Open-Source LLM Guardrails Explained: NeMo Guardrails, Llama Guard 4, Prompt Guard 2, LlamaFirewall and LLM Guard

Guardrails are the checks around a model call: screen what goes in, screen what comes out, and sometimes control the conversation in between. Every serious interview on LLM application security asks how you would build them and why they are not enough on their own. These open-source tools are what many teams start with.

What they are

NVIDIA NeMo Guardrails is a toolkit for adding programmable guardrails to conversational systems. Its repository moved to NVIDIA-NeMo/Guardrails, and the latest release in November 2026 is v0.24.1. It supports five kinds of rail:

• Input rails check what the user sends.
• Dialog rails steer the conversation.
• Retrieval rails check chunks pulled in by retrieval-augmented generation (RAG).
• Execution rails check what actions and tools receive and return.
• Output rails check the model's answer.

Rails are configured in YAML and written in Colang; Colang 1.0 is the default, and 2.0 is supported.

Meta's Purple Llama tools:

• Llama Guard 4 (12B) classifies prompts or responses as safe or unsafe across 14 hazard categories, with text and images.
• Prompt Guard 2 (86M and 22M) classifies input as benign or malicious, meaning an explicit attempt to override instructions.
• LlamaFirewall combines Prompt Guard 2, AlignmentCheck and CodeShield into a guardrail system for agents. AlignmentCheck audits an agent's reasoning for goal hijacking. CodeShield is static analysis of generated code.

LLM Guard, from Protect AI, offered input scanners (personal data anonymisation, prompt injection, secrets, toxicity, token limits) and output scanners (relevance, sensitive data, malicious URLs). It was archived in July 2026 and is no longer maintained.

How it works

Most guardrails are classifiers: small models or rules that produce a label and a score. You decide what happens on each label, whether that is blocking, asking the user to rephrase, routing to a human or just logging. That choice, and the threshold, matter as much as the classifier.

How to use it

Day one: classify inputs and outputs

With NeMo Guardrails, create a configuration folder containing config.yml (models and active rails), Colang .co files and optional actions.py. A minimal config.yml that turns on input and output rails looks like this, using flow names from the project's README example:

models:
  - type: main
    engine: openai
    model: <your-model>
rails:
  input:
    flows:
      - check jailbreak
      - mask sensitive data on input
  output:
    flows:
      - self check facts
      - self check hallucination

In Python, RailsConfig.from_path() loads the folder, LLMRails(config) builds the rails, and rails.generate(messages=[...]) returns the guarded reply, with messages in a chat completions-like format. nemoguardrails server --config ./guardrails-config exposes the same rails behind a chat completions-style endpoint, so an existing application can call it like a model. Turn telemetry off in regulated environments by setting NEMO_GUARDRAILS_NO_USAGE_STATS=1 before start-up.

Week one: measure before you enforce

Run the classifiers in log-only mode on real or realistic traffic. Measure:

• False positives on legitimate questions, because blocking real customers costs money.
• Misses on a labelled attack set.
• Added latency, because self-check rails cost an extra model call per turn.

Choose thresholds per use case: a children's education app and an internal security research tool should not share one.

Every day: guardrails plus design

Treat guardrails as one layer. Limit what the model can do even if a guardrail misses, for example with least-privilege tools, approval for consequential actions and no secrets in context. Keep classifiers updated, and keep a labelled regression set of past misses.

Where they stop

• Classifiers can be evaded. Meta's model cards say Llama Guard "may be vulnerable to adversarial or prompt-injection attacks", and Prompt Guard 2 can be evaded by adaptive attackers.
• Narrow labels. Prompt Guard 2 detects explicit instruction override, not every harmful request. Llama Guard's categories for defamation, intellectual property and elections need up-to-date facts it may not have.
• Language coverage. The 22M Prompt Guard model is weaker on non-English text.
• Maintenance. LLM Guard's archiving is a reminder to check that a library is maintained before you depend on it.

How it comes up in interviews

• "Where would you put guardrails in a RAG assistant, and what does each one stop?" Input, retrieval, output and tool layers, and what they miss.
• "Your injection classifier catches 95% of a test set. Is that good?" Ask about the test set, adaptive attackers, false positives and what a miss can do.
• "Should a guardrail fail open or closed?" Depends on the harm of a miss against the cost of blocking, per feature.

Sources

Checked on 13 November 2026: NVIDIA-NeMo/Guardrails GitHub README and NeMo Guardrails documentation; Hugging Face model cards for Llama-Guard-4-12B and Llama-Prompt-Guard-2-86M; Meta PurpleLlama repository and LlamaFirewall paper (arXiv 2505.03574); LLM Guard GitHub repository archive notice and quickstart documentation; PyPI pages for nemoguardrails, llamafirewall and llm-guard.