From 85d75852697af898c82b527b0184071ac5949e77 Mon Sep 17 00:00:00 2001 From: Sam Xu Date: Tue, 30 Jun 2026 03:11:27 -0700 Subject: [PATCH] feat(litellm): add OpenAI moderation guardrail (monitor-only) for anti-pattern detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit LiteLLM Guardrails feature: content/behavioral anti-pattern detection on proxy traffic. Starts in logging_only/default_on (flag, never block) using the existing OPENAI_API_KEY — no new secret/infra. Measures policy-violating content from platform features + hosted agents before any enforcement. Real exposure = indirect prompt injection of platform features; broad UGC moderation belongs at the app layer. Presidio PII + prompt-injection detectors are documented fast-follows. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_019vuFLFHnmJKmMxosHSWA4P --- .../templates/configmaps/litellm-config.yaml | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/k8s/helm/commonly/templates/configmaps/litellm-config.yaml b/k8s/helm/commonly/templates/configmaps/litellm-config.yaml index 4ffd0e3f..8ca1fdb2 100644 --- a/k8s/helm/commonly/templates/configmaps/litellm-config.yaml +++ b/k8s/helm/commonly/templates/configmaps/litellm-config.yaml @@ -318,6 +318,30 @@ data: # the container startup script; PYTHONPATH is set accordingly. callbacks: rate_limit_signal.proxy_handler_instance + # Content/behavioral guardrails — anti-pattern DETECTION on proxy traffic. + # Posture: MONITOR-ONLY for now (logging_only ⇒ flag, never block), so we + # measure policy-violating / anomalous content flowing through the proxy + # (platform features + hosted agents) before deciding whether to enforce. + # Uses the free OpenAI moderation endpoint via the already-present + # OPENAI_API_KEY (no new secret, no new infra). default_on runs it on every + # request. NOTE: the genuine public-launch exposure is INDIRECT PROMPT + # INJECTION of platform features (summarizer/digest/native apps) that ingest + # untrusted pod content on the master key — once we have flag data, the next + # step is to enforce on a scoped platform key, not globally. Broad user-post + # moderation belongs at the app/ingestion layer, NOT here. Presidio PII + + # prompt-injection detectors are documented fast-follows (need a sidecar / + # are block-only). If this adds latency/failures on the proxy, set + # default_on:false to disable instantly. See issue #538-adjacent + the + # guardrails research note. + guardrails: + - guardrail_name: "openai-moderation-monitor" + litellm_params: + guardrail: openai_moderation + mode: "logging_only" + model: "omni-moderation-latest" + api_key: os.environ/OPENAI_API_KEY + default_on: true + general_settings: master_key: os.environ/LITELLM_MASTER_KEY database_url: os.environ/DATABASE_URL