Input Guardrails
Threats: Prompt Injection (LLM01), Jailbreaks (LLM01), Adversarial Prompts (LLM01, LLM04)
Standards: NIST AI 600-1 MANAGE-2.2, NIST AI RMF MAP-2.3/MEASURE-2.1, OWASP LLM01/LLM04, EU AI Act Art. 15, ISO 42001 A.5.2, MITRE TA0012
Control Layers
| Layer | Control | Mechanism | Standards |
|---|---|---|---|
| Input Validation | Schema validation | Enforce JSON schema / structured prompt format; reject non-conforming | NIST AI RMF MAP-2.3 |
| Input Validation | Length / complexity limits | Max tokens, max nesting depth, reject high-entropy prompts | OWASP LLM04, NIST AI 600-1 §2.5 |
| Boundary Enforcement | Instruction hierarchy | System prompt immutable; user prompt in delimited block; tool outputs in separate namespace | NIST AI 600-1 MANAGE-2.2, OWASP LLM01 |
| Boundary Enforcement | Special token sanitisation | Strip/escape model control tokens (<|endoftext|>, <|tool_call|>, etc.) |
MITRE TA0012 |
| Classification | Heuristic filter | Regex + keyword blocklist for known injection patterns (low FP, high recall) | OWASP LLM01 |
| Classification | ML-based detector | Fine-tuned classifier (DeBERTa/distilBERT) on injection/jailbreak dataset; threshold tuned for <1% FPR | NIST AI 600-1 MEASURE-2.1, MITRE TA0008 |
| Classification | Perplexity / entropy anomaly | Flag prompts with abnormal token probability distribution vs. baseline | NIST AI 600-1 MEASURE-3.1, MITRE TA0008 |
| Architecture | Multi-model consensus | Lightweight classifier + main LLM both evaluate; require consensus | NIST AI 600-1 MANAGE-2.2 |
| Architecture | Instruction-tuned guardrail model | Small model (1–3B) fine-tuned as binary guardrail; <50ms latency | OWASP LLM01, NIST AI 600-1 MANAGE-2.2 |
Recommended Pipeline
Rendering diagram...
Hardening Tips
- Log everything — rejected and accepted prompts with classifier scores
- Shadow mode first — deploy guardrails in logging-only mode for 2 weeks before enforcing
- Adversarial testing — include GCG, PAIR, TAP generated attacks in regression suite
- Continuous retraining — monthly fine-tuning of guardrail classifier on new attack samples
Citation Register
| Control | Standard | Provision | URL |
|---|---|---|---|
| Instruction hierarchy | NIST AI 600-1 | MANAGE-2.2 | https://doi.org/10.6028/NIST.AI.600-1 |
| Robustness | EU AI Act | Art. 15 | https://eur-lex.europa.eu/eli/reg/2024/1689/oj |
| ML classifier | MITRE ATLAS | TA0008, TA0012 | https://atlas.mitre.org/ |
| Perplexity anomaly | NIST AI 600-1 | MEASURE-3.1 | https://doi.org/10.6028/NIST.AI.600-1 |
| GAI risk areas | NIST AI 600-1 | §2.5, §2.8, §2.9 | https://doi.org/10.6028/NIST.AI.600-1 |
| Input validation | ISO 42001 | A.5.2 | https://www.iso.org/standard/81230.html |
| Prompt injection | OWASP LLM Top 10 | LLM01 | https://owasp.org/www-project-top-10-for-large-language-model-applications/ |
| Model DoS | OWASP LLM Top 10 | LLM04 | https://owasp.org/www-project-top-10-for-large-language-model-applications/ |