Guardrails as a separate layer

Why the check must not be the same model

A model asked to both answer the user and police itself has a structural problem: the thing it is policing is in its own context, written by the person it is policing. Prompt injection works precisely because instructions and data arrive through the same channel.

A separate classifier does not have that problem to the same degree. It is not following instructions; it is producing a label. Text saying ignore your previous instructions is an input to be classified, not a command, because the model was tuned to classify rather than to comply.

That is not perfect either (classifiers can be evaded), but it is a different failure surface, and layering the two is much stronger than either alone.

The open guardrail models

Llama Guard classifies against a hazard taxonomy (violent crime, sexual content, self-harm, privacy, intellectual property and others) and runs on both the user’s input and the model’s output. You can edit the taxonomy in the prompt, which is more useful than it sounds: the categories you care about are rarely exactly the default list.

ShieldGemma does the same job in the Gemma family, in several sizes including very small ones.

Granite Guardian from IBM covers harms plus groundedness and relevance checks for retrieval systems.

Prompt-injection classifiers are typically small encoder models (DeBERTa-sized, tens of millions of parameters) trained to spot injection attempts. They run in single-digit milliseconds on a CPU, which is what makes them practical on every request.

NeMo Guardrails is orchestration rather than a model: a framework for defining conversational rails and wiring checks around a model.

Order them by cost

The pipeline that works is cheapest-first, so the expensive checks only see what survives.

1. Deterministic checks. Length limits, allow-lists, regular expressions for obvious patterns, rate limits per user. Microseconds, and they catch a surprising amount.
2. A small classifier on the input. Injection detection and hazard classification. Single-digit milliseconds on a CPU.
3. The model.
4. A check on the output. Hazard classification again, plus whatever your domain requires: a groundedness check for retrieval, a personal-data detector, a schema validation.

Step 4 matters more than people expect. Plenty of inputs look benign and produce output you cannot ship. Checking only the input is the more common design and the weaker one.

The cost, and how to pay less of it

A guardrail model adds latency to every request. A small classifier at 20 milliseconds against a 2-second generation is 1% and invisible. A large guardrail model doing a full generation to produce a verdict can add hundreds of milliseconds twice, which is a product decision rather than a technical one.

Two mitigations. Run the output check concurrently with streaming and be prepared to withdraw the response: this is what most production systems do. And use the smallest classifier that hits your target, measured on your own inputs rather than on the published numbers.

False positives are the expensive failure

A guardrail that blocks legitimate requests fails your users silently. They do not report it; they leave. Measure both directions, on your own data:

• False negatives: attempts that got through. Collect them from red-teaming and from incidents.
• False positives: the false-refusal set from the previous lesson, run through the guardrail rather than the model.

Report both numbers together and tune the threshold to a ratio you chose deliberately, not to whatever the default was.

What no guardrail gives you

Robustness against a determined adversary. Every published classifier has been evaded, and evasion techniques circulate quickly. Layered defence lowers the rate of successful attacks; it does not make the risk zero.

The design consequence is architectural rather than model-shaped: do not put a language model where a successful attack causes irreversible harm. No amount of classification makes it safe to let a model, on its own, send money, delete data, or publish to the world. Keep a person or a deterministic rule in the path of any action you cannot undo.