What are guardrails?
Guardrails are protective mechanisms that increase the likelihood of an AI system behaving appropriately and as intended. We use the term to refer specifically to separate components from the LLM itself — components that filter or adjust harmful or undesired content before it is generated by the LLM or returned to the user.
Prompts first pass through an input guardrail before being sent to the LLM. The output from the LLM passes through an output guardrail before being returned to the user. While LLMs may have built-in safety from training and API providers may apply their own guardrails on prompts, application-layer guardrails build on top of these for both performance and flexibility.
Guardrails can be as simple as a keyword check, but modern implementations typically incorporate machine learning to capture semantics and are multi-layered for robustness.
Types of guardrails
Guardrails can be implemented using different approaches, each with distinct trade-offs:
| Type | Description |
|---|---|
| Rule-based | Pattern matching using keywords, regex, exact matches, or predefined rules Pros: Fast, cheap to run, no model needed, easy to implement and debug Cons: Cannot capture semantic meaning, high false positives, easily bypassed |
| Machine learning model | Trained classifiers (e.g., decision trees, neural networks) that detect content based on learned patterns Pros: Captures semantic meaning, better accuracy than rule-based checks, faster inference than LLMs, economical to host, configurable thresholds for precision/recall trade-offs Cons: Requires training data and expertise, may need fine-tuning for new domains |
| Large language model | Using a large language model to classify content as acceptable or not Pros: Highly flexible, can understand complex context, explainable reasoning, minimal setup needed Cons: Slower inference, more expensive to run, higher latency, binary yes/no output without calibrated confidence scores |
Guardrails can be thought of as binary classification: is the content acceptable or not? Standard classification metrics — precision, recall, F1 score, ROC-AUC, PR-AUC — applies.
Common risk types
These are common risks that AI applications face. Most can be mitigated by applying input and/or output guardrails.
| Type | Description | Input | Output |
|---|---|---|---|
| Toxicity / content moderation | Harmful, offensive, or inappropriate content | ✓ | ✓ |
| Jailbreak / prompt injection | Attempts to bypass system constraints or inject malicious prompts | ✓ | |
| PII | Information that can identify an individual | ✓ | ✓ |
| Off-topic | Content irrelevant to the AI system's purpose | ✓ | ✓ |
| System-prompt leakage | Exposure of system prompts containing information about the AI system | ✓ | |
| Hallucination | Content not factual or grounded in source material | ✓ |
Principles for effective guardrails
1. Performant, localised, and fast
Performance involves an inherent trade-off between false positives and false negatives — the precision-vs-recall trade-off. If the guardrail is too strict, harmless content gets flagged; too lenient, harmful content slips through.
Performance improves with a multi-layered approach. Each guardrail is like a slice of Swiss cheese; the holes represent weaknesses. Stacking guardrails covers each other's gaps.
If your system can accommodate multiple guardrails, prioritise precision per guardrail and let stacking raise overall recall.
Performance also requires localisation. A content moderation guardrail trained on the open internet may not classify Singapore-specific terms accurately. Beyond language and culture, business-context localisation matters too — terminology specific to one industry may not apply to another.
The final trade-off is between accuracy and latency. Guardrails should run efficiently to keep the user experience smooth.
LionGuard is a content moderation guardrail localised to the Singapore context. See the LionGuard tool page for details.
2. Model-agnostic design
Guardrails are separate components from the LLM itself. This lets the team develop and test components independently, and swap LLMs or guardrails depending on the scenario.
A separate guardrail also lets you set a minimum safety performance for the system. Typical guardrails are more deterministic than LLM outputs. If a guardrail has 95% accuracy in detecting NSFW language, the system's safety floor is at least 95%, leaving the model to handle the remainder.
3. Actionable and configurable
Guardrails should expose confidence or severity scores rather than only binary decisions. With a 0–1 score, the AI system can take differentiated actions — log low-confidence detections, warn on medium, block on high.
Confidence refers to how certain the guardrail is about its classification. Severity refers to the degree of harmfulness. Most guardrail providers expose one of the two. For confidence, calibration matters: a well-calibrated 0.5 score means the content really is harmful 50% of the time. Out-of-the-box ML models are usually not well-calibrated — see scikit-learn's calibration documentation.
Configurability matters too. Teams should be able to adjust thresholds and action bands based on the AI system's context — prioritise recall in healthcare where safety is paramount, or precision in customer service where false positives erode trust.
Was this page helpful?