LLM Guard

Implements a modular scanner framework where input scanners validate user prompts before LLM processing and output scanners validate LLM responses before user delivery. Each scanner follows a common interface returning (sanitized_text, is_valid, risk_score), enabling independent composition and chaining of 36+ security checks across both gates without tight coupling.

Detects prompt injection attacks using multiple techniques including transformer-based semantic similarity matching, token-level pattern detection, and instruction-following analysis. Scanners analyze prompt structure to identify attempts to override system instructions or inject hidden commands through various encoding schemes and linguistic tricks.

Allows teams to define custom scanner pipelines by composing multiple scanners with configurable execution order, conditional logic, and aggregation strategies. Supports YAML-based configuration for declaring which scanners to run, their parameters, and how to combine results (e.g., fail-fast on first violation, aggregate all risk scores).

Provides built-in observability hooks for tracking scanner execution, latency, and results. Exports structured metrics (execution time, risk scores, detection rates) for monitoring and alerting. Supports integration with observability platforms for tracking security events and identifying attack patterns.

Abstracts transformer model loading through a unified interface (transformers_helpers module) that handles HuggingFace model downloads, caching, tokenization, and device placement (CPU/GPU). Automatically manages model lifecycle including lazy loading, memory management, and version pinning to ensure reproducible security scanning.

Supports scanning multiple prompts or outputs in a single API call, enabling efficient batch processing for high-throughput scenarios. Processes batches through the scanner pipeline with optimized tensor operations and optional parallelization, reducing per-item overhead compared to individual requests.

Aggregates risk scores from multiple scanners using configurable strategies (weighted sum, maximum, AND/OR logic) to produce a final security decision. Enables policy-based rules (e.g., 'block if any scanner scores > 0.8 OR toxicity > 0.9') for nuanced security decisions beyond binary allow/block.

Identifies personally identifiable information (names, emails, phone numbers, SSNs, credit cards, etc.) in both prompts and outputs using pattern matching and NER models, then stores detected PII in a stateful Vault object for later retrieval or replacement. Enables reversible anonymization workflows where sensitive data is replaced with tokens and can be restored post-processing.

Detects toxic, abusive, profane, and harmful language in prompts and outputs using transformer-based toxicity classifiers. Provides configurable risk thresholds to allow teams to define what level of toxicity is acceptable for their use case, enabling nuanced content moderation beyond binary allow/block decisions.

Detects attempts to inject malicious code (SQL, shell commands, Python code) or extract sensitive code patterns from LLM outputs. Uses pattern matching and AST-based analysis to identify code injection payloads and prevents LLMs from generating executable code that could be used for attacks or data exfiltration.

Filters prompts and outputs based on configurable topic ban lists (e.g., violence, illegal activities, adult content). Uses keyword matching and optional semantic similarity to detect when users are trying to get the LLM to discuss banned topics, with support for custom topic definitions and exception lists.

Detects attempts to hide malicious content using invisible unicode characters, zero-width spaces, homograph attacks, and other encoding tricks. Analyzes character-level properties to identify suspicious encoding patterns that could bypass other security checks or confuse users.

Exposes all 36+ scanners via a FastAPI REST API service (llm-guard-api) with configurable endpoints for scanning prompts and outputs. Supports batch processing, scanner composition, and observability hooks. Deployable as Docker containers with optional CUDA GPU acceleration for production environments.

Supports ONNX (Open Neural Network Exchange) format model conversion and inference for transformer-based scanners, enabling 2-10x faster inference on CPU and GPU compared to PyTorch. Automatically handles model quantization and optimization while maintaining accuracy, reducing latency from 200-500ms to 20-100ms per scan.

Provides native integration with LiteLLM, a library that abstracts multiple LLM providers (OpenAI, Anthropic, Ollama, etc.) behind a unified API. Enables automatic scanning of prompts and responses for any LLM provider without provider-specific integration code, using LiteLLM's proxy or library mode.