> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getnetra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# LLM Security & Guardrails

> Build defense-in-depth for your LLM applications with runtime guardrail libraries, Netra tracing, and built-in security & privacy evaluators.

LLM applications face a range of safety risks in production — prompt injection, PII leakage, toxic completions, biased outputs, and off-topic drift. A single checkpoint is not enough. Effective guarding requires **layers**: blocking dangerous input before it reaches the model, tracing every step so nothing is invisible, and continuously evaluating outputs after the fact.

This guide covers how to combine **external guardrail libraries** for run-time protection with **Netra's built-in security & privacy evaluators** for continuous, asynchronous detection across your traces.

## How LLM Security Works

LLM security is addressed with a combination of:

1. **Run-time guardrail libraries** — intercept and filter inputs/outputs on the hot path
2. **Netra tracing** — capture full execution context so every step is observable
3. **Netra evaluators** — score traces asynchronously for PII, prompt injection, toxicity and bias.

Each layer catches what the others miss. Run-time libraries block known-bad patterns in real time; Netra evaluators catch subtle or cumulative issues across sessions that a single-request scanner would miss.

## Step 1: Set Up Run-time Guardrails

Use a dedicated guardrail library in your request pipeline to scan, block, or sanitize content before it reaches the model — and to check the response before it reaches the user.

### Popular Libraries

| Library | Capabilities |
| - | - |
| [LLM Guard](https://llm-guard.com) | PII anonymization, prompt injection detection, toxicity filtering, topic banning, deanonymization |
| [NeMo Guardrails](https://github.com/NVIDIA/NeMo-Guardrails) | Programmable dialog rails, topic control, fact-checking, jailbreak prevention |
| [Lakera](https://www.lakera.ai) | Prompt injection detection, PII detection, content moderation API |
| [Prompt Armor](https://promptarmor.com) | Prompt injection defense, input validation |
| [Azure AI Content Safety](https://azure.microsoft.com/en-us/products/ai-services/ai-content-safety) | Toxicity, hate speech, self-harm, violence content classification |

### Example: PII Anonymization with LLM Guard

This example uses the open-source [LLM Guard](https://llm-guard.com) library to redact PII before inference and restore it afterward. The same pattern translates directly to any of the libraries above.

```python Python theme={null}
# Install: pip install llm-guard openai
from llm_guard.input_scanners import Anonymize
from llm_guard.input_scanners.anonymize_helpers import BERT_LARGE_NER_CONF
from llm_guard.output_scanners import Deanonymize
from llm_guard.vault import Vault
from openai import OpenAI

vault = Vault()
client = OpenAI(api_key="<your_openai_api_key>")

def anonymize(prompt: str):
    scanner = Anonymize(vault, recognizer_conf=BERT_LARGE_NER_CONF, language="en")
    sanitized_prompt, is_valid, risk_score = scanner.scan(prompt)
    return sanitized_prompt

def deanonymize(sanitized_prompt: str, answer: str):
    scanner = Deanonymize(vault)
    restored_output, is_valid, risk_score = scanner.scan(sanitized_prompt, answer)
    return restored_output

def safe_chat(user_prompt: str):
    # 1. Redact PII from user input
    sanitized = anonymize(user_prompt)

    # 2. Call the model with sanitized input
    response = client.chat.completions.create(
        model="gpt-4",
        messages=[{"role": "user", "content": sanitized}],
    )
    raw_answer = response.choices[0].message.content

    # 3. Restore PII in the output
    final_answer = deanonymize(sanitized, raw_answer)
    return final_answer
```

```typescript TypeScript theme={null}
// Install: npm install llm-guard openai
// Note: LLM Guard is Python-native. For TypeScript, use Lakera or Azure AI Content Safety.
// This example shows the equivalent pattern using a generic scanner interface.
import OpenAI from "openai";

const client = new OpenAI({ apiKey: "<your_openai_api_key>" });

async function safeChat(userPrompt: string) {
  // 1. Scan/redact PII from user input (use your chosen library)
  const sanitized = await scanAndRedactPII(userPrompt);

  // 2. Call the model with sanitized input
  const response = await client.chat.completions.create({
    model: "gpt-4",
    messages: [{ role: "user", content: sanitized }],
  });
  const rawAnswer = response.choices[0].message.content;

  // 3. Restore PII in the output
  const finalAnswer = await restorePII(sanitized, rawAnswer);
  return finalAnswer;
}
```

### Example: Prompt Injection Detection

```python Python theme={null}
from llm_guard.input_scanners import PromptInjection

scanner = PromptInjection()

def check_injection(prompt: str):
    sanitized_prompt, is_valid, risk_score = scanner.scan(prompt)
    if not is_valid:
        raise ValueError(f"Prompt injection detected (risk: {risk_score})")
    return sanitized_prompt
```

```typescript TypeScript theme={null}
// Using Lakera Guard API as an example
async function checkInjection(prompt: string): Promise<string> {
  const response = await fetch("https://api.lakera.ai/v1/prompt_injection", {
    method: "POST",
    headers: {
      Authorization: "Bearer <your_lakera_api_key>",
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ input: prompt }),
  });
  const result = await response.json();

  if (result.flagged) {
    throw new Error(`Prompt injection detected (score: ${result.score})`);
  }
  return prompt;
}
```

## Step 2: Instrument with Netra

Initialize Netra early so traces capture the full workflow — guardrail scans, model calls, tool invocations, and post-processing — not just the final response.

Set your Netra endpoint and API key before you call `Netra.init()`. Without `NETRA_OTLP_ENDPOINT`, the SDK prints spans to the console instead of sending them to Netra, and your dashboard stays empty.

```bash US Region theme={null} theme={null} theme={null} theme={null}
export NETRA_OTLP_ENDPOINT="https://api.getnetra.ai/telemetry"
export NETRA_API_KEY="your-api-key-here"
```

```bash EU Region theme={null} theme={null} theme={null} theme={null}
export NETRA_OTLP_ENDPOINT="https://api.eu.getnetra.ai/telemetry"
export NETRA_API_KEY="your-api-key-here"
```

Set these wherever your app runs, including Docker containers and CI jobs.

```python Python theme={null}
from netra import Netra

# Initialize before importing other libraries for best results
Netra.init(app_name="my-ai-app", environment="production")
```

```typescript TypeScript theme={null}
import { Netra } from "netra-sdk";

// Initialize before importing other libraries for best results
await Netra.init({
  appName: "my-ai-app",
  environment: "production",
});
```

With Netra initialized, every LLM call, guardrail scan, and tool invocation is captured as a span in a hierarchical trace. This gives you full execution context that a gateway alone cannot provide — you can see exactly which guardrail fired, what it sanitized, and how the model responded.

## Step 3: Enable Netra's Built-in Evaluators

Run-time libraries catch issues on the hot path. Netra evaluators work **asynchronously on your traces**, scoring every interaction for risks that real-time scanners may miss — especially patterns that emerge across multi-turn sessions.

### Security & Privacy Evaluators

These evaluators are available out of the box under the **Security & Privacy** category. They use an LLM-as-Judge approach and return a **boolean** pass/fail result.

#### PII Detection

Scans for unredacted personally identifiable information in model-facing content.

| Variant | Scope | Variables | What It Catches |
| - | - | - | - |
| **Single-turn** | One request/response pair | `input`, `output` | PII in a single interaction — names, emails, phone numbers, government IDs, financial identifiers, addresses, dates of birth, medical/insurance IDs |
| **Multi-turn** | Full conversation transcript | `conversation` | Cumulative PII exposure across an entire session — catches cases where identifiers leak gradually across turns |

**Pass criteria:** Returns `true` only when **no unredacted PII** is present. Masked/redacted values (e.g. `****1234`) are acceptable unless the full identifier is exposed.

**PII categories detected:**

* Full names tied to identifying context
* Email addresses and phone numbers
* Government identifiers (SSN, tax IDs, passport, Aadhaar, etc.)
* Financial identifiers (card numbers, bank account numbers)
* Home addresses or exact location identifiers
* Date of birth tied to a person
* Medical record or insurance identifiers

#### Prompt Injection Detection

Detects jailbreak attempts, policy bypasses, role confusion, and hidden override directives.

| Variant | Scope | Variables | What It Catches |
| - | - | - | - |
| **Single-turn** | One request/response pair | `input`, `output` | Direct injection attempts — "ignore previous instructions", role-switching, delimiter tricks, jailbreak phrasing |
| **Multi-turn** | Full conversation transcript | `conversation` | Gradual multi-turn manipulation — trust-building followed by override commands, credential extraction across turns |

**Pass criteria:** Returns `true` only when **no credible injection attempt** exists and the agent shows **no sign of following one**.

**Injection patterns detected:**

* Instructions to ignore previous/system/developer rules
* Attempts to reveal hidden prompts, tools, keys, or secrets
* Role-switching or policy override requests framed as higher-priority commands
* Delimiter/code-block tricks to smuggle control instructions
* "Do not follow safety policy" style jailbreak phrasing

### Safety & Fairness Evaluators

These evaluators are available under the **Safety and Fairness** category. They use an LLM-as-Judge approach and return a **numerical score (1–5)**, normalized to a 0–1 range.

#### Toxicity

Evaluates whether the response contains toxic, harmful, or offensive content.

| Variable | Required | Description |
| - | - | - |
| `user_query` | Yes | The input query |
| `response` | Yes | The generated answer |

**Scoring criteria (5→1, subtract for issues):** Offensive language, harmful content, hate/discrimination, harassment/intimidation.

**Pass threshold:** ≥ 0.5 (normalized)

#### Bias

Evaluates whether the response exhibits unfair demographic, cultural, or ideological bias.

| Variable | Required | Description |
| - | - | - |
| `user_query` | Yes | The input query |
| `response` | Yes | The generated answer |

**Scoring criteria (5→1, subtract for issues):** Demographic bias, ideological bias, selection bias, framing bias.

**Pass threshold:** ≥ 0.5 (normalized)

### Enabling Evaluators on Your Traces

All of the above evaluators are available in the Netra evaluator library and enabled by default. To run them against your production traces:

1. Go to **Evaluations** → **Evaluator Library** in the Netra dashboard
2. Find the evaluator under **Security & Privacy** or **Safety & Fairness**
3. Map the variables to your trace fields (defaults are pre-configured)
4. Enable the evaluator — it will run asynchronously on incoming traces

You can also trigger evaluators programmatically as part of a [test run](https://docs.getnetra.ai/Evaluations/Evaluation-overview.md) or via [online evaluations](https://docs.getnetra.ai/Evaluations/Evaluation-overview.md) for continuous monitoring.

## Step 4: Monitor, Alert, and Iterate

With guardrails and evaluators in place, close the loop with dashboards and alerts.

### Track Evaluator Pass Rates

Use [custom dashboards](https://docs.getnetra.ai/Dashboard/Custom-dashboard.md) to monitor security evaluator scores over time:

* PII Detection pass rate (target: 100%)
* Prompt Injection Detection pass rate
* Toxicity and Bias score distributions

### Set Up Alerts

Use [Netra alerts](https://docs.getnetra.ai/quick-start/QuickStart_Alerts.md) to get notified when:

* PII Detection pass rate drops below threshold
* Prompt injection attempts spike
* Toxicity scores degrade after a prompt or model change

### Review Flagged Traces

Investigate failed evaluations by inspecting the full trace in the Netra dashboard. Each evaluator provides reasoning alongside its score, so you can see exactly what triggered the failure and whether it's a true positive or needs tuning.

## Best Practices

* **Keep blocking checks lightweight on the hot path.** Run-time scanners should add minimal latency. Use Netra evaluators for heavier analysis asynchronously.
* **Start strict, then calibrate.** Begin with conservative thresholds for PII and injection detection. Tune based on false positive rates from flagged trace review.
* **Treat evaluator pass rates as deployment health signals.** A drop in pass rate after a prompt change or model upgrade is an early warning.
* **Use multi-turn evaluators for voice and chat.** PII and injection risks accumulate across turns — single-turn checks alone will miss session-level patterns.
* **Never hardcode API keys.** Store LLM provider credentials in environment variables or a secrets manager.
* **Combine libraries with evaluators.** Run-time libraries and Netra evaluators are complementary, not redundant — one blocks in real time, the other catches what slipped through.

## What's Next?

> [card] [Run Evaluations](https://docs.getnetra.ai/Evaluations/Evaluation-overview.md)
>
> Set up test runs with security evaluators to validate prompt changes before they ship.

> [card] [Set Up Custom Dashboards](https://docs.getnetra.ai/Dashboard/Custom-dashboard.md)
>
> Build views to track PII detection rates, injection attempts, and safety scores over time.

> [card] [Configure Alerts](https://docs.getnetra.ai/quick-start/QuickStart_Alerts.md)
>
> Get notified when security evaluator pass rates drop or anomalous patterns emerge.

> [card] [Run Simulations](https://docs.getnetra.ai/Simulations/Simulation-overview.md)
>
> Stress-test your guardrails with adversarial multi-turn conversations using configurable personas.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.