CONCEPT Cited by 1 source

Deterministic filtering before LLM

Definition

A pipeline design principle where programmatic, rules-based checks handle predictable cases before invoking an LLM, eliminating the cost and latency of model inference for inputs whose disposition is already known. The cheapest LLM call is the one you never make.

Mechanism

When processing a stream of inputs (alerts, tickets, documents), a deterministic filter layer applies pattern-matching rules — trusted IP lists, known service-account activity, expected tool behavior — to produce instant dispositions. Only ambiguous inputs that survive the filter proceed to expensive LLM reasoning.

At Databricks, this approach handles 30–95% of security alert volume depending on the detection source, leaving only genuinely uncertain alerts for model-based triage (Source: sources/2026-07-06-databricks-scaling-security-alert-triage).

Why it matters

• Cost: LLM inference costs scale linearly with volume; deterministic filters are O(1) per rule match.
• Latency: Pattern matching completes in microseconds vs. seconds for LLM calls.
• Reliability: Deterministic rules produce consistent outputs — no hallucination risk.
• Scope control: Tightly scoped LLM instructions consistently outperform broad prompts; filtering narrows what the model must evaluate.

Seen in

• sources/2026-07-06-databricks-scaling-security-alert-triage — Databricks security agents filter 30–95% of alerts deterministically before any LLM call.