LLM Guard
Open SourceEnterprise Security & GuardrailsArchived open-source toolkit of 35+ input/output scanners. Read-only since Jul 2026 after Palo Alto Networks folded Protect AI into Prisma AIRS.
Last verified
editorial take
LLM Guard is the utility knife of the open-source stack: 35+ scanners you chain into whatever sanitization pipeline your threat model needs — PII, secrets, toxicity, bias, code detection, injection heuristics — all running in your infrastructure with zero data egress. The Protect AI acquisition by Palo Alto Networks in 2025 put a major vendor behind its maintenance without closing the source.
The trade-off is operational: you own model downloads, latency tuning, and scanner threshold calibration. Teams that underinvest in calibration get either alert fatigue or silent gaps; the scanners are only as good as the thresholds you set against your own traffic.
overview
LLM Guard, maintained under Protect AI (now part of Palo Alto Networks), chains security scanners as middleware around any LLM call. With more than 35 scanners spanning PII, secrets, toxicity, bias, and code detection, it offers the broadest open-source scanning coverage available, with full data control since everything runs in your infrastructure.
- 35+ chainable input and output scanners - Secrets and PII detection with redaction - Prompt-injection and jailbreak heuristics - Self-hosted; no data leaves your environment
core features
- 35+ chainable input and output scanners
- Secrets and PII detection with redaction
- Prompt-injection and jailbreak heuristics
- Self-hosted; no data leaves your environment
target frameworks
faq
LLM Guard — frequently asked questions
- How much latency does LLM Guard add?
- Depends entirely on which scanners you chain and whether transformer-based scanners run on GPU. Regex and pattern scanners are sub-millisecond; ML scanners (toxicity, injection classifiers) add tens to hundreds of milliseconds on CPU. Most production teams split the chain: fast scanners inline, heavy scanners async on output logging.
- LLM Guard vs Lakera Guard?
- Same problem, opposite operating models. LLM Guard: open source, self-hosted, you tune it, data never leaves. Lakera: managed API, continuously retrained detectors, someone else runs the ops. Sovereignty-constrained teams pick LLM Guard; teams optimizing for detection freshness against live attacks pick Lakera.
- Does the Palo Alto acquisition change anything for OSS users?
- The repository remains open source under Protect AI stewardship. The realistic long-term effect is that advanced capabilities ship into the commercial Prisma AIRS line while the OSS core stays maintained — the standard playbook when a security major acquires an OSS project.