AI guardrails
Most guardrails watch the door. These watch what walks back out.
Input guardrails are worth having. Prompt-injection filtering, PII redaction, topic blocking: real protections against a real class of problem, and llm11 does not replace any of them.
They also cannot help with the most common way an LLM feature fails in production, which is a perfectly well-behaved prompt producing a confident, well-formatted, wrong answer. Nothing on the way in sees that coming, because on the way in it has not happened yet.
On the way in
Input guardrails
- Prompt injection and jailbreak attempts
- PII and secrets leaving your systems
- Topics and categories you will not serve
- Token and length ceilings
Keep whatever you already run here. This is a different job.
On the way out
Output verification
- Claims your own sources do not support
- A second model family materially disagreeing
- Schema, format and reference violations
- Answers that change when the model is resampled
A failed check escalates to your strong model automatically, before the response leaves us.
The objection, and the answer to it
Output guardrails have a well-earned reputation for being expensive, because checking an answer properly tends to cost about what generating it did. Most teams switch them on, look at the bill, and switch them back off.
The way out is to spend on checking in proportion to what an answer is worth. A sub-cent triage call decides which checks a request has earned, so the expensive ones run on the small fraction that needs them. Try it.
The request
Short, self-contained, no source material. The common case, and the cheap one.
Criticality
Your policy sets the floor. Triage can raise it, never lower it.
Triage confidence
0.820.3 to 0.7 is the uncertain band.
The ladder
1 of 4 checks running
- 00
Schema and rules
Free, and about a millisecond
Valid JSON when JSON was asked for. URLs that parse. Numbers in the answer that appear in the input. Length and format honoured.
Always runs. Deterministic, free, and never wrong about what it checked.
- 01
Groundedness
Fractions of a cent
Every factual claim in the answer checked against the context you supplied. Anything the context does not support gets flagged.
Skipped: no context was supplied, so there is nothing to check the answer against.
- 02
Cross-model disagreement
One extra completion
A different model family answers the same question independently. Two unrelated models rarely invent the same false detail.
Skipped: this request is not marked critical, so a second full completion is not worth its cost.
- 03
Self-consistency
Three extra completions
The same model is resampled at temperature and the spread is scored. An answer that changes between runs was never settled.
Skipped: reserved for critical requests.
Verification spend on this request
under 1% of the ceiling
The ceiling is all four rungs on every call, which is what a verification product that checks everything would cost you. Most traffic sits at the bottom of that bar, which is the entire point.
Read the limits before you buy.
There are failure modes these checks do not catch, and we would rather you knew which ones now. The scope page is specific about it.