Llama Guard

Llama Guard uses a fine-tuned Llama backbone to classify user prompts and model responses against a taxonomy of unsafe content categories (violence, sexual content, criminal planning, self-harm, etc.). The model operates as a sequence classifier that tokenizes input text and produces category-level safety judgments, allowing deployment teams to define custom policy thresholds per category rather than enforcing a single binary safe/unsafe boundary. This enables nuanced safety enforcement where some categories may be blocked entirely while others permit higher risk tolerance.

Llama Guard identifies attempts to manipulate LLM behavior through prompt injection attacks by classifying prompts that contain adversarial instructions designed to override system prompts or elicit unsafe behavior. The model learns patterns of injection techniques (e.g., 'ignore previous instructions', role-play scenarios, hypothetical framing) from training data that includes both benign and adversarial prompt variants. This capability integrates with the broader CyberSecEval benchmark framework which includes prompt injection test datasets.

CyberSecEval v3 extends safety evaluation to visual prompt injection attacks where adversaries embed malicious instructions in images to manipulate multimodal LLMs. PurpleLlama provides benchmarks and evaluation methodology for assessing LLM robustness to visual injection attacks, enabling safety assessment of vision-capable models before deployment.

CyberSecEval v3 includes benchmarks for evaluating LLM capability to function as autonomous cyber attack agents, testing whether models can plan and execute multi-step offensive operations (reconnaissance, exploitation, lateral movement). This evaluation measures the risk of LLM misuse for cybercriminal purposes and informs safety policies around autonomous agent capabilities.

Llama Guard extends safety classification across multiple languages by leveraging machine-translated versions of safety evaluation datasets (e.g., MITRE prompts translated to 10+ languages). The model is evaluated and can be fine-tuned on these multilingual variants to detect unsafe content regardless of input language. This capability is integrated into CyberSecEval's benchmark suite which includes multilingual prompt injection and MITRE compliance test sets.

Llama Guard integrates as a core component within the LlamaFirewall security framework, which orchestrates multiple scanner components (Llama Guard, Prompt Guard, CodeShield) into a unified input/output filtering pipeline. LlamaFirewall provides the orchestration layer that chains Llama Guard's classification results with other security scanners, applies policy decisions, and manages the flow of requests through the security stack. This enables teams to compose multi-stage security workflows where Llama Guard handles general content safety while specialized scanners handle code security or prompt injection.

Llama Guard serves as both a subject of evaluation within CyberSecEval's comprehensive cybersecurity benchmark suite and as a tool for evaluating other LLMs. The framework includes structured benchmarks for prompt injection, MITRE compliance, code interpreter abuse, and autonomous offensive cyber operations. Teams can use Llama Guard to classify LLM responses in these benchmarks, measuring how well their models resist adversarial attacks. The integration with CyberSecEval v1/v2/v3 provides standardized evaluation protocols and datasets for red-teaming LLM deployments.

Llama Guard produces granular per-category risk scores (e.g., violence: 0.8, sexual content: 0.2, criminal planning: 0.1) rather than a single binary safe/unsafe judgment. Teams can define custom policy thresholds per category, allowing fine-grained enforcement where some categories are blocked at high confidence while others permit lower thresholds. This is implemented through the model's output layer which produces logits for each safety category, enabling downstream policy engines to apply category-specific rules.

Llama Guard runs entirely locally on customer infrastructure without requiring external API calls or data transmission to Meta or third-party services. The model weights are open-source and can be downloaded and deployed on private servers, VPCs, or air-gapped environments. This architecture eliminates latency from network round-trips and provides full data privacy — safety classifications never leave the customer's infrastructure.

Llama Guard integrates with CodeShield, a specialized safety model for evaluating code security risks in LLM-generated code. While Llama Guard handles general content safety, CodeShield specifically detects insecure code patterns, vulnerable dependencies, and code interpreter abuse. The integration within LlamaFirewall allows teams to apply CodeShield to code outputs while using Llama Guard for text outputs, creating a unified security pipeline that handles both modalities.

Llama Guard integrates with CyberSecEval's MITRE compliance benchmarks to measure false refusal rates (FRR) — the percentage of legitimate, safe requests that are incorrectly blocked. The framework includes MITRE-mapped test cases that represent legitimate use cases within security domains (e.g., educational content about vulnerabilities, authorized penetration testing). Teams can evaluate their LLM's FRR to ensure safety policies don't over-block legitimate requests, balancing safety with usability.

Llama Guard integrates with Prompt Guard, a specialized model for detecting visual prompt injection attacks where adversaries embed text instructions in images to manipulate LLM behavior. While Llama Guard handles text-based attacks, Prompt Guard processes image inputs to detect embedded instructions. The integration within LlamaFirewall allows teams to apply Prompt Guard to multimodal inputs (text + images) alongside Llama Guard's text classification.