Classify

The classify model rejects a message when a classifier detects one of a configured set of labels in it. Classifiers are configured once, under the top-level classifiers section, and each one detects labels its own way:

Classifier	Detects	Runs
patterns	Content with a recognizable shape, such as API keys and tokens, by regular expression	In-process
presidio	Personal data, such as names and email addresses	With a Microsoft Presidio analyzer service
semantic	Content by meaning, such as a jailbreak attempt	With an embedding provider

Configuration

classifiers:
  secrets0:
    type: patterns
    options:
      labels:
        secret.aws_key: "AKIA[0-9A-Z]{16}"
  pii0:
    type: presidio
    options:
      endpoint: http://presidio-analyzer:3000
      labels:
        email: EMAIL_ADDRESS

A classify model then names, for each classifier, the labels to reject:

model: classify
reject:
  secrets0:
    - secret.aws_key
  pii0:
    - email

The model never changes the value: it is rejected when any listed classifier detects one of its listed labels.

Where to Use It

Use classify in LLM guardrails, on a section of an LLM prompt or reply:

north_llm_proxy:
  type: llm
  kind: proxy
  options:
    guardrails:
      gpt-4o-mini:
        request:
          - section: user-text
            value:
              model: classify
              reject:
                secrets0:
                  - secret.aws_key
                pii0:
                  - email

Fails Closed

When a classifier can't classify a value, the value is treated as detected and rejected. That includes a Presidio analyzer that can't be reached or returns an error, an embedding that fails, and a value too long for a regular expression to check.

Next Steps

• Secrets, Personal Data, and Semantic: each classifier in detail.
• LLM Guardrails: apply classify to LLM prompts and replies.
• classify: the full classify model reference.