When you stream a model's reply token by token, users may see harmful text before any filter can judge the whole answer. You have three options: buffer and check before showing, check in chunks and cut off, or stream freely and accept the risk. The right one depends on how bad a single bad reply would be.
Why streaming changes the problem
A filter that scores a full reply needs the full reply. One provider's moderation documentation states this plainly: with streamed responses, scores arrive only after the complete output is available. By then the user has already read it.
A second effect: errors can arrive after the response has started. Another provider's documentation notes that when streaming over server-sent events, an error can occur after a 200 status has already been returned, so normal HTTP error handling does not apply. Your client code needs to handle a stream that ends badly halfway through.
Design 1: buffer, check, then reveal
Collect the full reply on the server, run the check, then send it. The user waits longer, and you lose the typing effect. This is the safest design and the right one for high-risk settings, such as products for minors or health advice.
You can soften the wait with a progress indicator. A common trick is to stream a neutral status, not model text.
Design 2: check in chunks
Run the check on each sentence or paragraph as it forms, and release text only after it passes. If a chunk fails, stop the stream and replace what is pending with a safe message.
Trade-offs to know:
- A harmful meaning can be spread across chunks, so each chunk looks fine alone.
- Text already shown cannot be unshown. Decide whether the client can remove it.
- Chunk checks multiply the number of filter calls.
Design 3: stream first, check after
Show text live, run the full check at the end, and log or retract after the fact. This is acceptable only where the harm from one reply is small and you have a way to remove the message from the history and from any copies, such as emails or notifications.
What else to handle
Links and images in output. Rendering model output as rich text can send data to another site through an image URL. See markdown image exfiltration from LLM chat output. Sanitize before rendering, in every design.
Tool calls. Moderation of text does not stop a tool from running. Gate tools separately.
Cancellation. When the user closes the page, stop the upstream request so you do not pay for output no one reads. Check how your provider bills cancelled streams.
Logging. Log the final text and the filter decision. Redact personal data as described in what log data to redact before sending to an LLM.
How to choose
Ask one question: what is the worst reply, and what happens if one user sees it for two seconds? If the answer is a legal problem or harm to a child, buffer. If it is mild embarrassment, chunk or stream.
Quick check
Does a shorter filter model fix the delay?
It reduces the delay for buffering, but the full reply must still exist before a full-reply check. Chunk checks avoid that wait at the cost of weaker context.
Sources
Last reviewed: 19 October 2026.
