{"id":"2ad584fd-0c3b-4d69-9001-0d9ca78ac6b9","arxiv_id":"2608.10279","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"Scanning the full accumulated prefix before every stream release guarantees that the chunk completing a fixed two-part lexical danger signature is withheld.","lead":"This paper tests a simple rule for streaming chatbot output: before releasing each chunk of text, scan everything written so far and hold back the first chunk that completes a forbidden pair of words or phrases. It shows the rule works as a narrow backstop for fixed word-based policies, while being no substitute for broader AI safety classifiers.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified: the pair-completion theorem is sound under its explicit integration contract; the only gate is whether deployments actually meet that contract.","rationale":"The reader's conditional verdict is appropriate, and the weakest assumption they identify is exactly the one I would flag: the formal guarantee holds only when the caller obeys the feed-before-emission contract. The paper does not hide this; it appears in the formal model, the integration contract, and the limitations. I considered whether the 32/32 mechanism matrix or the 0/394 external scope check could undermine the central claim, but RQ1–RQ3 are explicitly conformance tests, and the paper separates mechanism correctness from policy adequacy throughout. The only reason to move beyond a clean formal finding is that the executable artifact and detector strings are withheld, which gates independent verification of the empirical claims. That supports the reader's CONDITIONAL verdict without changing it.","tokens_in":16607,"tokens_out":7562,"duration_ms":79154,"concrete_test":"On the sanitized artifact, add a transport-level assertion that every byte written to the client equals the release string returned by feed for the same chunk, and that feed is invoked before any write occurs; then run the 32-trial mechanism matrix through that instrumented transport. If any completing chunk reaches the client, or if any write bypasses feed, the system-boundary guarantee fails. Alternatively, if the artifact is unavailable, independently reimplement the Section 3.2 transition and run the same matrix to confirm that the completing chunk returns empty.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The Section 3.3 formal claim is internally consistent: given the transition order (construct P_i = P_{i-1}||x_i, evaluate D(P_i), then choose the release branch), a non-empty D(P_i) necessarily selects the empty-release branch, so no character of the completing chunk is returned. The only load-bearing condition is the integration contract in Section 5.3: the runtime must call feed before any emission, release only the returned string, and process chunks serially. The paper explicitly lists this assumption in Sections 3.3 and 5.3, so it is a scoping caveat rather than a hidden flaw. Residual risks (first predicate already released, unguarded parallel channels, semantic evasion, quadratic cost) are acknowledged in Sections 4 and 9. I find no additional internal inconsistency or unsupported step in the central argument. The 0/394 external result and 4/13,114 contextual flags, while negative for practical utility, are honestly reported and do not bear on the formal property.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies a deterministic streaming-output moderation construction for policies expressed as conjunctions of two lexical predicates. The guard appends each chunk to an accumulated prefix, scans the prefix with the same buffered detector, and withholds the first chunk that makes both predicates true. The authors prove three properties (non-release of the completing chunk, terminal-label parity at the trip prefix, and a released-prefix invariant) under an explicit integration contract, and support them with an empirical mechanism matrix (32 pair trials, 8 single-predicate controls), a 512-trial strategy comparison, corpus screens (0/338 human-derived safe responses, 0/394 jury-labelled unsafe responses, 4/13,114 internal training answers), a Llama Guard 3 1B baseline, and scanner latency and concurrency measurements. The paper explicitly scopes its claim: pair completion is an exact release-boundary backstop for a small fixed policy, not a substitute for semantic moderation.","tokens_in":16774,"tokens_out":8215,"duration_ms":87855,"significance":"If the results hold, the paper makes a small but clean contribution: a formally stateable release-boundary guarantee for a class of deterministic streaming policies, together with a reference implementation and an honest separation of mechanism conformance from policy adequacy. The formal propositions in Section 3.3 are straightforward and correct under the stated assumptions, and the paper deserves credit for refusing to present constructed conformance as external harmful-output recall, for reporting Wilson intervals, for pinning dataset revisions and hashes, and for making the integration contract explicit. The main limitation is that the exact detector strings and executable policy code are withheld and the sanitized artifact is not yet available, so the empirical conformance claims are not independently reproducible at this stage; this affects the evaluation contribution, though not the formal argument.","major_comments":[{"comment":"Reproducibility of the empirical conformance claims: The manuscript states that the public source package omits exact detector strings and executable policy code and that the sanitized artifact will be released only after rights-holder and operational-safety reviews. Because Section 6.2 and Section 6.3 report conformance results (32/32 pair trials, 8/8 controls, and the 512-trial strategy matrix) that depend entirely on the four committed predicate families and their matching semantics, a reader cannot currently verify or reproduce these core empirical claims. Please provide reviewers and the editor with access to the sanitized artifact, or a precise specification of the predicate families and matching semantics sufficient for independent reimplementation, as part of the revision. If that is not possible, the paper should explicitly mark the empirical conformance results as not-yet-verifiable rather than presenting them as a reproducible evaluation.","section":"Section 15 / Section 11"}],"minor_comments":[{"comment":"The abstract and Section 6.7 describe the Llama Guard baseline as \"separately calibrated,\" but the text only reports four predeclared calibration cases and gives no calibration procedure (for example, threshold selection, temperature, or prompting scheme). Please either describe the actual calibration method or replace \"calibrated\" with a more neutral phrase such as \"locally converted\" to avoid overclaiming.","section":"Abstract / Section 6.7"},{"comment":"The semantics of the finish() method after a trip are ambiguous: the text says calls after a trip return an empty string, but also that finish() performs a terminal scan for unusual buffering paths. Please specify explicitly whether finish() can ever cause text to be released after the guard has blocked, and if so, under what conditions.","section":"Section 5.1"},{"comment":"The central propositions are conditional on an integration contract (the caller invokes feed before emission, emits only the returned string, and processes chunks serially). Sections 3.3 and 5.3 state this clearly, but the abstract and conclusion phrase the result without the condition. Adding a one-sentence restatement of the contract in the abstract would prevent readers from over-generalizing the guarantee.","section":"Section 3.3 / Section 5.3"},{"comment":"The description of character-level chunking would benefit from a concrete example showing how a lexical token split across chunk boundaries is handled, since this is one of the mechanisms the matrix is designed to exercise. The current text states that boundaries can be forced inside words, but it does not illustrate the behavior in the main text.","section":"Section 6.2"},{"comment":"The y-axis of Figure 4 is on a logarithmic scale and the axis labels omit explicit units; please add a note in the caption stating that time is in milliseconds and that medians of 50 runs are plotted, with percentiles retained in the evidence JSON.","section":"Figure 4"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is internally consistent and carefully scoped; I found no technical error in the formal argument. The main substantive issue is artifact availability: the paper's own contribution list includes a 'bounded reproducible evaluation,' but the exact predicates and code are withheld. I would ask the editor to decide whether reviewers-only access to the sanitized artifact should be a condition of acceptance. No concerns about citation patterns or authorship disclosure beyond what the paper already states."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Best thing to know: this is a small paper that knows it is small. The central property — scan the full prefix before every release and the chunk that completes a configured pair is withheld — is not deep, but it is stated precisely and proved in a few lines. The real contribution is the framing: separating mechanism conformance (does the guard implement the fixed policy exactly?) from policy adequacy (do those pairs catch harmful content?), and refusing to let the first answer the second. That is more discipline than most guardrail papers show.\n\nIt does useful work in the strategy comparison: full-prefix vs rolling window vs chunk-local vs complete buffer across 128 trials each. The numbers line up with the theory — bounded window misses pairs separated by more than 512 chars, chunk-local misses split evidence. The 512-char window score of 96/128 is exactly what you'd predict. Not a surprise, but a clean demonstration.\n\nThe honesty extends to the negatives. It reports 0/394 detection on a jury-labelled unsafe subset and says plainly this is not a general moderator. It reports four contextual false positives in cybersecurity material and notes the author did the review alone. It gives Wilson intervals and explains label provenance in AEGIS carefully. The integration contract in Section 5.3 is explicit: caller must feed before emitting, release only the returned string, process serially. Under that contract the proof holds. If a framework violates it, no mechanism can help. The paper says so.\n\nSoft spots: the artifact is not actually public. Detector strings, policy code, and corpus material are omitted pending 'operational-safety review', so independent verification is gated. Given the evaluation is mostly conformance-by-construction, that is a real limitation, though the paper flags it. The author is founder/CTO of the company that makes Bee, and the evaluation and contextual review are author-only. That doesn't invalidate the formal claim, but it does mean the empirical parts need an independent hand. The quadratic cost is measured honestly; at 16k chars with 8-char chunks it's over 800ms, which limits practical deployment. Also the first predicate can be released before the second appears; the paper acknowledges this but it's a genuine leak surface.\n\nOverall: this deserves peer review. It's a credible, well-scoped engineering report with a correct formal core and unusually honest limitations. I'd want the artifact released and independent validation of the contextual dispositions before accepting, but that's a revision, not a desk reject.","headline":"A narrow, honestly-scoped streaming guardrail paper: the formal claim is correct under an explicit integration contract, and the author's discipline about not overclaiming is the best part.","tokens_in":17263,"tokens_out":1689,"would_cite":false,"duration_ms":17268,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Streaming guards can deterministically withhold the chunk that first completes a configured banned pair.","keywords":["streaming safety","LLM output moderation","deterministic guardrails","lexical predicates","pair completion","online enforcement","release boundary","auditability"],"falsifier":"Run the guard with a caller that emits the raw model chunk before calling feed on a fixture whose second predicate appears in that chunk; the completing chunk will reach the client, directly refuting the paper's main non-release claim.","tokens_in":16415,"feed_emoji":"🛡️","tokens_out":8911,"duration_ms":77276,"temperature":0.7,"pith_summary":"Streamed model output cannot be recalled once released, but buffering the whole response destroys the point of streaming. The paper studies a narrow deterministic fix: when a moderation policy defines a danger signature as the conjunction of two lexical predicates, a guard that scans the full accumulated prefix before every chunk release can withhold the first chunk that makes both predicates observable. The paper shows that this construction makes the streaming decision and label match a buffered scanner exactly for the committed predicate pairs, while keeping the released text a true prefix of the generated text. It argues that this is an exact release-boundary backstop for a small fixed policy, not a substitute for semantic moderation, and it quantifies the cost of naive prefix rescanning.","feed_headline":"The completing chunk of a banned pair is withheld before it streams","feed_subtitle":"Scanning every prefix before release makes streamed moderation match buffered rules exactly, for fixed lexical pairs.","key_machinery":"The machinery is a stateful adapter around an existing buffered scanner. For each incoming chunk $x_i$, the guard forms the prefix $P_i = P_{i-1} \\parallel x_i$, evaluates the joint predicate $A_j(P_i) \\wedge B_j(P_i)$ for each committed family $j$, and only then chooses the release value: the chunk itself if no pair is complete, the empty string (and a sticky blocked state) otherwise. Because the scan happens before the return value is chosen, the completing chunk cannot cross the boundary, and because the streaming path calls the same scanner function as the buffered path, labels and refusal text stay identical.","core_discovery":"The central discovery is a release-boundary property: if every chunk traverses the guard in order and the caller emits only the string the guard returns, then the first chunk whose prefix satisfies a committed pair $A_j \\wedge B_j$ is withheld before release. The stream's first non-empty label equals the buffered detector's label at that trip prefix, and after the block the released text is exactly the pre-trip prefix. The paper states this as three propositions --- completing-chunk non-release, buffered/streaming terminal-label parity, and a released-prefix invariant --- and stresses that exactness is relative to the fixed policy representation, not to the open space of harmful language.","pith_inferences":["The paper leaves implicit that the same ordering argument would carry over to any finite Boolean combination of fixed predicates, not just pairs, as long as the full prefix is scanned before release and the blocked state is sticky.","Pair completion could be combined with incremental matching to eliminate the quadratic rescan cost while preserving the exact release property, if the incremental matcher is proven equivalent to the buffered scanner.","A testable extension is to treat the pre-block residue as the quantity of interest and measure its distribution across chunk sizes and predicate separations, since the paper reports descriptive residue values rather than a leakage bound.","Because the guarantee holds at the moderation-chunk boundary, deployments that accumulate several transport fragments before scanning release more unapproved text than a per-chunk reading of the guarantee suggests; the guarantee should be stated at the chosen moderation granularity."],"forward_implications":["For any fixed policy expressed as predicate pairs, a streaming endpoint can restore the exact enforcement semantics of a buffered moderator instead of weakening them.","The released text before a block is always a proper prefix of the generated text, so audit logs can distinguish what the model produced from what the client received.","Bounded-memory release strategies, such as a 512-character rolling window or chunk-local scanning, miss configured pairs when the evidence is separated, so exactness requires full-prefix scanning or complete buffering.","The deterministic guard is an exact backstop but a narrow one: it detected none of 394 broadly labelled unsafe responses, so it must be layered with a learned semantic moderator.","With coarse moderation chunks of 128 characters or more, repeated-prefix scanning is cheap on ordinary response lengths, but fine chunks on long streams make the quadratic cost material."],"supporting_citations":[{"why":"This prior streaming guardrail design buffers sentence-sized units before release; the paper positions pair completion as a different, exact decision basis rather than a learned classifier.","marker":"[1]"},{"why":"This prior approach forecasts expected harm of likely continuations; the paper contrasts forecasting with acting on an observed predicate transition.","marker":"[2]"},{"why":"This public dataset supplies the held-out test split: a human-labelled safe-response subset and an LLM-jury-labelled unsafe-response subset used for the scope checks and the semantic baseline.","marker":"[3]"},{"why":"This earlier safeguard taxonomy frames input/output safety as instruction-tuned classification, supporting the paper's layered interpretation of deterministic and semantic guards.","marker":"[4]"},{"why":"This open moderation suite demonstrates the broad prompt and response harm coverage achieved by learned classifiers, used to show what a semantic layer adds beyond fixed pairs.","marker":"[5]"},{"why":"This classical incremental multi-pattern matching algorithm is the engineering alternative identified for removing the quadratic cost of repeated full-prefix rescans while preserving exact matching.","marker":"[7]"},{"why":"This compact official learned safeguard supplies the calibrated same-corpus baseline whose safe and unsafe error profile is compared with the deterministic guard.","marker":"[15]"},{"why":"This confidence-interval method is used to report the uncertainty around zero observed flag incidence on the safe-response subset.","marker":"[16]"}],"fun_headline_variants":["Withhold the completing chunk: exact pair guard","Prefix-scan guard withholds first banned-completion chunk","Streaming moderation backstop: block pair-completing chunk","Deterministic pair guard matches buffered rules exactly","No streamed chunk completes a banned lexical pair"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is the integration contract: the model runtime must call the guard's feed method before any emission and must release only the string the guard returns, with chunks processed in serial order; otherwise the completing chunk can reach the client before any scan runs.","fun_headline_variants_meta":{"raw":{"variants":["Withhold the completing chunk: exact pair guard","Prefix-scan guard withholds first banned-completion chunk","Streaming moderation backstop: block pair-completing chunk","Deterministic pair guard matches buffered rules exactly","No streamed chunk completes a banned lexical pair"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000652,"raw_usage":{"total_tokens":2986,"prompt_tokens":935,"completion_tokens":2051,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":551,"completion_tokens_details":{"reasoning_tokens":1974}},"tokens_in":551,"tokens_out":2051,"duration_ms":14639,"temperature":1.0,"reasoning_tokens":1974,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:09:55.266760+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the guard with a caller that emits the raw model chunk before calling feed on a fixture whose second predicate appears in that chunk; the completing chunk will reach the client, directly refuting the paper's main non-release claim.","supporting_citations":[{"cited_title":"SentGuard: Sentence-Level Streaming Guardrails for Large Language Models","cited_arxiv_id":"2606.02041","evidence_quote":"This prior streaming guardrail design buffers sentence-sized units before release; the paper positions pair completion as a different, exact decision basis rather than a learned classifier."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"This public dataset supplies the held-out test split: a human-labelled safe-response subset and an LLM-jury-labelled unsafe-response subset used for the scope checks and the semantic baseline."},{"cited_title":"WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs","cited_arxiv_id":null,"evidence_quote":"This open moderation suite demonstrates the broad prompt and response harm coverage achieved by learned classifiers, used to show what a semantic layer adds beyond fixed pairs."},{"cited_title":"Aho and Margaret J","cited_arxiv_id":null,"evidence_quote":"This classical incremental multi-pattern matching algorithm is the engineering alternative identified for removing the quadratic cost of repeated full-prefix rescans while preserving exact matching."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"This confidence-interval method is used to report the uncertainty around zero observed flag incidence on the safe-response subset."}],"review_version":1}