How LLM Security Works
LLM security is addressed with a combination of:- Run-time guardrail libraries — intercept and filter inputs/outputs on the hot path
- Netra tracing — capture full execution context so every step is observable
- Netra evaluators — score traces asynchronously for PII, prompt injection, toxicity and bias.
Step 1: Set Up Run-time Guardrails
Use a dedicated guardrail library in your request pipeline to scan, block, or sanitize content before it reaches the model — and to check the response before it reaches the user.Popular Libraries
Example: PII Anonymization with LLM Guard
This example uses the open-source LLM Guard library to redact PII before inference and restore it afterward. The same pattern translates directly to any of the libraries above.Example: Prompt Injection Detection
Step 2: Instrument with Netra
Initialize Netra early so traces capture the full workflow — guardrail scans, model calls, tool invocations, and post-processing — not just the final response. Set your Netra endpoint and API key before you callNetra.init(). Without NETRA_OTLP_ENDPOINT, the SDK prints spans to the console instead of sending them to Netra, and your dashboard stays empty.
Step 3: Enable Netra’s Built-in Evaluators
Run-time libraries catch issues on the hot path. Netra evaluators work asynchronously on your traces, scoring every interaction for risks that real-time scanners may miss — especially patterns that emerge across multi-turn sessions.Security & Privacy Evaluators
These evaluators are available out of the box under the Security & Privacy category. They use an LLM-as-Judge approach and return a boolean pass/fail result.PII Detection
Scans for unredacted personally identifiable information in model-facing content.
Pass criteria: Returns
true only when no unredacted PII is present. Masked/redacted values (e.g. ****1234) are acceptable unless the full identifier is exposed.
PII categories detected:
- Full names tied to identifying context
- Email addresses and phone numbers
- Government identifiers (SSN, tax IDs, passport, Aadhaar, etc.)
- Financial identifiers (card numbers, bank account numbers)
- Home addresses or exact location identifiers
- Date of birth tied to a person
- Medical record or insurance identifiers
Prompt Injection Detection
Detects jailbreak attempts, policy bypasses, role confusion, and hidden override directives.
Pass criteria: Returns
true only when no credible injection attempt exists and the agent shows no sign of following one.
Injection patterns detected:
- Instructions to ignore previous/system/developer rules
- Attempts to reveal hidden prompts, tools, keys, or secrets
- Role-switching or policy override requests framed as higher-priority commands
- Delimiter/code-block tricks to smuggle control instructions
- “Do not follow safety policy” style jailbreak phrasing
Safety & Fairness Evaluators
These evaluators are available under the Safety and Fairness category. They use an LLM-as-Judge approach and return a numerical score (1–5), normalized to a 0–1 range.Toxicity
Evaluates whether the response contains toxic, harmful, or offensive content.
Scoring criteria (5→1, subtract for issues): Offensive language, harmful content, hate/discrimination, harassment/intimidation.
Pass threshold: ≥ 0.5 (normalized)
Bias
Evaluates whether the response exhibits unfair demographic, cultural, or ideological bias.
Scoring criteria (5→1, subtract for issues): Demographic bias, ideological bias, selection bias, framing bias.
Pass threshold: ≥ 0.5 (normalized)
Enabling Evaluators on Your Traces
All of the above evaluators are available in the Netra evaluator library and enabled by default. To run them against your production traces:- Go to Evaluations → Evaluator Library in the Netra dashboard
- Find the evaluator under Security & Privacy or Safety & Fairness
- Map the variables to your trace fields (defaults are pre-configured)
- Enable the evaluator — it will run asynchronously on incoming traces
Step 4: Monitor, Alert, and Iterate
With guardrails and evaluators in place, close the loop with dashboards and alerts.Track Evaluator Pass Rates
Use custom dashboards to monitor security evaluator scores over time:- PII Detection pass rate (target: 100%)
- Prompt Injection Detection pass rate
- Toxicity and Bias score distributions
Set Up Alerts
Use Netra alerts to get notified when:- PII Detection pass rate drops below threshold
- Prompt injection attempts spike
- Toxicity scores degrade after a prompt or model change
Review Flagged Traces
Investigate failed evaluations by inspecting the full trace in the Netra dashboard. Each evaluator provides reasoning alongside its score, so you can see exactly what triggered the failure and whether it’s a true positive or needs tuning.Best Practices
- Keep blocking checks lightweight on the hot path. Run-time scanners should add minimal latency. Use Netra evaluators for heavier analysis asynchronously.
- Start strict, then calibrate. Begin with conservative thresholds for PII and injection detection. Tune based on false positive rates from flagged trace review.
- Treat evaluator pass rates as deployment health signals. A drop in pass rate after a prompt change or model upgrade is an early warning.
- Use multi-turn evaluators for voice and chat. PII and injection risks accumulate across turns — single-turn checks alone will miss session-level patterns.
- Never hardcode API keys. Store LLM provider credentials in environment variables or a secrets manager.
- Combine libraries with evaluators. Run-time libraries and Netra evaluators are complementary, not redundant — one blocks in real time, the other catches what slipped through.
What’s Next?
Run Evaluations
Set up test runs with security evaluators to validate prompt changes before they ship.
Set Up Custom Dashboards
Build views to track PII detection rates, injection attempts, and safety scores over time.
Configure Alerts
Get notified when security evaluator pass rates drop or anomalous patterns emerge.
Run Simulations
Stress-test your guardrails with adversarial multi-turn conversations using configurable personas.
