ai-lakera-guard

Checks prompts with Lakera Guard before the LLM.

Category AIAdd it to Route, Service, Consumer, Consumer group, Global rule, Plugin configEngine plugin ai-lakera-guardPriority 1028

What it does

ai-lakera-guard sends the prompt to Lakera Guard before the model receives it, and with Direction set to output or both, the model's answer too. A request Lakera flags is refused when Action is block, and only logged when it is alert. The refused client receives Request failure message with Deny code.

It scans only what an AI proxy on the same route handles, ai-proxy or ai-proxy-multi. The refusal is answered 200 unless you change Deny code, and client libraries read that as a normal completion, not as an error.

When to use it

• A support chat on your website whose prompts come from anyone, checked for prompt injection before they reach the model.
• A security team that keeps its detectors and thresholds in a Lakera project, named under Project ID, and wants every chat route judged by it.
• A first week on live traffic with Action set to alert, which logs each flagged prompt and lets it through, before you switch to block.
• Answers of the model that must be checked as well as the prompts, with Direction set to both.

Not for refusing prompts by patterns you write yourself — see ai-prompt-guard (Allows or denies prompts that match configured patterns), asking your own authorization service whether a request may go on — see forward-auth (Delegates authentication to an external service) or prompts rated by Alibaba Cloud content moderation — see ai-aliyun-content-moderation (Moderates request content with Alibaba Cloud before the LLM).

Set it up

Block prompt injection before it reaches the model

Acts only on a route that also carries ai-proxy or ai-proxy-multi; without a project ID the prompt is judged by Lakera's default policy, which covers more than prompt injection.

Under Basics set API key to <secret> and leave Direction at input. Under Behavior set Deny code to 403 and set Request failure message to This prompt was refused by the content policy.. Under Advanced leave Lakera endpoint at https://api.lakera.ai/v2/guard.

ai-lakera-guard · as the console saves it

{
  "api_key": "<secret>",
  "direction": "input",
  "deny_code": 403,
  "request_failure_message": "This prompt was refused by the content policy.",
  "lakera_endpoint": "https://api.lakera.ai/v2/guard"
}

Things to know

• Action — alert lets a flagged request through, but not one Lakera fails to judge: an error or a timeout follows Fail open under either action.
• Direction — With the answer scanned, a streamed answer reaches the client only once the stream has ended. With alert and Fail open on, the chunks pass at once and the scan is only logged.
• Deny code — Only 200 to 599 can be set; 600 is refused when you save.
• Fail mode — Nothing is scanned unless an AI proxy on the same route picked a model first, and the default then lets the request through in silence.
• Lakera endpoint — An address without its scheme, api.lakera.ai/v2/guard for example, is refused when you save.
• Action — With block, a prompt Lakera flags is answered with the deny code and the request failure message, 403 and This prompt was refused by the content policy. in the example, and a prompt it does not flag reaches the model.
• Lakera endpoint — The prompt goes to this address as a POST; the example names Lakera's own and a private deployment names its own.
• AdviceStart with Action set to alert and read what it logs before you refuse anything with block.

Settings

The fields as the console shows them, section by section.

Basics

API keyapi_keystringRequired

The Lakera Guard key, sent as a bearer token with every check. Stored on the engine and shown only to roles that manage this object.

at least 1 character

Project IDproject_idstring

The Lakera project whose detectors and thresholds judge the content.

Directiondirectionstringdefault input

Which traffic to scan: input for the request, output for the response, or both. Scanning the response holds a streamed answer back until the stream ends, unless Action is alert and Fail open is on, in which case the chunks pass and the scan is only logged.

one of both, input, output

Actionactionstringdefault block

What a flagged request or response gets: block denies it, and alert only logs it and lets it through. Errors and timeouts follow Fail open either way.

one of alert, block

Behavior

Deny codedeny_codeintegerdefault 200

The status a blocked request is answered with, where 200 reads as a normal completion to client libraries and a 4xx as an error.

200 to 599

Request failure messagerequest_failure_messagestringdefault Request blocked by Lakera Guard

The text returned to the caller when a request is blocked.

Response failure messageresponse_failure_messagestringdefault Response blocked by Lakera Guard

The text returned to the caller when a model response is blocked.

Reveal failure categoriesreveal_failure_categoriesbooleandefault false

Includes the detector categories that flagged the content in the denial response.

Fail modefail_modestringdefault skip

What to do with a request the plugin cannot inspect: skip lets it through, warn also logs it, and error rejects it with 500. Plain traffic that did not pass through an AI proxy is such a request.

one of error, skip, warn

Fail openfail_openbooleandefault false

On, a request goes through when Lakera cannot be reached or times out, and off it is denied.

Timeouttimeoutintegerdefault 5000

How long the guard has to answer one scan.

at least 1 · in milliseconds

SSL verifyssl_verifybooleandefault true

Checks the certificate of the Lakera endpoint before content is sent to it.

Advanced

Lakera endpointlakera_endpointstringdefault https://api.lakera.ai/v2/guard

The Lakera Guard address the content is sent to, changed only for a private or regional deployment.

an http or https address

pattern

^https?://

Every plugin also has Enabled, Priority, Filter, Error response and Pre-function: see Plugin execution settings.