Guardrails

Guardrails wrap the target in classifier models, so you can measure an attack against a defended system rather than a bare model. They are off unless you ask for them.

guardrails

Classifier models that defend the target.

before checks each prompt and blocks an unsafe one before it reaches the target; after checks the reply and withholds an unsafe one. Both fail open: an unavailable or unparseable classifier lets the text through, so a misconfigured guardrail never blocks the whole run. Use this to measure an attack against a defended target.

Field	Type	Default	Description
before	GuardrailModelConfig	unset	Classifier that checks each prompt before it reaches the target.
after	GuardrailModelConfig	unset	Classifier that checks each reply before it is returned.

guardrails.before and guardrails.after

A guardrail: a classifier model that decides whether a text is safe.

Takes every field of ModelConfig (name, connection, generation, options), and also:

Field	Type	Default	Description
system_prompt	string	unset	Replace the classifier's built-in instruction with your own.

Examples

A safety classifier on both sides of the target

guardrails:
  before:
    name: llama-guard3:8b
    connection:
      provider: ollama
      type: OLLAMA
  after:
    name: llama-guard3:8b
    connection:
      provider: ollama
      type: OLLAMA