Output filtering post-processes LLM responses to remove harmful, sensitive, or policy-violating content before delivery. What to filter: Toxic/harmful content, PII leakage, confidential information, off-brand responses, hallucinated claims, competitor mentions, unsafe instructions. Approaches: Classifier-based: Train models to detect violation categories, block or flag violations. Regex/rules: Catch specific patterns (SSN formats, internal URLs, profanity). LLM-as-judge: Use another model to evaluate response appropriateness. Content moderation APIs: OpenAI moderation, Perspective API, commercial services. Actions on detection: Block entire response, redact specific content, regenerate with constraints, escalate for review. Trade-offs: False positives frustrate users, latency from additional processing, sophisticated attacks may evade filters. Layered defense: Combine with input sanitization, RLHF training, system prompts. Production considerations: Log filtered content for analysis, monitor filter rates, tune thresholds per use case. Best practices: Defense in depth, graceful degradation, transparency about filtering policies. Critical for customer-facing applications.