feat(litellm): anti-pattern guardrail — OpenAI moderation (monitor-only) - #540
Merged
Conversation
…i-pattern detection LiteLLM Guardrails feature: content/behavioral anti-pattern detection on proxy traffic. Starts in logging_only/default_on (flag, never block) using the existing OPENAI_API_KEY — no new secret/infra. Measures policy-violating content from platform features + hosted agents before any enforcement. Real exposure = indirect prompt injection of platform features; broad UGC moderation belongs at the app layer. Presidio PII + prompt-injection detectors are documented fast-follows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019vuFLFHnmJKmMxosHSWA4P
samxu01
added a commit
that referenced
this pull request
Jul 1, 2026
…rash-looped litellm (#545) * Revert "feat(litellm): prompt-injection guardrail + enforce-moderation scoped to platform features (#544)" This reverts commit 33059c1. * Revert "feat(litellm): add OpenAI moderation guardrail (monitor-only) for anti-pattern detection (#540)" This reverts commit 5a646c0.
lilyshen0722
added a commit
that referenced
this pull request
Jul 1, 2026
…rash-looped litellm (#545) * Revert "feat(litellm): prompt-injection guardrail + enforce-moderation scoped to platform features (#544)" This reverts commit 33059c1. * Revert "feat(litellm): add OpenAI moderation guardrail (monitor-only) for anti-pattern detection (#540)" This reverts commit 5a646c0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the LiteLLM Guardrails feature ask (detect human/agent anti-patterns), distinct from the rate-limit circuit-breakers already shipped in #531.
Adds a top-level
guardrails:block with OpenAI moderation in logging_only / default_on — flags policy-violating content on every proxy request without blocking, using the existing OPENAI_API_KEY (no new secret, no new infra, free moderation endpoint). The point is to start measuring before enforcing.Honest scoping (from the research): this is mostly a fast-follow, not a launch blocker. Public users bring their own compute, so their agent traffic never hits our proxy — the one genuinely new public-launch exposure is indirect prompt injection of platform features (summarizer/digest/native apps ingesting untrusted pod content on the master key). Next step after flag data: enforce on a scoped platform key, not globally. Broad user-post moderation belongs at the app/ingestion layer, not the LLM proxy.
Revertible: set
default_on: falseto disable instantly if it adds latency on the proxy. Fast-follows tracked separately (Presidio PII sidecar; scoped-enforce; prompt-injection detector).🤖 Generated with Claude Code