An input-side jailbreak filter runs on every user request before the main model is called. That means the filter cost,both money and latency,gets multiplied by the total request volume, including the requests that end up blocked. Picking the right size is mostly a unit-economics question.
A frontier model used as a classifier sounds nice because it has the best judgement, but it adds hundreds of milliseconds and several cents per call. At any real traffic level the bill is large and users feel the delay. A regex-only filter is cheap but misses anything paraphrased or encoded. The sweet spot is a small purpose-trained classifier,Prompt Guard 2, Llama Guard 4 small, or a distilled DeBERTa,under 1B parameters, running on a cached endpoint with sub-50ms p99.
Most production stacks layer this. Regex catches the obvious patterns. The small classifier handles nuance. The frontier model gets called only as a fallback judge on the small fraction of ambiguous cases.
**The decisive constraint is hot-path economics.** An input-side classifier sits before the generation model, so every request pays its cost,including the ones it will block. That multiplies the per-request cost and latency by total traffic, not by accepted traffic.
Frontier models as classifiers are out: 200-500ms p99 and a few cents per call destroy both the latency budget and the unit economics. Regex-only is also out: it catches obvious patterns but misses paraphrases, encoded jailbreaks, and the long tail of injection content. Re-using the generation endpoint couples two failure domains, so an outage in the safety path also takes down generation.
The right answer is a small purpose-trained classifier,Prompt Guard 2, Llama Guard 4 small, or a distilled DeBERTa,under 1B parameters, served on a cached endpoint with sub-50ms p99 and fractional-cent economics. Empirically these reach about 95% of a frontier judge's recall on known jailbreak families.
Production stacks tier the layers: regex for the obvious, small classifier for nuance, frontier model only as a fallback judge on the ambiguous tail. That tiering keeps cost low and quality high.
Quick reference
TL;DR
On the hot path, every request pays the classifier cost, so the right pick is a small purpose-trained model under 1B params with sub-50ms latency.
Picture airport security. You do not put a senior detective at the metal detector,they cost too much and the line would never move. You put a quick scanner that catches almost everything, and you only escalate the rare ambiguous case to the detective in the back room. A jailbreak filter on the hot path is the same idea. Every traveller, even the ones who get turned away at the gate, walks through the scanner. So the scanner has to be cheap, fast, and good enough. The detective stays in the back room for the small fraction of cases that need real judgement.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Batch or offline pipeline where latency does not affect user perception If the workload is async and traffic is bounded, a larger judge model can be acceptable on cost
Extremely low-traffic internal tool with a tiny user base Per-call cost stops mattering at low volume, and engineering time on a dedicated classifier is wasted
Strictly regulated domain where every block decision must be defensible by a documented model Some regulators expect a specific named model with documented evals, which can override pure cost optimization
Quick scan · 2–4 min
Everything important, quickly.
6 min: hot-path cost framing, latency budget, why frontier classifiers do not fit, tiered pattern, threshold tuning, endpoint decoupling.
Real-world examples
Real products, models, and research that use this idea.
1Meta Prompt Guard 2 and Llama Guard 4 small are explicitly sized for input-side serving on commodity GPUs
2Microsoft Azure AI Content Safety ships purpose-built classifiers behind a low-latency API rather than calling GPT-5.5 for every request
3AWS Bedrock Guardrails uses dedicated classifier endpoints separate from the generation model so latency and outages decouple
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you decide where to set the classifier threshold?
Sign in or go Pro to see the approach for this follow-up.
QWhy decouple the safety classifier endpoint from the generation endpoint?
Sign in or go Pro to see the approach for this follow-up.
QWhat does the fallback judge tier look like in practice?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Reaching for the smartest available model for safety classification, forgetting that on a hot path the classifier cost is multiplied by every request, not by every accepted one.