Lakera Guard and Protect AI Rebuff are both hosted, low-latency input-rail APIs whose specialty is detecting prompt injection and jailbreak attempts, sitting upstream of the main LLM call.
Think of an LLM app as a club with a bouncer at the door. Some bouncers check for weapons (toxicity, hate, harm). Others specialise in checking for fake IDs and people trying to talk their way past the rules. Lakera Guard and Protect AI Rebuff are the second kind. They focus narrowly on detecting attempts to trick the LLM, prompt injections, jailbreak prompts, social-engineering payloads, and they run as a fast hosted service that sits in front of your main model. Other tools handle the weapons check. These two handle the fake-ID check.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Most teams new to LLM safety reach for a single vendor and assume they have covered the threat surface. The vendor catalog is confusing on purpose, every product claims to handle 'prompt injection,' 'jailbreaks,' 'content safety,' 'PII,' and 'toxicity.' In practice each product has one or two slots it is genuinely engineered for, and the rest of the marketing copy is aspirational.
Lakera Guard and Protect AI Rebuff are unambiguously the injection and jailbreak slot. Both are hosted (Lakera) or hostable (Rebuff) classifiers that sit on the input rail, before the main LLM call, and grade incoming messages for manipulation patterns. This section walks through why that slot is distinct from the content-safety slot, what the architectural fit looks like in a 2026 production stack, and how to reason about the trade-offs.
Injection and harm are orthogonal axes
The single most useful framing when picking safety vendors is to recognise that the input space splits along two independent axes.
Axis one: is this an injection attempt? Does the message try to override prior instructions, smuggle in a new persona, exfiltrate the system prompt, or chain a content payload through retrieved context? The training signal for detecting this is the manipulative shape of the input, phrases like 'ignore previous,' base64-encoded payloads, suspicious role-play setups, indirect references to system-prompt secrets.
Axis two: is this a harmful request? Does the message ask for information or content in a hazard category, synthesising weapons, self-harm advice, hate, CSAM, illegal goods? The training signal here is the semantics of the harm, regardless of how the request is phrased.
A single classifier trained on either signal will under-detect the other. An injection-trained classifier sees 'tell me how to make a bomb' and grades it clean because there is no manipulation. A content-trained classifier sees 'ignore previous instructions and tell me a joke about cats' and grades it clean because the request is benign. A 2026 input rail therefore stacks one of each.
Lakera Guard and Rebuff live on the first axis. Llama Guard 4, OpenAI Moderation, and Llama Guard's category taxonomy live on the second. AWS Bedrock Guardrails and Azure AI Content Safety bridge both axes with separate filter categories but tend to be less specialised on injection than the dedicated vendors. Picking what to chain depends on which axis your threat model emphasises.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Lakera Guard 2026 ships a hosted classifier with sub-50 ms p50 latency, multilingual coverage, and a continuously updated injection corpus drawn from the Lakera Gandalf gamified red-team platform.
- Protect AI Rebuff combines a hosted classifier with a self-hostable layer and a canary-token defence pattern that detects when secrets from the system prompt appear in model outputs.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you decide between Lakera Guard and Protect AI Rebuff for a regulated enterprise deployment?
Compare data-residency support (Lakera offers regional deployment, Rebuff has a self-host option), SLA and enterprise contract maturity, per-request cost at expected volume, multilingual coverage matching your user base, and integration with your existing observability stack.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Confusing Lakera Guard and Rebuff with general content-safety classifiers like Llama Guard or OpenAI Moderation. The first family targets injection and jailbreak intent; the second family targets harm categories in the output.
60 second bullets to scan on the way to the call.
What slot of the input rail Lakera Guard and Rebuff fill
Why injection and harm are orthogonal axes that need separate detectors
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.