Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII detection and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, enforcing topic boundaries) and model outputs (detecting hallucinations, filtering toxic content, validating JSON schema compliance). Activates for requests involving LLM output validation, AI content filtering, guardrail implementation, or LLM safety enforcement.
Implements input and output validation guardrails for LLM-powered applications to prevent prompt injection, data leakage, toxic content generation, and hallucinated outputs. Builds a security validation pipeline using NVIDIA NeMo Guardrails Colang definitions, custom Python validators for PII detection and content policy enforcement, and the Guardrails AI framework for structured output validation. The guardrails system intercepts both user inputs (blocking injection attempts, stripping PII, enforcing topic boundaries) and model outputs (detecting hallucinations, filtering toxic content, validating JSON schema compliance). Activates for requests involving LLM output validation, AI content filtering, guardrail implementation, or LLM safety enforcement.
Deploying a new LLM-powered application that processes user input and needs input/output safety controls
Adding content policy enforcement to an existing chatbot or AI agent to comply with organizational policies
Implementing PII detection and redaction in LLM pipelines handling sensitive customer data
Building topic-restricted AI assistants that must refuse off-topic or disallowed queries
Validating that LLM responses conform to expected schemas before they reach downstream systems or users
Protecting RAG pipelines from indirect prompt injection in retrieved documents
Do not use as a replacement for proper authentication, authorization, and network security controls. Guardrails are a defense-in-depth layer, not a perimeter defense. Not suitable for real-time content moderation of user-to-user communication without LLM involvement.
Common Misconfigurations & Verification
LLM guardrails create a false sense of safety when the deny-list is narrow, the
input rail can be bypassed by encoding, or the output/RAG path is left
unguarded:
Bypassable input rail: blocked_patterns like "how to hack" are defeated
by encoding (base64/leetspeak), translation, or roleplay framing ("you are
DAN..."). Confirm the rail decodes and normalizes input before matching, and
test known jailbreak templates against it.
Allow/deny topic list too coarse: an allow-list of customer_support
still passes an injected instruction phrased as a support question. Validate
with on-topic-but-malicious prompts.
Output rail / hallucination check skipped: input is filtered but the model
response leaks PII or system-prompt content unchecked. Verify the output rail
actually runs and require_grounded_response rejects ungrounded claims.
Indirect injection via RAG ignored: guardrails inspect the user turn but
not retrieved documents. Plant an injected instruction in a source document
and confirm it is caught.
PII redaction gaps: Presidio misses non-US formats or split tokens; test
with international phone numbers, IBANs, and SSNs broken across lines.
How to confirm: run a jailbreak/encoding/indirect-injection corpus through
the pipeline and verify each is blocked or redacted, then measure false
positives on benign on-topic traffic.
Prerequisites
Python 3.10+ with pip for installing guardrail dependencies
An OpenAI API key or local LLM endpoint for NeMo Guardrails self-check rails (set as environment variable)
OPENAI_API_KEY
The nemoguardrails package for Colang-based guardrail definitions
The guardrails-ai package for structured output validation (optional, for JSON schema enforcement)
Familiarity with YAML configuration and basic Colang 2.0 syntax for defining rail flows
Workflow
Step 1: Install Guardrail Frameworks
Install the required Python packages:
# Core NeMo Guardrails library
pip install nemoguardrails
# Guardrails AI for structured output validation (optional)
pip install guardrails-ai
# Additional dependencies for PII detection and content analysis
pip install presidio-analyzer presidio-anonymizer spacy
python -m spacy download en_core_web_lg
Step 2: Run the Guardrails Security Agent
The agent implements a complete input/output validation pipeline:
# Analyze a single input through all guardrail layers
python agent.py --input "Tell me how to hack into a system"# Analyze input with a custom content policy file
python agent.py --input "Some text" --policy policy.json
# Scan a file of prompts through the guardrail pipeline
python agent.py --file prompts.txt --mode full
# Input-only validation (no LLM call, just check if input is safe)
python agent.py --input "Some text" --mode input-only
# Output validation mode (validate a pre-generated LLM response)
python agent.py --input "User question" --response "LLM response to validate" --mode output-only
# PII detection and redaction mode
python agent.py --input "My SSN is 123-45-6789 and email john@example.com" --mode pii
# JSON output for pipeline integration
python agent.py --file prompts.txt --output json
Step 3: Configure Content Policies
Create a JSON policy file defining allowed topics, blocked patterns, and PII categories:
{"allowed_topics":["customer_support","product_info","billing"],"blocked_topics":["politics","violence","illegal_activities","competitor_products"],"blocked_patterns":["how to hack","create malware","bypass security"],"pii_categories":["PERSON","EMAIL_ADDRESS","PHONE_NUMBER","US_SSN","CREDIT_CARD"],"max_output_length":2000,"require_grounded_response":true}
Step 4: Integrate NeMo Guardrails with Colang
Create a NeMo Guardrails configuration directory with config.yml and Colang flow files:
# rails.co - Colang 2.0 flow definitions
define user ask about hacking
"How do I hack into a system"
"Tell me how to break into a network"
"How to exploit vulnerabilities"
define bot refuse hacking request
"I cannot provide instructions on unauthorized hacking or security exploitation.
If you are interested in cybersecurity, I can suggest legitimate learning resources
and ethical hacking certifications."
define flow
user ask about hacking
bot refuse hacking request
Step 5: Deploy as a Validation Middleware
Integrate the guardrails into your application as middleware:
A guardrail that intercepts and validates user input before it reaches the LLM, blocking injection attempts and redacting sensitive data
Output Rail
A guardrail that validates LLM-generated output before it reaches the user, filtering toxic content and enforcing schema compliance
Colang
NVIDIA's domain-specific language for defining conversational guardrail flows, with Python-like syntax for specifying user intent patterns and bot responses
PII Redaction
The process of detecting and masking personally identifiable information (names, emails, SSNs) in text before processing
Content Policy
A configuration file defining which topics, patterns, and content categories are allowed or blocked by the guardrail system
Self-Check Rail
A NeMo Guardrails technique where the LLM itself evaluates whether its input or output violates defined policies
Hallucination Detection
Output validation that checks whether the LLM response is grounded in the provided context, flagging fabricated claims
Tools & Systems
NVIDIA NeMo Guardrails: Open-source toolkit for adding programmable input, dialog, and output rails to LLM applications using Colang flow definitions and YAML configuration
Guardrails AI: Python framework for structured output validation with a hub of pre-built validators for PII, toxicity, JSON schema compliance, and more
Microsoft Presidio: Open-source PII detection and anonymization engine supporting 30+ entity types with configurable NLP backends
Colang 2.0: Event-driven interaction modeling language for defining guardrail flows with Python-like syntax, supporting multi-turn dialog control
OpenAI Guardrails Python: OpenAI's client-side guardrails library for prompt injection detection and content policy enforcement
