# LLM Guard

**Category:** Enterprise Security & Guardrails
**Website:** https://protectai.com/llm-guard
**GitHub:** https://github.com/protectai/llm-guard
**Pricing:** Open Source
**Listing status:** verified
**Canonical:** https://aicompliance.ai/tools/llm-guard

**Compliance badges:** OWASP LLM Top 10
**Target frameworks:** GDPR

## Summary

Archived open-source toolkit of 35+ input/output scanners. Read-only since Jul 2026 after Palo Alto Networks folded Protect AI into Prisma AIRS.

## TL;DR

- Widest scanner selection in open source — one dependency covers PII, secrets, toxicity, bias, and injection checks.
- Fully self-hosted: the choice when data cannot leave your environment, at the cost of owning latency and tuning.
- Backed by Palo Alto Networks (via Protect AI) since 2025 — maintenance risk is low.
- Calibrate scanner thresholds against real traffic; defaults are starting points, not policy.

## Overview

LLM Guard is the utility knife of the open-source stack: 35+ scanners you chain into whatever sanitization pipeline your threat model needs — PII, secrets, toxicity, bias, code detection, injection heuristics — all running in your infrastructure with zero data egress. The Protect AI acquisition by Palo Alto Networks in 2025 put a major vendor behind its maintenance without closing the source.

The trade-off is operational: you own model downloads, latency tuning, and scanner threshold calibration. Teams that underinvest in calibration get either alert fatigue or silent gaps; the scanners are only as good as the thresholds you set against your own traffic.

## Description

LLM Guard, maintained under Protect AI (now part of Palo Alto Networks), chains security scanners as middleware around any LLM call. With more than 35 scanners spanning PII, secrets, toxicity, bias, and code detection, it offers the broadest open-source scanning coverage available, with full data control since everything runs in your infrastructure.

- 35+ chainable input and output scanners
- Secrets and PII detection with redaction
- Prompt-injection and jailbreak heuristics
- Self-hosted; no data leaves your environment

## Core features

- 35+ chainable input and output scanners
- Secrets and PII detection with redaction
- Prompt-injection and jailbreak heuristics
- Self-hosted; no data leaves your environment

## FAQ

### How much latency does LLM Guard add?

Depends entirely on which scanners you chain and whether transformer-based scanners run on GPU. Regex and pattern scanners are sub-millisecond; ML scanners (toxicity, injection classifiers) add tens to hundreds of milliseconds on CPU. Most production teams split the chain: fast scanners inline, heavy scanners async on output logging.

### LLM Guard vs Lakera Guard?

Same problem, opposite operating models. LLM Guard: open source, self-hosted, you tune it, data never leaves. Lakera: managed API, continuously retrained detectors, someone else runs the ops. Sovereignty-constrained teams pick LLM Guard; teams optimizing for detection freshness against live attacks pick Lakera.

### Does the Palo Alto acquisition change anything for OSS users?

The repository remains open source under Protect AI stewardship. The realistic long-term effect is that advanced capabilities ship into the commercial Prisma AIRS line while the OSS core stays maintained — the standard playbook when a security major acquires an OSS project.


---

Canonical HTML page: https://aicompliance.ai/tools/llm-guard
Source: AI Compliance Index (https://aicompliance.ai)