaviours and interfaces that overlap with threat indicators. Interrupting those users can delay investigation and can encourage them to route work around the governed system. Organisations should consequently evaluate benign utility by professional domain, provide an authorised research mode with independent access controls, and monitor overrides without treating every override as evidence of malicious intent. The deterministic layer nevertheless offers governance properties that learned classifiers do not always provide. Each block can identify the committed rule family, the release boundary, the prefix available to the client, and the policy version responsible for the decision. These facts support incident reconstruction, regression testing, and a meaningful appeal: a reviewer can determine whether the rule matched literally and then decide whether the rule was appropriate in context. An explanation that merely reports an opaque risk score provides less help when a legitimate user challenges an interruption. That auditability creates its own responsibilities. Rule changes should have an owner, justification, review date, version, and rollback path. Proposed pairs should be tested against specialist benign corpora before deployment, and the organisation should record which services, user groups, and jurisdictions use each policy version. Operational metrics should separate literal matches, contextually sustained blocks, authorised overrides, and confirmed incidents. Collapsing them into one "unsafe output" counter would turn a precise mechanism into misleading governance evidence. Pair completion should therefore be deployed as a contestable backstop inside a layered decision process. Semantic guards can cover paraphrase and broader harm; authorization systems can distinguish approved research; deterministic rules can enforce a small set of reviewable commitments; and human escalation can resolve cases where literal evidence and legitimate purpose diverge. No one layer establishes legal or regulatory compliance. The defensible claim is that pre-release ordering, explicit state, and versioned evidence make a limited policy easier to test and govern. 9 Limitations The evaluation covers exactly four signature families and cannot be reported as general harmful-output recall. The safe-response corpus contains only 338 responses whose safe labels are inherited from human-labelled safe conversations, not independent response-only annotations. AEGIS reports approximately 74% inter- annotator agreement, and the subset leaves a 1.12% upper confidence bound despite zero observed flags. Safety labels are socially contingent, and a single dataset does not represent every deployment policy. 19 The external unsafe subset is labelled by an LLM jury rather than independent human annotators, and the scanner detects none of its 394 responses. This confirms the absence of broad recall and limits the mechanism to a layered backstop role. The four internal contextual dispositions were made by the author alone; independent review remains outstanding. The first member of a pair may be released before the second arrives. The fixture residue measurement is descriptive rather than a formal leakage bound. The approach is vulnerable to obfuscation, paraphrase, alternate representations, and knowledge of the fixed predicates. Finally, the naive implementation’s quadratic cost motivates incremental automata or bounded moderation windows. 10 Conclusion This study isolates a narrow but operationally important property of streaming LLM safety: when a fixed rule is the conjunction of two lexical predicates, scanning the complete accumulated prefix before release withholds the chunk that first makes the pair observable. The implementation satisfied that property for all 32 bounded mechanism trials and matched the buffered policy, while bounded-history and chunk-local alternatives lost evidence. The result is a conformance guarantee for four committed families, not a general safety score. The external evidence clarifies where the mechanism belongs. It produced no flags on 338 human- derived safe responses and detected none of 394 broadly unsafe responses; an official FP16 Llama Guard baseline detected 202/394 but flagged 28/338 on the safe branch. The layers therefore address different failure modes. Deterministic pair completion can provide a reviewable backstop, while learned moderation supplies semantic breadth. The principal engineering cost is naive repeated-prefix scanning, whose latency grows quadratically for fixed chunk size and whose Python throughput did not scale with threads. Incremental matching and independently reproducible multi-domain evaluation are the next necessary steps. 11 Ethics and disclosure The study uses no customer prompts or responses. The external evaluation subset is derived from AEGIS2.0 under C BY 4.0 and retains no additional annotations. The bounded mechanism fixtures are used only to exercise already-committed policy families. Concrete detector strings are omitted from this draft pending independent operational-safety review. OpenAI Codex was used under the author’s direction to assist with code changes, manuscript editing, figure generation, and automated verification. The author reviewed the resulting text, code, calculations, and claims and remains solely responsible for the submitted work. No AI system is listed as an author. 12 Author information and competing interests Christopher M. Frost is Founder and Chief Technology Officer of HEOSSI (Pte.) Ltd., the Singapore company that develops Bee. He conceived the pair-completion study, implemented the reference mechanism and evaluation, curated the data, produced the visualisations, analysed the results, and wrote the manuscript. In CRediT terms, he performed conceptualisation, methodology, software, validation, formal analysis, investigation, data curation, visualisation, writing, and project administration. His leadership and ownership relationship with HEOSSI, which may benefit commercially from related work, is disclosed as a potential competing interest. The paper reports bounded mechanism evidence and makes no comparative claim of general product superiority. ORCID: 0009-0002-1027-1149. 20 13 Funding This work received no external grant funding. It was conducted as internal research at HEOSSI (Pte.) Ltd. 14 Corresponding author Correspondence should be addressed to Christopher M. Frost at christopher@heossi.com. 15 Data, code, and reproducibility AEGIS2.0 is publicly available under C BY 4.0. The evidence package records the pinned source revision, source and derived SHA-256 hashes, row-selection rule, full domain screen, per-trial mechanism matrix, latency repetitions, runtime environment, and Wilson interval. A sanitised artifact, with exact version and archive hash, will be released only after the rights-holder and operational-safety reviews recorded with this draft. No DOI exists at the time of writing, and the paper does not imply otherwise. The reported evidence and manuscript artifacts were generated and verified through Bee’s version-controlled research pipeline. The public source package contains the manuscript and deterministic figures but omits proprietary corpus material, exact detector strings, and executable policy code. These restrictions reduce independent reproducibility and are reported as such rather than hidden. Project information is available at bee.heossi.com. The public HEOSSI organisation and Bee community repository are available at github.com/heossihq and github.com/heossihq/bee-public. References [1] Jiaqi Yu, Xin Wang, Yixu Wang, Jie Li, Yan Teng, Xingjun Ma, and Yingchun Wang. SentGuard: Sentence-Level Streaming Guardrails for Large Language Models. arXiv:2606.02041, 2026. [2] Pride Kavumba, Koki Wataoka, Huy H. Nguyen, Jiaxuan Li, and Masaya Ohagi. Predict, Don’t React: Value-Based Safety Forecasting for LLM Streaming. arXiv:2604.03962, 2026. [3] Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. AEGIS2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails. In Proceedings of NAACL 2025, pages 5992–6026, 2025. [4] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations. arXiv:2312.06674, 2023. [5] Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs. In Advances in Neural Information Processing Systems 37, Datasets and Benchmarks Track, 2024. [6] Paul Rottger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models. In Proceedings of NAACL 2024, pages 5377–5400, 2024. [7] Alfred V. Aho and Margaret J. Corasick. Efficient String Matching: An Aid to Bibliographic Search. Communications of the ACM, 18(6):333–340, 1975. [8] Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. In EMNLP System Demonstrations, pages 431–445, 2023. 21 [9] Yi Dong, Ronghui Mu, Gaojie Jin, Yi Qi, Jinwei Hu, Xingyu Zhao, Jie Meng, Wenjie Ruan, and Xiaowei Huang. Position: Building Guardrails for Large Language Models Requires Systematic Design. In ICML, PMLR 235:11375–11394, 2024. [10] Elias Bassani and Ignacio Sanchez. On Guardrail Models’ Robustness to Mutations and Adversarial Attacks. In Findings of EMNLP, pages 16995–17006, 2025. [11] Neal Mangaokar, Ashish Hooda, Jihye Choi, Shreyas Chandrashekaran, Kassem Fawaz, Somesh Jha, and Atul Prakash. PRP: Propagating Universal Perturbations to Attack Large Language Model Guard- Rails. In ACL, pages 10960–10976, 2024. [12] Lenka Turonova, Lukas Holik, Ivan Homoliak, Ondrej Lengal, Margus Veanes, and Tomas Vojnar. Counting in Regexes Considered Harmful: Exposing ReDoS Vulnerability of Nonbacktracking Match- ers. In 31st USENIX Security Symposium, pages 4165–4182, 2022. [13] Elias Bassani and Ignacio Sanchez. GuardBench: A Large-Scale Benchmark for Guardrail Models. In EMNLP, pages 18393–18409, 2024. [14] Jinggui Liang and Lizi Liao. LS-Guard: Adaptive Safety Guardrails Tailored to Individual LLMs. In Findings of ACL, pages 19759–19772, 2026. [15] Igor Fedorov, Kate Plawiak, Lemeng Wu, Tarek Elgamal, Naveen Suda, Eric Smith, Hongyuan Zhan, Jianfeng Chi, Yuriy Hulovatyy, Kimish Patel, Zechun Liu, Changsheng Zhao, Yangyang Shi, Tijmen Blankevoort, Mahesh Pasupuleti, Bilge Soran, Zacharie Delpierre Coudert, Rachad Alao, Raghuraman Krishnamoorthi, and Vikas Chandra. Llama Guard 3-1B-INT4: Compact and Efficient Safeguard for Human-AI Conversations. arXiv:2411.17713, 2024. [16] Edwin B. Wilson. Probable Inference, the Law of Succession, and Statistical Inference. Journal of the American Statistical Association, 22(158):209–212, 1927. 22