# LLM Guard - Deep Dive

> **TL;DR**: LLM Guard is an open-source security toolkit (2,400+ stars) that protects LLM applications with 38 specialized scanners - 16 for inputs, 22 for outputs. It detects prompt injection, blocks sensitive data leakage, filters toxic content, and prevents jailbreaks. Created by ProtectAI (acquired by Palo Alto Networks for $500M), it's the go-to library for securing AI applications. MIT licensed, works with any LLM provider.

---

## What Is LLM Guard?

**LLM Guard** is a security toolkit designed to protect LLM interactions through comprehensive scanning of both inputs (prompts) and outputs (responses). It acts as a security layer between your application and the LLM.

### The Problems It Solves

```
┌─────────────────────────────────────────────────────────────────────┐
│                    LLM SECURITY THREATS                              │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   INPUT THREATS                      OUTPUT THREATS                 │
│   ├── Prompt injection               ├── Data leakage               │
│   ├── Jailbreak attempts             ├── Toxic/harmful content      │
│   ├── PII in prompts                 ├── Hallucinations             │
│   ├── Credential exposure            ├── Malicious URLs             │
│   ├── Malicious code                 ├── Biased responses           │
│   ├── Banned topics                  ├── Competitor mentions        │
│   └── Invisible text attacks         └── Code injection             │
│                                                                     │
│   LLM GUARD SOLUTION                                                │
│   ├── 16 input scanners                                             │
│   ├── 22 output scanners                                            │
│   ├── Configurable thresholds                                       │
│   ├── Per-scanner risk scores                                       │
│   └── Sanitization + validation                                     │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
```

---

## Quick Stats

| Metric | Value |
|--------|-------|
| **GitHub Stars** | 2,400+ |
| **Contributors** | 23 |
| **Input Scanners** | 16 |
| **Output Scanners** | 22 |
| **License** | MIT |
| **Downloads** | 2.5M+ |
| **Company** | ProtectAI (acquired by Palo Alto Networks) |

---

## Input Scanners (16)

Protect prompts before they reach the LLM:

| Scanner | What It Detects |
|---------|-----------------|
| **Anonymize** | PII - masks personal information |
| **Ban Code** | Code content in prompts |
| **Ban Competitors** | Competitor organization mentions |
| **Ban Substrings** | Specific text patterns |
| **Ban Topics** | Prohibited subjects (zero-shot) |
| **Code** | Code-related security issues |
| **Emotion Detection** | Emotional content patterns |
| **Gibberish** | Nonsensical/meaningless text |
| **Invisible Text** | Hidden/stealth characters (attacks) |
| **Language** | Text language validation |
| **Prompt Injection** | Direct and indirect injection attacks |
| **Regex** | Custom pattern matching |
| **Secrets** | API keys, credentials, tokens |
| **Sentiment** | Suspicious sentiment patterns |
| **Token Limit** | Input length restrictions |

---

## Output Scanners (22)

Protect responses before they reach users:

| Scanner | What It Detects |
|---------|-----------------|
| **Ban Code** | Unwanted code patterns |
| **Ban Competitors** | Competitor mentions in output |
| **Ban Substrings** | Prohibited text strings |
| **Ban Topics** | Restricted content subjects |
| **Bias** | Biased language or unfair perspectives |
| **Code** | Code quality and validity issues |
| **Deanonymize** | Re-identifying information |
| **Emotion Detection** | Emotional tone in responses |
| **Factual Consistency** | Hallucination detection |
| **Gibberish** | Nonsensical output |
| **JSON** | JSON formatting validation |
| **Language** | Language identification |
| **Language Same** | Input/output language match |
| **Malicious URLs** | Dangerous/malicious links |
| **No Refusal** | Jailbreak detection via refusal patterns |
| **Reading Time** | Length and complexity metrics |
| **Regex** | Custom pattern rules |
| **Relevance** | Response appropriateness |
| **Sensitive** | Sensitive information exposure |
| **Sentiment** | Tone and sentiment patterns |
| **Toxicity** | Harmful/offensive language |
| **URL Reachability** | Link accessibility verification |

---

## How It Works

### Architecture

```
┌─────────────────────────────────────────────────────────────────────┐
│                    LLM GUARD FLOW                                    │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│   User Input                                                        │
│        ↓                                                            │
│   ┌─────────────────────────────────────────────────────────────┐   │
│   │  INPUT SCANNERS                                             │   │
│   │  ├── Prompt Injection Scanner                               │   │
│   │  ├── Secrets Scanner                                        │   │
│   │  ├── Ban Topics Scanner                                     │   │
│   │  └── ... (configurable chain)                               │   │
│   └─────────────────────────────────────────────────────────────┘   │
│        ↓                                                            │
│   Returns: (sanitized_prompt, is_valid, risk_score)                │
│        ↓                                                            │
│   If valid → Send to LLM                                           │
│        ↓                                                            │
│   LLM Response                                                      │
│        ↓                                                            │
│   ┌─────────────────────────────────────────────────────────────┐   │
│   │  OUTPUT SCANNERS                                            │   │
│   │  ├── Toxicity Scanner                                       │   │
│   │  ├── Factual Consistency Scanner                            │   │
│   │  ├── Bias Scanner                                           │   │
│   │  └── ... (configurable chain)                               │   │
│   └─────────────────────────────────────────────────────────────┘   │
│        ↓                                                            │
│   Returns: (sanitized_output, is_valid, risk_score)                │
│        ↓                                                            │
│   User receives safe response                                       │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
```

### Basic Usage

```python
from llm_guard.input_scanners import PromptInjection, Secrets, BanTopics
from llm_guard.output_scanners import Toxicity, Bias, FactualConsistency

# Input scanning
prompt_scanner = PromptInjection(threshold=0.8)
secrets_scanner = Secrets(redact=True)

sanitized, is_valid, risk = prompt_scanner.scan(user_prompt)

if is_valid:
    # Safe to send to LLM
    response = llm.generate(sanitized)

    # Output scanning
    toxicity_scanner = Toxicity(threshold=0.7)
    safe_response, is_valid, risk = toxicity_scanner.scan(user_prompt, response)
```

---

## Installation

```bash
# Basic installation
pip install llm-guard

# With ONNX acceleration (recommended)
pip install llm-guard[onnxruntime]

# With GPU support
pip install llm-guard[onnxruntime-gpu]
```

### Requirements
- Python 3.9+
- 16GB RAM for API deployment

---

## Integration Patterns

### 1. Python Library (Lowest Latency)

```python
from llm_guard import scan_prompt, scan_output

# Scan input
sanitized_prompt, results, is_valid = scan_prompt(
    scanners=[prompt_injection, secrets, ban_topics],
    prompt=user_input
)

# Scan output
sanitized_output, results, is_valid = scan_output(
    scanners=[toxicity, bias],
    prompt=user_input,
    output=llm_response
)
```

### 2. API Deployment (Docker)

```yaml
# config.yml
scanners:
  prompt:
    - BanTopics:
        topics: [violence, illegal]
        threshold: 0.5
    - PromptInjection:
        threshold: 0.8
  response:
    - Toxicity:
        threshold: 0.7
```

```bash
docker run -p 8000:8000 -v ./config.yml:/app/config.yml laiyer/llm-guard
```

### 3. LangChain Integration

```python
from langchain.chains import LLMChain
from llm_guard.langchain import LLMGuardChain

# Wrap existing chain with security
protected_chain = LLMGuardChain(
    chain=original_chain,
    input_scanners=[prompt_injection, secrets],
    output_scanners=[toxicity, bias]
)
```

### 4. LiteLLM Integration

Works with any LLM provider via LiteLLM:
- OpenAI, Anthropic, Google, AWS Bedrock, Azure
- 100+ LLM APIs through single interface

---

## Performance Optimization

| Technique | Benefit |
|-----------|---------|
| **ONNX Runtime** | Faster inference (use `use_onnx=True`) |
| **Low CPU Memory** | Reduced memory (use `low_cpu_mem_usage=True`) |
| **Smaller Models** | Lower latency (distilbert, bert-tiny) |
| **Quantization** | Smaller footprint |
| **Fail-Fast Mode** | Early exit on first violation |
| **Streaming** | Process chunks for large responses |

---

## Comparison with NeMo Guardrails

| Aspect | LLM Guard | NeMo Guardrails |
|--------|-----------|-----------------|
| **Focus** | Input/output scanning | Dialogue flow control |
| **Approach** | Modular scanner pipeline | State machine + Colang DSL |
| **Architecture** | Loosely coupled | Tightly integrated |
| **Best For** | Content moderation, compliance | Multi-turn conversation control |
| **Learning Curve** | Low (Python config) | Medium (learn Colang) |
| **Latency** | ~0.1-0.5s per scanner | ~0.5s for 5 rails |

### When to Use Which?

```
USE LLM GUARD WHEN:
├── You need content filtering
├── You want drop-in security
├── You have existing LLM code
├── You need granular scanner control
└── Compliance is the focus

USE NEMO GUARDRAILS WHEN:
├── You need conversation flow control
├── You're building chatbots
├── You want programmable policies
├── Multi-turn context matters
└── You need topic steering
```

### Can You Use Both?

**Yes!** They're complementary:
- LLM Guard: Filter content in/out
- NeMo Guardrails: Control conversation flow
- Together: Comprehensive safety

---

## Who Is ProtectAI?

| Fact | Detail |
|------|--------|
| **Founded** | 2022 |
| **HQ** | Seattle, USA |
| **Mission** | "Securing ML" |
| **Funding** | $129M raised |
| **Acquired** | By Palo Alto Networks (April 2025, $500M) |

### ProtectAI Products

| Product | Purpose |
|---------|---------|
| **LLM Guard** | LLM input/output security |
| **ModelScan** | ML model security scanning |
| **NB Defense** | Jupyter notebook security |
| **AI Exploits** | Vulnerability documentation |
| **Vulnhuntr** | AI-powered vuln discovery |
| **huntr** | ML/AI threat research community |

---

## Use Cases

### 1. Customer Support Bots

```
├── Block jailbreak attempts
├── Prevent PII disclosure
├── Filter competitor mentions
└── Ensure professional tone
```

### 2. Healthcare AI

```
├── HIPAA compliance (PII redaction)
├── Medical misinformation filtering
├── Professional boundary enforcement
└── Audit trail for responses
```

### 3. Financial Services

```
├── Prevent market-sensitive disclosures
├── Regulatory compliance
├── Credential protection
└── Topic restrictions
```

### 4. Content Moderation

```
├── Toxicity filtering
├── Bias detection
├── Harmful content blocking
└── Multi-language support
```

---

## How This Connects to Our Other Deep Dives

| Deep Dive | Connection |
|-----------|------------|
| **NeMo Guardrails** | Complementary approach (flow vs content) |
| **Awesome LLMOps** | Listed in Security category |
| **OpenHands** | Could add safety layer to agent outputs |
| **MindsDB** | Secure AI-generated SQL responses |
| **Context Engineering** | Safety as part of context management |

---

## Key Links

| Resource | URL |
|----------|-----|
| GitHub | https://github.com/protectai/llm-guard |
| Documentation | https://llm-guard.com/ |
| ProtectAI | https://protectai.com/ |
| PyPI | https://pypi.org/project/llm-guard/ |

---

## Bottom Line

LLM Guard is the **most comprehensive open-source library for LLM security**.

**Why it matters**:
- 38 specialized scanners for complete coverage
- MIT licensed - use anywhere
- Works with any LLM provider
- Backed by serious security expertise (ProtectAI → Palo Alto)

**The key insight**: LLM security isn't optional for production. LLM Guard makes it accessible with a simple, modular architecture that can be added to any existing application.

For our repository focused on AI-assisted development, LLM Guard represents the security layer that every production AI system needs. It's the answer to "but what about prompt injection?" and "how do we prevent data leakage?"

---

*Document created: January 2026*
*Sources: [GitHub - protectai/llm-guard](https://github.com/protectai/llm-guard), [ProtectAI](https://protectai.com/), [Palo Alto Networks Acquisition](https://finance.yahoo.com/news/palo-alto-networks-acquires-protect-181130061.html)*
