Skip to main content

LLM Guardrails

Use CaseLLMGuardrailsAI Gateway

Prompts carry whatever users type and applications attach: an API key pasted into a question, a customer's email address, an attempt to talk the model out of its instructions. Once a prompt reaches a provider, it has left your control.

The Problem

Each application can check its own prompts, but then every application implements the same checks its own way, and a single application that skips them sends sensitive data to a provider. Policies change faster than applications are redeployed, and no one can show which checks applied to which traffic.

How Zilla Solves It

LLM guardrails on llm · proxy check each prompt and reply at the gateway, for every application and SDK. Checks are configured per model and target sections of the conversation, such as the user's text or the assistant's reply. Classifiers detect secrets by pattern, personal data with a Presidio analyzer, and jailbreak attempts by meaning. A rejected prompt never reaches the provider: the caller receives 400 in its own API's error format, naming the rejected section.

Architecture

LLM guardrails flow
LLM guardrails flow

Configuration

north_llm_proxy:
  type: llm
  kind: proxy
  options:
    guardrails:
      gpt-4o-mini:
        request:
          - section: user-text
            value:
              model: classify
              reject:
                jailbreak0:
                  - jailbreak
                secrets0:
                  - secret.aws_key
                pii0:
                  - email

The classifiers jailbreak0, secrets0, and pii0 are configured once under classifiers. See Classify.

Limits

  • Guardrails are configured per exact model name.
  • Checks on replies forward accepted text straight away, so part of a reply can reach the caller before a later part is rejected. In a streaming reply, each streamed piece is checked on its own, so content split across pieces isn't matched as a whole.
  • A classifier that can't check a section rejects it, so the services classifiers depend on, such as a Presidio analyzer, need to be available.

See LLM Guardrails for the details.

Try It

The LLM Gateway demo rejects prompts that contain an AWS key, an email address, or a jailbreak attempt.

Try the guide

Walk through LLM Guardrails to add guardrails to a gateway and watch them reject prompts.