← Safety

LLM GuardLLM Guard

Protect AI

开源Open source 本地Local 混合Hybrid partial lifecycle: archived 核验Checked 2026-11-06

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

未确认的信息Information not confirmed

各扫描器所需的具体模型权重与外部推理服务（当日只到文档索引级口径）
遥测、日志留存、文本外发范围等隐私条款
文件型输入（附件、目录）支持与临时文件落盘行为
阈值与各 on-fail 动作的默认值
是否存在托管服务档位（README 只留了 Production Support 联系方式）
Python 版本口径冲突：README 说 3.9+，PyPI 元数据说 =3.10 且 3.13
MCP 或其他扩展接入方式
大陆直连与备案状态（cn 块记为 unknown）

The exact model weights or external inference services each scanner needs (captured only at documentation-index level today)
Telemetry, log retention and the scope of sending text onward
Support for file-shaped inputs (attachments, directories) and temp-file behaviour
Default thresholds and default on-fail actions per scanner
Whether any hosted tier exists (the README only leaves a "Production Support" contact route)
The Python-version conflict: README says 3.9+, PyPI metadata says =3.10 and 3.13
MCP or other extension points
Mainland direct reachability and filing status (recorded as unknown in the cn block)

Protect AI 开源的 LLM 输入/输出扫描工具箱：一侧拦 prompt（注入、隐形文本、密钥、毒性、话题禁用），一侧拦 completion（偏见、恶意链接、敏感信息、事实一致性）。它是「你自己部署的扫描器集合」，不是托管护栏服务。

适合与不适合When to use it, when not to

适合把前后置检查嵌进自有链路、并且愿意自己承担依赖与模型下载的团队；文档当日给的两种用法是 Python 库与 API server。不适合需要「上游持续更新」的场景——README 顶部警告块已宣布项目归档，关联 Hugging Face 模型同样不再维护。也不适合想找检测率数字的读者：官方只声明支持哪些通道，本站不做端到端实测。

中文生态China availability 国产 / 国内可直接用 / 备案状态 · 快照domestic / direct access / CAC filing · snapshot 2026-11-06

出品属地Origin: 国外出品foreign-made　Protect AI（GitHub 组织 Protect AI，主体为美国公司），非国产产品。Protect AI (GitHub organisation "Protect AI", a US-based company); not a domestic product.
国内使用Direct access: 直连未核验direct unknown　当日只核验了通用网络下的 GitHub / 文档站 / PyPI 可达性，未做大陆直连实测，故直连结论留空。Only general-network reachability of GitHub / docs site / PyPI was checked today; no mainland direct-access test was run, so this stays unknown.
备案状态CAC filing: 备案未核验filing unknown：当日未检索网信办公示名单，无官方依据判定备案状态；该产品本身不面向大陆公众提供服务。The CAC public registry was not searched on the verification day, so filing status has no official basis; the product does not serve the mainland public.

备案信息以网信办《生成式人工智能服务已备案信息》公示名单为准（按批次滚动更新，本站只抄编号不解读）；「大陆可直连」是本站从大陆网络直连实测的结果，不是厂商承诺。GitHub 类站点当日实测有波动，口径写在依据里。Filing status is quoted from the CAC public registry (updated batch by batch; this site copies the number and does not interpret it). "Direct access" is this site's own reachability measurement from a mainland network, not a vendor promise. GitHub-hosted sites fluctuated on the measurement day — the note says so.

固定坐标系Fixed coordinate system

8 个维度dimensions, 与同分区其他对象逐项可比each comparable item by item against others in the same section.

模型与开放条件Model & openness: 它守的是「进模型前」与「模型回来后」的文本，不是某个厂商的模型本体。官方 README 的入门示例走 ChatGPT / OpenAI API 路线（examples/openai_api.py），文档当日列出的交付形态是 Python 库与 API server。哪些扫描器需要下载本地权重、哪些需要外部推理服务，本次只抓到文档索引级口径，未逐条核验，记为未知。
It guards the text going into the model and the text coming back, not any vendor's model itself. The README's starter example goes through ChatGPT / the OpenAI API (examples/openai_api.py), and the documentation index lists two delivery forms as of the verification day: a Python library and an API server. Which scanners need downloaded local weights and which need an external inference service was only captured at documentation-index level; not verified item by item, recorded as unknown.
运行位置Where it runs: 自托管：pip install llm-guard 在你自己的环境里跑，README 要求 Python 3.9 及以上（PyPI 包元数据当日给的约束是

=3.10 且 <3.13，两处口径不一致，已记入未知项）。文档当日另给 API server 部署路径，即把扫描器架在你侧服务里

做前后置检查。不存在需要交给厂商的计算面——官方正文未描述云端代跑。
Self-hosted: pip install llm-guard runs in your own environment; the README requires Python 3.9 or newer, while the PyPI package metadata measured today states =3.10 and 3.13 (the two disagree; logged in the unknowns list). The docs index also gives an API server path, i.e. hosting the scanners inside your own service as pre/post checks. No vendor-side computation is described in the official text.
本地文件Local files: 官方 README 与文档索引当日都把处理对象描述为 prompt / completion 文本，未声明读取工作区文件或遍历目录的能力。扫描器对文件型输入（附件、目录）的支持范围与临时文件落盘行为，官方未说明。
Both the README and the documentation index describe the object of processing as prompt / completion text; no capability to read workspace files or traverse directories is declared. Support for file-shaped inputs (attachments, directories) and any temp-file behaviour on disk is not stated officially.
关机后的任务Tasks after shutdown: 作为库时随你的进程生死；作为 API server 时是你自己常驻的服务，启停与扩缩由部署方掌握。官方未说明托管队列、关机续跑或异步任务能力。
As a library it lives and dies with your process; as an API server it is a service you keep resident, with start/stop and scaling in your hands. Managed queues, continuation after shutdown and asynchronous tasks are not stated officially.
工具与扩展Tools & extensions: 官方 README 列出 15 个 Prompt scanners 与 21 个 Output scanners，覆盖 PromptInjection、InvisibleText、 Secrets、Anonymize、Toxicity、BanTopics、Regex、TokenLimit 等输入通道，以及 Bias、MaliciousURLs、 Sensitive、FactualConsistency、Relevance、JSON、LanguageSame 等输出通道。文档当日口径是可按阈值与 mask / block / answer 类处置动作配置。MCP 接入方式官方未说明。
The README lists 15 Prompt scanners and 21 Output scanners, covering input channels such as PromptInjection, InvisibleText, Secrets, Anonymize, Toxicity, BanTopics, Regex and TokenLimit, and output channels such as Bias, MaliciousURLs, Sensitive, FactualConsistency, Relevance, JSON and LanguageSame. The documented configuration model is thresholds plus mask / block / answer style disposition actions. MCP integration is not stated officially.
上下文与记忆Context & memory: 检测以单次送入的文本为单位，官方未说明会话级记忆、跨轮上下文或历史攻击库机制。上下文长度上限由 TokenLimit 这类扫描器自行设定，具体默认值本次未核验，记为未知。
Detection operates on the single text passed in; no session memory, cross-turn context or historical attack store is described officially. Context-length limits are set by scanners like TokenLimit; the concrete defaults were not verified and are recorded as unknown.
权限与限制Permissions & limits: 许可为 MIT（见 license 字段，逐条以官方 LICENSE 原文为准），可商用与再分发，需保留版权声明。数据流向是本项目最需要留空的一维：官方 README 与当日抓到的文档索引未声明遥测、日志留存或把文本发给第三方的范围，记为未知。合规认证（SOC 2 类）在当日抓到的页面中未见陈述。仓库已归档，官方明示不再活跃维护。
The licence is MIT (see the license field, judged against the official LICENSE text), so commercial use and redistribution are permitted with the copyright notice retained. Data flow is the dimension with the biggest gap here: neither the README nor the documentation index captured today states telemetry, log retention, or the scope of sending text to third parties, so it is recorded as unknown. Compliance certifications (SOC 2 class) were not mentioned on the pages reached. The repository is archived and the official text says it is no longer actively maintained.
适合什么任务Best for: 适合：要把输入/输出检查写进自己链路、能自己接管依赖与模型下载、并接受「规则不再更新」这一事实的工程团队。不适合：指望持续的安全规则维护、指望托管 SLA，或需要以检测率/绕过率作为选型依据的场景（本站不跑实测，也不引官方数字）。
Fits teams that want input/output checks wired into their own pipeline, can own dependencies and model downloads themselves, and accept that the ruleset stops being updated. Does not fit deployments needing continued security-rule maintenance or a hosted SLA, nor readers looking for detection or bypass rates — this site runs no end-to-end tests and quotes no vendor numbers.

头号误解Top misconception

把 README 的扫描器清单当成检测能力承诺——官方只列通道，不列命中率
以为上游仍在维护：仓库与关联 Hugging Face 模型均已宣布归档
Python 版本要求 README 与 PyPI 元数据不一致，装不上先看包元数据

证据来源Evidence sources

最近核验记录Latest recorded check 2026-11-06，内容更新日content updated on 2026-11-06。单项复核范围见正文或来源说明，不代表所有字段在同一天重新核验。See the text or source notes for item-specific scope; this does not mean every field was rechecked on that date.

类型Type	名称Name	链接Link
changelog	LLM Guard · 文档站更新日志（2026-11-06 确认可达）LLM Guard · docs-site changelog (reachability confirmed 2026-11-06)	https://protectai.github.io/llm-guard/changelog/
changelog	LLM Guard · 仓库提交历史（main 分支，最后推送 2026-07-08）LLM Guard · repository commit history (main branch, last push 2026-07-08)	https://github.com/protectai/llm-guard/commits/main
docs	LLM Guard · 官方文档（部署形态与扫描器配置口径）LLM Guard · official documentation (deployment forms and scanner configuration)	https://protectai.github.io/llm-guard/
repo	LLM Guard · 仓库 README（含归档警告与扫描器清单）LLM Guard · repository README (with the archive warning and the scanner lists)	https://github.com/protectai/llm-guard
docs	LLM Guard · 官方 LICENSE（MIT 原文）LLM Guard · official LICENSE (MIT text)	https://github.com/protectai/llm-guard/blob/main/LICENSE
docs	PyPI · llm-guard（0.3.16，2025-05-19 发布；requires_python 约束）PyPI · llm-guard (0.3.16, released 2025-05-19; requires_python constraint)	https://pypi.org/project/llm-guard/

官方口径与未核到项Official record and unverified items

本站未做端到端实测：没有跑过任何扫描器的检测样例，也没有测过阈值与处置动作的实际行为。本页全部结论只组织自官方 README、官方文档索引与 LICENSE / PyPI 元数据（2026-11-06 抓取），「检测通道清单」一节即 README 列表的照录，不代表任何命中或拦截表现。

This site has not run end-to-end tests: no scanner was executed against samples, and no threshold or disposition action was observed in practice. Everything here is assembled from the official README, the documentation index and the LICENSE / PyPI metadata (fetched 2026-11-06). The scanner-channel section is a transcription of the README list and implies no measured hit or block behaviour.

检测通道清单（官方 README 照录）Declared detection channels (transcribed from the README)

Prompt scanners（15 项）：Anonymize、BanCode、BanCompetitors、BanSubstrings、BanTopics、Code、Gibberish、 InvisibleText、Language、PromptInjection、Regex、Secrets、Sentiment、TokenLimit、Toxicity。

Output scanners（21 项）：BanCode、BanCompetitors、BanSubstrings、BanTopics、Bias、Code、Deanonymize、JSON、 Language、LanguageSame、MaliciousURLs、NoRefusal、ReadingTime、FactualConsistency、Gibberish、Regex、Relevance、 Sensitive、Sentiment、Toxicity、URLReachability。

这张表只是官方声明的能力面清单。本站没有跑过其中任何一项，也不引官方或第三方的命中率数字。

Prompt scanners (15 items): Anonymize, BanCode, BanCompetitors, BanSubstrings, BanTopics, Code, Gibberish, InvisibleText, Language, PromptInjection, Regex, Secrets, Sentiment, TokenLimit, Toxicity.

Output scanners (21 items): BanCode, BanCompetitors, BanSubstrings, BanTopics, Bias, Code, Deanonymize, JSON, Language, LanguageSame, MaliciousURLs, NoRefusal, ReadingTime, FactualConsistency, Gibberish, Regex, Relevance, Sensitive, Sentiment, Toxicity, URLReachability.

This table is only the capability surface the official text declares. This site ran none of these items and quotes no hit-rate numbers, official or third-party.

归档状态与选型影响Archive status and what it means for selection

README 顶部警告块原文（2026-11-06 抓取）：

THIS PROJECT HAS BEEN ARCHIVED. This project and its associated models on Hugging Face are no longer under active development or maintained.

配套可核验事实：仓库 archived 标志为真、最后推送 2026-07-08、PyPI 最新版本 0.3.16 发布于 2025-05-19。因此本条目 lifecycle 记 archived，confidence 上限为 partial。选型含义是维护责任转移：规则集、依赖与安全修复都要自己接手。

The warning block at the top of the README, original wording (fetched 2026-11-06):