Llama Guard & Rebuff

What it is

Open-weight safety, run by you.

Two open-source classifiers you host yourself. Llama Guard, from Meta, is an open-weight model that classifies both input and output against a safety taxonomy and returns a safe or unsafe label with the category. Rebuff is an open-source prompt-injection detector that layers several checks: fast heuristics, an LLM pass, and a vector store of known attacks so previously seen injections are caught cheaply. Between them you get content safety and injection detection without sending anything to a vendor.

The one job

Classify safety and injection, in-house.

Give a verdict on whether a message is safe or an attack, using weights and code you run yourself. The data never leaves your infrastructure, and the cost is compute you already control rather than per-call API pricing.

Reach for it when

• You want open-weight, self-hosted guardrails with no external dependency in the request path.
• Your data cannot go to a vendor classifier for privacy or compliance reasons.
• Cost matters at volume and per-call pricing on a managed API would add up.
• You want both content and injection coverage from open components.

Skip it when

• You want turnkey managed detection: Lakera removes the hosting burden entirely.
• You have no capacity to host a classifier model and keep it running.
• You need the highest detection quality with the least effort, not a self-run stack.

A minimal look

Call a locally-served classifier.

import OpenAI from "openai";

// Llama Guard served behind an OpenAI-compatible endpoint (vLLM / Ollama)
const guard = new OpenAI({ baseURL: "http://localhost:8000/v1", apiKey: "local" });

const res = await guard.chat.completions.create({
  model: "meta-llama/Llama-Guard-3-8B",
  messages: [{ role: "user", content: userText }],
});
// the model replies "safe" or "unsafe" plus a category
if (res.choices[0].message.content.startsWith("unsafe")) throw new Error("blocked");

The principle it teaches

Where it fits your labs

This is a Week 4 tool with a Week 3 dependency. Once you have a serving stack from the self-hosting work, dropping Llama Guard behind the same endpoint gives you guardrails that never leave your infrastructure.