Moksh Gupta

Posted on Aug 12 • Originally published at devtoollab.com

LLM Guard Is Archived. Here Are the Guardrail Tools Still Worth Installing

#ai #security #opensource #programming

If you go looking for protectai/llm-guard right now, GitHub greets you with a read-only notice. The repo went into the archive on July 9, 2026, its last commit landed the day before, and the README says outright that neither the code nor the Hugging Face models are being maintained any more. It shipped 15 input scanners and 20 output scanners under MIT, collected 3,200 stars, and it is still sitting near the top of most "best LLM guardrails" roundups you will find today.

Worth checking before it goes into a requirements file. I dug into what replaced it and wrote the full comparison, with every license and price verified against the vendor's own page, over on DevToolLab. This is the condensed version.

Follow the Ownership and the Archive Makes Sense

Protect AI maintained LLM Guard, and Palo Alto Networks finished buying Protect AI on July 22, 2025. Look either side of that date and a pattern shows up fast. Check Point picked up Lakera on September 16, 2025, in a deal reported at roughly $300 million. Palo Alto said it intended to buy Portkey on April 30, 2026. OpenAI said it was buying promptfoo on March 9, 2026.

Inside about a year and a half, nearly every independent vendor in this space turned into a feature of somebody's larger security platform. LLM Guard's capabilities did not vanish, they moved into Palo Alto's commercial AI security module, and the free library stopped getting commits.

Three Jobs Wearing One Word

"Guardrails" gets applied to three separate problems, and picking a tool built for the wrong one is where most teams waste a sprint.

Input rails sit in front of the model and screen what arrives: injection attempts, jailbreaks, off-limits topics, personal data you do not want leaving your network. This is the adversarial surface, because attackers get to choose this text.

Output rails screen what comes back: toxic content, leaked personal data, claims that do not match your retrieved sources, malformed structure. Different failure mode entirely, since here the model is the thing misbehaving.

Red teaming is not a filter at all. It is an adversarial test suite you run in CI before shipping. Treating it as a runtime control is how you end up with a clean security report and nothing actually guarding production.

Expect to need all three. Expect them to be three separate tools.

Why This Bug Class Stays Open

The 2025 edition of the OWASP Top 10 for LLM Applications lists prompt injection at LLM01, its second consecutive run at the top spot.

There is a structural reason it does not get patched away. Instructions and data arrive through the same channel with nothing marking which is which, so content can be read as a command. SQL solved this with bound parameters. There is no equivalent primitive for a prompt.

EchoLeak is the case study worth reading. Tracked as CVE-2025-32711 at CVSS 9.3, found by Aim Security in June 2025, it is documented as the first zero-click prompt injection actually exploited against a shipping LLM product.

The delivery was an email that looked like any other, carrying instructions tucked into an HTML comment or set in white text on white. No click required. When the recipient later asked Microsoft 365 Copilot about something entirely different, retrieval pulled that message into context and the buried text got treated as direction. Getting there meant stacking bypasses: past Microsoft's cross prompt injection classifier, around link redaction using reference-style Markdown, through auto-fetched images, out via a Teams proxy the content security policy already trusted. Microsoft fixed it server-side and saw no exploitation in the wild.

Note where the payload entered. Not the chat box. A classifier watching user input would never have seen it.

The Constraint That Beats Any Classifier

Simon Willison named the useful mental model on June 16, 2025: the lethal trifecta. Private data access, untrusted content exposure, external communication. Any two of those together is survivable. All three in one session means whoever controls the untrusted content can read your private data and send it somewhere, without writing a single line of exploit code.

The reason this beats a detector is that it is deterministic. You can guarantee an architecture; you cannot guarantee a probability. Cut one leg and you have removed the capability rather than lowered the odds, at zero runtime cost. Everything below belongs behind that decision, not instead of it.

What Is Still Being Maintained

Five options here are genuinely open source and run on hardware you control.

NeMo Guardrails sits at v0.23.0 as of July 1, 2026, Apache 2.0, around 6,900 stars, commits still landing. Heads up on the URL: NVIDIA/NeMo-Guardrails now redirects to NVIDIA-NeMo/Guardrails. It is the most opinionated design of the bunch, splitting enforcement across input, dialog, retrieval, execution and output stages, with policies expressed in a DSL called Colang. Those retrieval rails are the correct place to screen RAG chunks, which is exactly the gap EchoLeak drove through. Costs: Colang is a language you have to learn, and some rail types spend an LLM call per request. If a roundup quotes you a "sub-100ms GPU-accelerated" number for it, be skeptical, since the repo ships no latency benchmarks at all.

Guardrails AI reached v0.10.2 on June 4, 2026, Apache 2.0, roughly 7,300 stars. The unit here is a validator, one per risk, which you compose into guards around a call. Good fit for field-level output validation, and easy to introduce one validator at a time. Just read each validator before you deploy it, because several reach out to a model rather than computing locally.

Presidio is at 2.2.364 as of July 22, 2026, MIT, about 10,400 stars, and it only does PII: find it, mask it, anonymize it, across text, images and structured data, entirely offline.

This one relocated too, and it went the opposite direction from everything else in this article. microsoft/presidio now 301s to data-privacy-stack/presidio, because the project is becoming community-owned under a vendor-neutral org with Microsoft's backing. The license stays MIT and the copyright line now credits Presidio Contributors. The change that will actually break your build: images live at ghcr.io/data-privacy-stack/presidio-* now, so go grep for hardcoded mcr.microsoft.com pulls. While the paid end of this market got swallowed by security giants, the best open PII tool escaped one.

Llama Prompt Guard 2 is the classifier you host yourself, labeling prompts benign or malicious across both injection and jailbreak attempts. The 86M build sits on mDeBERTa-base, the 22M build on DeBERTa-xsmall for about 75 percent less latency and compute. Get the licensing right: those base models are MIT, but Meta ships the Prompt Guard weights themselves under the Llama license behind a gated download, which is not the same thing. What I like is the honesty of the model card, which reports .998 AUC on English and 97.5 percent recall at a 1 percent false positive rate, then admits the real-world attack prevention rate is 81.2 percent at 3 percent utility loss. That gap is the most useful number in the document. It also states its limits plainly: 512-token window, no multilingual pretraining in the 22M variant, and an acknowledgment that people will build attacks specifically to defeat it.

promptfoo covers red teaming, MIT, about 24,000 stars, commits landing daily. Its red team mode manufactures adversarial prompts across injection, jailbreaks, PII leakage, SSRF, SQL injection, excessive agency and hallucination, then tells you what slipped past. Put it in CI. The OpenAI acquisition means the roadmap is no longer independent, though MIT and a public codebase keep the downside contained.

The Managed Options, With Real Numbers

Bedrock Guardrails is refreshingly easy to price because AWS publishes each policy separately, and you only pay for what you switch on. A text unit tops out at 1,000 characters.

Content filters run $0.15 per 1,000 text units for text and $0.00075 per image. Denied topics are $0.15 per 1,000 units. Sensitive information filters are $0.10 per 1,000 units, or free if you express them as regex. Word filters are free. Contextual grounding checks are $0.10 per 1,000 units. Automated Reasoning checks are $0.17 per 1,000 units per policy.

Two things jump out. The single cheapest useful control in this whole category is a deny list you write by hand, because word filters and regex PII filters bill nothing. And grounding checks, the direct fix for a RAG pipeline inventing facts, undercut the content filters.

Do the arithmetic before flipping switches. One million requests a month, an 800-character prompt and a 1,600-character response, works out to three text units per request. Filter both directions and you are billing three million units, so $450. Add denied topics on input only, $150. Add PII filtering on output, $200. You are at $800 a month, which is either budgeted or a surprise depending on whether anyone ran this multiplication.

Azure prices differently, bundling text moderation, Prompt Shields, groundedness and protected material detection into one rate.

The free allowance is 5,000 text records and 5,000 images monthly, and it halts rather than silently billing you. Standard is $0.38 per 1,000 text records and $0.75 per 1,000 images, checked in Central US with USD selected. A record covers up to 1,000 Unicode code points.

Which is cheaper genuinely depends on your policy count, since Azure's $0.38 already includes what Bedrock charges $0.15 plus $0.10 plus $0.10 for. One or two policies favor Bedrock. All of them can favor Azure. Rates vary by region, so check your own.

On the commercial side, Lakera Guard remains the best-known dedicated prompt firewall, now inside Check Point following the September 2025 deal, so ask how it is packaged before assuming old pricing survived. Protect AI's Guardian and Recon plus its red teaming layer now live in Palo Alto's Prisma AIRS, which is where LLM Guard's functionality went commercially.

Side by Side

Tool	License	Layer	Self-hosted	Status
NeMo Guardrails	Apache 2.0	Input, dialog, retrieval, output	Yes	Active, v0.23.0
Guardrails AI	Apache 2.0	Input and output validators	Yes	Active, v0.10.2
Presidio	MIT	PII detection and redaction	Yes	Active, 2.2.364
Llama Prompt Guard 2	Llama license, MIT base	Injection and jailbreak classifier	Yes	Active
promptfoo	MIT	Red teaming in CI	Yes	Active, OpenAI acquiring
Bedrock Guardrails	Commercial	Input and output	No	From $0.10 per 1k text units
Azure Prompt Shields	Commercial	Input and output	No	$0.38 per 1k text records
Lakera Guard	Commercial	Runtime prompt firewall	No	Check Point, post-acquisition
LLM Guard	MIT	Input and output scanners	Yes	Archived July 2026

Defaults Will Corrupt Your Redactions

PII stripping has the least ambiguous spec of any guardrail, so it is the one I actually measured rather than trusted. Everyone's first version is a pile of regular expressions. Here is Presidio 2.2.364 with spaCy 3.8.15 on a synthetic support ticket, straight out of the box:

from presidio_analyzer import AnalyzerEngine
from presidio_analyzer.nlp_engine import NlpEngineProvider
from presidio_anonymizer import AnonymizerEngine

TICKET = (
    "Hi, this is Marcus Delgado from Cleveland. My order never arrived. "
    "You can reach me at marcus.delgado@northgate-supply.com or (216) 555-0142. "
    "I paid with card 4111 1111 1111 1111 and my SSN on file is 401-55-9302. "
    "The request came from 198.51.100.24 if that helps."
)

provider = NlpEngineProvider(nlp_configuration={
    "nlp_engine_name": "spacy",
    "models": [{"lang_code": "en", "model_name": "en_core_web_sm"}],
})
analyzer = AnalyzerEngine(nlp_engine=provider.create_engine(), supported_languages=["en"])
anonymizer = AnonymizerEngine()

results = analyzer.analyze(text=TICKET, language="en")
print(anonymizer.anonymize(text=TICKET, analyzer_results=results).text)

A regex pass catches the five structured identifiers: email, phone, SSN, card, IP. Presidio catches all five plus PERSON for "Marcus Delgado" and LOCATION for "Cleveland", which is the whole reason to run a real engine, because no pattern will ever recognize a name.

It also returns things you never asked for. marcus.de came back as a URL at 0.5 confidence, since .de is a live TLD hiding inside the email address. The digits 1111 were classified DATE_TIME at 0.85. The literal token "SSN" was tagged ORGANIZATION at 0.85. That last one is not cosmetic, because it wrecks the output:

Hi, this is <PERSON> from <LOCATION>. My order never arrived. You can reach me
at <EMAIL_ADDRESS> or <PHONE_NUMBER>. I paid with card <CREDIT_CARD> and my
<ORGANIZATION> on file is <US_SSN>. The request came from <IP_ADDRESS> if that helps.

"My <ORGANIZATION> on file" is a bug your customers would read. Two arguments fix it, by naming the entities you actually want and setting a confidence floor:

ENTITIES = [
    "PERSON", "LOCATION", "EMAIL_ADDRESS",
    "PHONE_NUMBER", "CREDIT_CARD", "US_SSN", "IP_ADDRESS",
]

results = analyzer.analyze(
    text=TICKET, language="en", entities=ENTITIES, score_threshold=0.4,
)

Seven findings, all correct, clean text. Two caveats: I ran en_core_web_sm to keep the download small when Presidio really wants en_core_web_lg, and PHONE_NUMBER scored exactly 0.4, right on the line, which is your cue to tune that floor on your own data instead of copying mine. The full write-up has both runs side by side with every score.

The transferable lesson: any guardrail left on defaults with no threshold will produce false positives, and in a redaction path a false positive is a shipped bug, not a security win.

Picking One

Conversational app with topic rules, go NeMo Guardrails and use the retrieval rails. Field-level output validation, Guardrails AI, one validator at a time. Hard requirement that personal data never leaves your network, self-hosted Presidio with an explicit entity list. Want your own injection classifier, Llama Prompt Guard 2 at whichever size fits your latency budget, with the license reviewed by whoever reviews licenses. Already on Bedrock, turn on the free word and regex filters today and add paid policies only after measuring. No adversarial tests at all, start with promptfoo in CI, because knowing which attacks land beats a filter you cannot evaluate. And if LLM Guard is already in your requirements file, Guardrails AI plus Presidio covers most of what you were using it for.

A Rollout Order That Works

Start by auditing for the lethal trifecta, since removing one leg outperforms every tool listed here and costs nothing at runtime. Then write down every route text takes into your context window, not just the prompt field, remembering that EchoLeak came in through retrieved mail.

Normalize before inspecting, because payloads hide inside zero-width characters and get base64-wrapped to slip past literal matching. The Invisible Character Remover strips the hidden ones and the Base64 Encoder Decoder shows you what the model will really see. Test every deny-list pattern against adversarial input in a Regex Tester before it touches a request path, because a bad pattern either blocks real users or waves everything through.

After that, add PII redaction with an explicit entity list rather than defaults, get promptfoo running in CI so a system-prompt regression breaks a build, and log every block alongside the input that caused it. A guardrail you cannot audit is a guardrail you cannot tune.

Where This Leaves You

Eighteen months of consolidation: Lakera to Check Point, Protect AI and Portkey to Palo Alto, promptfoo to OpenAI, LLM Guard to the archive. Check a repo's own status page before you trust any comparison article, this one included.

The open layer is still in good shape. Two Apache 2.0 frameworks under active development, an MIT PII engine that just gained community ownership, and a self-hosted classifier whose own documentation publishes the distance between its benchmark score and its real-world hit rate.

None of it closes prompt injection, because instructions and data still share a channel. Presidio broke its own output on default settings in the test above, and Meta's numbers put roughly a fifth of genuine attacks through a well-trained classifier. Spend your first hour on architecture and on which leg of the trifecta you can amputate. Treat the rest as depth behind that call.

DEV Community