AI Security
What Is an LLM Guardrail?
- Input checks
- Output checks
- Policy
Short answer
An LLM guardrail is a check that runs before or after a model call to keep inputs and outputs within rules you set. Input guardrails can mask personal data, block secrets or flag injection attempts. Output guardrails can filter unsafe content, validate format or check facts. Guardrails reduce risk, but they don't make a model reliable.
Where do guardrails sit?
Think of a model call as a pipeline: the request goes in, the model runs, the response comes out, maybe a tool gets called, and the loop repeats. A guardrail is any check you insert at one of those points. Most teams start with one or two and add more as they find out what goes wrong in production.
| Stage | Example checks |
|---|---|
| Before the model (input) | Mask personal data, block secrets, reject off-topic requests, flag injection attempts |
| Before a tool runs | Check arguments, require approval for write actions, mask data sent to the tool |
| After a tool runs | Mask personal data in results before the model sees them |
| After the model (output) | Validate JSON against a schema, filter unsafe content, check claims against sources, restore masked values |
What types of guardrails are there?
| Type | What it checks | Usually built with |
|---|---|---|
| PII and PHI masking | Personal and health data in prompts, files and results | Patterns, validators, dictionaries, sometimes ML |
| Secret blocking | API keys, tokens, passwords, private keys | Patterns with known formats |
| Content moderation | Hate, self-harm, sexual content | Classifier models |
| Prompt injection detection | Instructions hidden in input | Classifier models, heuristics |
| Topic restriction | Requests outside the app's purpose | Classifiers or an LLM judge |
| Output validation | Structure, schema, allowed values | Code: JSON schema, regex |
| Grounding checks | Whether the answer is supported by sources | An LLM judge or retrieval comparison |
| Tool policy | Which tools may run, with what arguments | Code and approval workflows |
Deterministic or model-based?
A deterministic guardrail gives the same answer for the same input every time. A model-based one, such as a classifier or an LLM judge, can handle fuzzier questions like "is this off-topic?", but it's slower, it can't always explain its decision, and an attacker can probe it for blind spots.
For data protection, deterministic checks have big advantages. An IBAN either passes mod 97 or it doesn't. A card number either passes Luhn or it doesn't. Maskflare's guardrail is deterministic for identifiers and secrets: 574 detectors and an explain view in the playground that shows why each value matched. It adds about 2 ms median to a 10 KB request with default rules. Names have no checksum, so a local named-entity layer covers them; it runs inside Maskflare, not at a third-party AI service.
Input or output: which guardrails matter more?
It depends on what you're afraid of. If the worry is data leaving, input guardrails matter most, because once a customer's IBAN reaches the provider no output check can take it back. If the worry is what the app says, such as a support bot promising a refund policy you don't have, output checks matter most. Most production apps need both, but in a fixed order of priority: first make sure nothing sensitive goes out, then make sure nothing wrong comes back.
Output guardrails have a data-protection side too. A model can repeat personal data that was in a retrieved document, and an agent's tool results flow straight back into the context. Maskflare masks responses and MCP tool results as well as prompts, and restores masked values only where restoring is switched on for the key.
How do guardrails plug into an existing stack?
- In a gateway: every request through the gateway gets the same checks. See what is an AI gateway.
- In a proxy such as LiteLLM: guardrails run as plugins. Maskflare ships one as
maskflare.integrations.litellm.MaskflareGuardrail. - In code: call an SDK directly where you need fine control, for example to mask a document before chunking it for RAG.
- In agent hooks: coding agents like Claude Code expose hooks that run before and after tool use.
pip install "maskflare[litellm]"
# Then reference this class as a guardrail in your LiteLLM proxy config:
# maskflare.integrations.litellm.MaskflareGuardrailMore in the LiteLLM PII masking guide and the SDK docs.
How do you design a guardrail set?
- List what can go wrong in your app, concretely: "a customer's IBAN reaches the provider", "the bot quotes a refund policy we don't have".
- Match each risk to a stage and a check type from the table above.
- Prefer deterministic checks where the rule is crisp, and model-based ones where it isn't.
- Run new rules in shadow mode first and look at what they would have done.
- Decide the failure mode for each check: block, mask, alert or let through.
- Put rule changes under review. Maskflare supports maker-checker approval, so one person proposes and another approves.
What are the limits of guardrails?
Guardrails catch what they're built to catch. Model-based checks can be bypassed with rephrasing, and deterministic checks miss values that don't fit any pattern. Stacking many checks adds latency and false positives. And be clear about scope: Maskflare covers the data-protection guardrails, masking, redacting and blocking personal data and secrets. It doesn't do content moderation, injection detection or grounding checks, so you'll pair it with other tools for those.
Frequently asked questions
What is an example of an LLM guardrail?
Replacing a customer's email address with a token before the prompt reaches the model, then restoring it in the answer. Or rejecting a response that isn't valid JSON.
Are guardrails the same as content moderation?
Moderation is one type of guardrail. Others cover personal data, secrets, output format, tool use and grounding.
Do guardrails slow down responses?
Deterministic checks are fast; Maskflare adds about 2 ms median with default rules. Checks that call another model add much more.
Can I use Maskflare as a LiteLLM guardrail?
Yes. Install maskflare[litellm] and use the MaskflareGuardrail class in your LiteLLM proxy.
Do guardrails stop hallucinations?
Grounding checks can catch some unsupported answers, but no guardrail makes a model reliably accurate.