Structured output

There are three levels of guarantee, and they are often confused. Prompt-only formatting asks for JSON in the instructions, perhaps with an example, and has no guarantee at all; outputs may include prose around the JSON, trailing commas or missing fields. JSON mode, introduced by OpenAI in November 2023 and offered in similar form by other providers, guarantees syntactically valid JSON but not any particular shape. Schema-constrained output guarantees that the result validates against a supplied JSON Schema. OpenAI launched this as Structured Outputs on 6 August 2024, both as a response format and as strict: true on function definitions, reporting 100% schema adherence on its internal evaluation for gpt-4o-2024-08-06 against under 40% for gpt-4-0613 with prompting alone; Anthropic introduced JSON outputs and strict tool use in public beta in November 2025.

The guarantee comes from constrained decoding. The schema is compiled into a grammar or finite-state machine, and at each step the sampler masks the logits of every token that could not lead to a valid continuation, so only grammatical tokens can be chosen. Because tokens do not align with JSON syntax (one token may contain a quote, a colon and part of a key), the compiler must precompute which vocabulary entries are admissible in each automaton state; libraries such as Outlines, llama.cpp's GBNF grammars and XGrammar implement this for open-weight models, and hosted APIs typically cache the compiled schema, so the first request with a new schema can be slower. Providers support only a subset of JSON Schema in strict mode - commonly requiring every property to be listed as required, disallowing additional properties, and limiting recursion, pattern and format keywords.

Constraints guarantee form, not content. The model still chooses values, so an enum field can hold the wrong category, a date field a plausible but false date, and a string field arbitrary text including injected instructions or markup. Forcing a format can also cost quality: Tam et al. (2024, "Let Me Speak Freely?") reported that strict format constraints degraded reasoning performance on some tasks. Common mitigations are to include a free-text reasoning field before the answer fields, to keep schemas flat and descriptive (field names and descriptions act as instructions), and to model "unknown" or "not found" explicitly so the model is not forced to invent a value. Safety refusals may be returned in a separate field rather than inside the schema.

Downstream code must still treat model output as untrusted input. OWASP's 2025 LLM Top 10 lists Improper Output Handling as LLM05: values from a well-formed object can still cause SQL injection, cross-site scripting, path traversal or unintended tool actions if passed on without validation. Structured output makes semantic validation easier - check ranges, cross-field consistency and business rules on typed fields - but does not replace it.