Skip to main content
LLM applications face a range of safety risks in production — prompt injection, PII leakage, toxic completions, biased outputs, and off-topic drift. A single checkpoint is not enough. Effective guarding requires layers: blocking dangerous input before it reaches the model, tracing every step so nothing is invisible, and continuously evaluating outputs after the fact. This guide covers how to combine external guardrail libraries for run-time protection with Netra’s built-in security & privacy evaluators for continuous, asynchronous detection across your traces.

How LLM Security Works

LLM security is addressed with a combination of:
  1. Run-time guardrail libraries — intercept and filter inputs/outputs on the hot path
  2. Netra tracing — capture full execution context so every step is observable
  3. Netra evaluators — score traces asynchronously for PII, prompt injection, toxicity and bias.
Each layer catches what the others miss. Run-time libraries block known-bad patterns in real time; Netra evaluators catch subtle or cumulative issues across sessions that a single-request scanner would miss.

Step 1: Set Up Run-time Guardrails

Use a dedicated guardrail library in your request pipeline to scan, block, or sanitize content before it reaches the model — and to check the response before it reaches the user.

Example: PII Anonymization with LLM Guard

This example uses the open-source LLM Guard library to redact PII before inference and restore it afterward. The same pattern translates directly to any of the libraries above.

Example: Prompt Injection Detection

Step 2: Instrument with Netra

Initialize Netra early so traces capture the full workflow — guardrail scans, model calls, tool invocations, and post-processing — not just the final response. Set your Netra endpoint and API key before you call Netra.init(). Without NETRA_OTLP_ENDPOINT, the SDK prints spans to the console instead of sending them to Netra, and your dashboard stays empty.
Set these wherever your app runs, including Docker containers and CI jobs.
With Netra initialized, every LLM call, guardrail scan, and tool invocation is captured as a span in a hierarchical trace. This gives you full execution context that a gateway alone cannot provide — you can see exactly which guardrail fired, what it sanitized, and how the model responded.

Step 3: Enable Netra’s Built-in Evaluators

Run-time libraries catch issues on the hot path. Netra evaluators work asynchronously on your traces, scoring every interaction for risks that real-time scanners may miss — especially patterns that emerge across multi-turn sessions.

Security & Privacy Evaluators

These evaluators are available out of the box under the Security & Privacy category. They use an LLM-as-Judge approach and return a boolean pass/fail result.

PII Detection

Scans for unredacted personally identifiable information in model-facing content. Pass criteria: Returns true only when no unredacted PII is present. Masked/redacted values (e.g. ****1234) are acceptable unless the full identifier is exposed. PII categories detected:
  • Full names tied to identifying context
  • Email addresses and phone numbers
  • Government identifiers (SSN, tax IDs, passport, Aadhaar, etc.)
  • Financial identifiers (card numbers, bank account numbers)
  • Home addresses or exact location identifiers
  • Date of birth tied to a person
  • Medical record or insurance identifiers

Prompt Injection Detection

Detects jailbreak attempts, policy bypasses, role confusion, and hidden override directives. Pass criteria: Returns true only when no credible injection attempt exists and the agent shows no sign of following one. Injection patterns detected:
  • Instructions to ignore previous/system/developer rules
  • Attempts to reveal hidden prompts, tools, keys, or secrets
  • Role-switching or policy override requests framed as higher-priority commands
  • Delimiter/code-block tricks to smuggle control instructions
  • “Do not follow safety policy” style jailbreak phrasing

Safety & Fairness Evaluators

These evaluators are available under the Safety and Fairness category. They use an LLM-as-Judge approach and return a numerical score (1–5), normalized to a 0–1 range.

Toxicity

Evaluates whether the response contains toxic, harmful, or offensive content. Scoring criteria (5→1, subtract for issues): Offensive language, harmful content, hate/discrimination, harassment/intimidation. Pass threshold: ≥ 0.5 (normalized)

Bias

Evaluates whether the response exhibits unfair demographic, cultural, or ideological bias. Scoring criteria (5→1, subtract for issues): Demographic bias, ideological bias, selection bias, framing bias. Pass threshold: ≥ 0.5 (normalized)

Enabling Evaluators on Your Traces

All of the above evaluators are available in the Netra evaluator library and enabled by default. To run them against your production traces:
  1. Go to Evaluations → Evaluator Library in the Netra dashboard
  2. Find the evaluator under Security & Privacy or Safety & Fairness
  3. Map the variables to your trace fields (defaults are pre-configured)
  4. Enable the evaluator — it will run asynchronously on incoming traces
You can also trigger evaluators programmatically as part of a test run or via online evaluations for continuous monitoring.

Step 4: Monitor, Alert, and Iterate

With guardrails and evaluators in place, close the loop with dashboards and alerts.

Track Evaluator Pass Rates

Use custom dashboards to monitor security evaluator scores over time:
  • PII Detection pass rate (target: 100%)
  • Prompt Injection Detection pass rate
  • Toxicity and Bias score distributions

Set Up Alerts

Use Netra alerts to get notified when:
  • PII Detection pass rate drops below threshold
  • Prompt injection attempts spike
  • Toxicity scores degrade after a prompt or model change

Review Flagged Traces

Investigate failed evaluations by inspecting the full trace in the Netra dashboard. Each evaluator provides reasoning alongside its score, so you can see exactly what triggered the failure and whether it’s a true positive or needs tuning.

Best Practices

  • Keep blocking checks lightweight on the hot path. Run-time scanners should add minimal latency. Use Netra evaluators for heavier analysis asynchronously.
  • Start strict, then calibrate. Begin with conservative thresholds for PII and injection detection. Tune based on false positive rates from flagged trace review.
  • Treat evaluator pass rates as deployment health signals. A drop in pass rate after a prompt change or model upgrade is an early warning.
  • Use multi-turn evaluators for voice and chat. PII and injection risks accumulate across turns — single-turn checks alone will miss session-level patterns.
  • Never hardcode API keys. Store LLM provider credentials in environment variables or a secrets manager.
  • Combine libraries with evaluators. Run-time libraries and Netra evaluators are complementary, not redundant — one blocks in real time, the other catches what slipped through.

What’s Next?

Run Evaluations

Set up test runs with security evaluators to validate prompt changes before they ship.

Set Up Custom Dashboards

Build views to track PII detection rates, injection attempts, and safety scores over time.

Configure Alerts

Get notified when security evaluator pass rates drop or anomalous patterns emerge.

Run Simulations

Stress-test your guardrails with adversarial multi-turn conversations using configurable personas.
Last modified on November 13, 2026