feat(litellm): prompt-injection guardrail + enforce-moderation (scoped to platform features) - #544
Merged
Merged
Conversation
… to platform features Adds a heuristic prompt-injection custom guardrail (/app/prompt_injection_guard.py, written on boot like rate_limit_signal.py) + registers openai-moderation-enforce (block) and injection-guard as default_on:false guardrails. Platform features (llmService: summarizer/digest/skills/avatars — which ingest untrusted pod content) opt in via a per-request guardrails:[...] field; dev-agent per-agent-key traffic is never blocked. Global moderation stays monitor-only. Runbook: docs/runbooks/litellm-guardrails.md. Upgrade path: PromptGuard sidecar. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019vuFLFHnmJKmMxosHSWA4P
samxu01
added a commit
that referenced
this pull request
Jul 1, 2026
…rash-looped litellm (#545) * Revert "feat(litellm): prompt-injection guardrail + enforce-moderation scoped to platform features (#544)" This reverts commit 33059c1. * Revert "feat(litellm): add OpenAI moderation guardrail (monitor-only) for anti-pattern detection (#540)" This reverts commit 5a646c0.
This was referenced Jul 1, 2026
lilyshen0722
added a commit
that referenced
this pull request
Jul 1, 2026
…rash-looped litellm (#545) * Revert "feat(litellm): prompt-injection guardrail + enforce-moderation scoped to platform features (#544)" This reverts commit 33059c1. * Revert "feat(litellm): add OpenAI moderation guardrail (monitor-only) for anti-pattern detection (#540)" This reverts commit 5a646c0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the guardrail hardening requested before opening registration: prompt-injection detection + moderation ENFORCE, scoped so dev agents are never blocked.
prompt_injection_guard.PromptInjectionGuard, written on boot like the rate-limit callback) that blocks obvious instruction-override / jailbreak / prompt-exfiltration patterns.openai_moderationin blocking (during_call) mode.default_on: false. Only the platform features opt in:llmService.generateViaLiteLLM(summarizer/digest/skills/avatars — which ingest untrusted pod content) sendsguardrails:[...]per-request. Dev agents call via their own per-agent keys → never blocked (no false-positives on coding prompts). Global moderation stays monitor-only (feat(litellm): anti-pattern guardrail — OpenAI moderation (monitor-only) #540).This is the right scope: the genuine public exposure is indirect prompt-injection of platform features, not arbitrary user prompts (public users bring their own compute). Runbook:
docs/runbooks/litellm-guardrails.md. Upgrade path: PromptGuard model sidecar for ML-based injection detection.Deploy restarts litellm (loads the config + writes the guardrail module); I will verify the pod boots + the guardrail blocks a test injection on the platform path while dev-agent traffic is unaffected.
🤖 Generated with Claude Code