An AI firewall or guardrail sits at the boundary of your LLM application — inspecting inputs before they reach the model and outputs before they reach users. It’s the closest thing to a traditional WAF that the LLM security stack has. Like WAFs, these tools vary enormously in detection quality, and like WAFs, they’re both necessary and not sufficient on their own.
This landscape covers eight products across two categories: developer-focused guardrail libraries and enterprise-grade AI firewall platforms. Every number below comes from one of two published evaluations and is labelled with whose measurement it is: the independent Palit benchmark study (Palit and Woods, May 2025), and Lakera’s vendor-published PINT benchmark. Products with no published third-party measurement are described without detection figures, because the honest answer there is that nobody has published one. Reported figures vary by test corpus, deployment configuration, and infrastructure, so treat them as directional rather than absolute, and compare against the same categories used in the scanner comparison at bestllmscanners.com.
What the Published Benchmarks Say
The Palit benchmark (independent). The study surveyed 13 LLM security tools and formally evaluated seven. On its no-context test set it reported Lakera Guard at 0.964 precision with 0.501 recall, a 0.057 false-positive rate and 0.066 seconds per prompt; Protect AI’s LLM Guard at 0.938 precision with the highest recall in the group, 0.604, but 1.59 seconds per prompt; Azure Prompt Shield at 0.945 precision and 0.364 recall with 0.349 seconds of added latency; and the open-source Vigil scanner at 0.944 precision but 2.94 seconds per prompt, which rules it out of a synchronous request path.
PINT (published by Lakera). PINT is 4,314 inputs mixing injections, jailbreaks, benign look-alikes, and ordinary documents. Its published scores: Lakera Guard 95.22%, Bedrock Guardrails 89.24%, Azure Prompt Shield 89.12%, Llama Prompt Guard 2 78.76%, Google Model Armor 70.07%. Two discounts apply: the vendor scoring first on its own benchmark is the pattern an evaluation memo should discount, and the repository was archived in August 2026, so these are a snapshot rather than a live leaderboard. The useful signal is the clustering of the non-Lakera tools.
Neither study covers every product on this page. Where a product appears in neither, this guide describes what it does and leaves the detection question open, which is the same position taken in the prompt injection detection tools comparison.
What These Tools Actually Do
Before the comparison, a note on naming: vendors use “guardrail,” “firewall,” “AI gateway,” and “safety layer” interchangeably. For this review, the scope is tools that:
- Accept prompts as input
- Classify or transform them (block, allow, modify, flag)
- Accept LLM outputs as input
- Classify or transform them in the same way
Out of scope is inference-time safety training (RLHF, Constitutional AI), which is a model property rather than a product you deploy separately, along with monitoring-only tools that don’t perform blocking.
Developer-Focused Guardrail Libraries
NeMo Guardrails (NVIDIA)
NeMo Guardrails uses a conversational flow language (Colang) to define allowed and disallowed conversation patterns. Rather than just classifying individual messages, it can enforce multi-turn dialogue policies — preventing conversations from drifting into prohibited topics across multiple exchanges.
Published detection figures: none. NeMo Guardrails appears in neither the Palit study nor PINT, so there is no third-party number to quote here.
Latency: depends on the rails you configure. A rail that calls a hosted LLM to classify a turn costs a full model round trip; a rail that matches a Colang flow locally does not. Measure your own configuration rather than a headline figure.
The conversational policy approach is NeMo’s differentiator. If your application has defined conversation flows (a customer service bot that should only discuss specific topics), NeMo can enforce those flows in a way that input/output classifiers can’t. The downside: configuration requires learning Colang, and a policy rail is a weaker control than a trained classifier against ad-hoc injections it was not written to anticipate.
Free, Apache 2.0. Best for: applications with well-defined conversational boundaries.
LLM Guard (ProtectAI), archived July 2026
LLMGuard is also covered in earlier reviews of open-source LLM security tools. Start with the status: the repository was archived in July 2026 and its Hugging Face models are no longer maintained. It should not go into a new deployment, and existing deployments should be planning a replacement, because a frozen classifier in a security path degrades as attacks move.
Published detection figures (Palit study): 0.938 precision with 0.604 recall, the highest recall of the seven tools formally evaluated, at 1.59 seconds per prompt. That latency is the catch, and it is an order of magnitude above the managed APIs in the same study.
The design is still instructive: modular input and output scanners, everything self-hosted, no external judge LLM in the default path. The self-hosted replacements worth evaluating are Llama Prompt Guard 2 open weights, which is scored on PINT above, and NeMo Guardrails where you need policy rails as well as classification.
Guardrails AI
Guardrails AI is less a firewall and more a structured output enforcer with security validators. It is not a trained injection detector and neither published evaluation scores it as one, but the output validation framework is flexible.
Best for: Teams where the primary security concern is ensuring LLM outputs conform to a schema (no hallucinated URLs, no out-of-scope content) rather than detecting adversarial inputs.
Enterprise AI Firewall Platforms
Lakera Guard
Lakera Guard is a strong default recommendation for teams that need reliable prompt injection detection without operational overhead. The API is clean, it scores first on both published evaluations above, and measured latency is production-viable.
Published detection figures (Palit study): 0.964 precision, the highest in the group, with 0.501 recall, a 0.057 false-positive rate, and 0.066 seconds per prompt.
Published detection figures (PINT, Lakera’s own benchmark): 95.22%, first in that suite. Weight it accordingly.
Read the recall column before signing anything. In the one independent evaluation, the best-scoring product caught roughly half the attacks in the set.
The managed API model means you’re not maintaining inference infrastructure, but it also means your prompts leave your perimeter. For most commercial applications this is acceptable; for applications handling PII or confidential data, evaluate whether the data processing agreement meets your requirements.
Pricing: published list pricing starts at about $0.003 per 1,000 tokens. At 10M tokens/month (a medium-scale deployment) that is approximately $30/month at list. Confirm current rates with the vendor before budgeting.
Protect AI’s Guardian
Protect AI’s Guardian is a newer entrant in the enterprise platform space. It integrates with their broader model security platform, allowing you to correlate guardrail events with model scan results and supply chain checks.
Published detection figures: none. Guardian appears in neither the Palit study nor PINT, so nothing here is measured against the tools above.
The integration story is the strongest reason to choose Guardian over standalone alternatives: if you’re already using Protect AI’s ModelScan, Guardian adds guardrail enforcement within the same control plane and logging infrastructure. For teams who want a unified AI security vendor, this matters. Note the ownership change: Protect AI was acquired by Palo Alto Networks, and Guardian now ships as Prisma AIRS Model Security.
Aporia Guardrails
Aporia started as an ML monitoring platform and extended into guardrails. The platform includes dashboard-level visibility into what’s being blocked, with alert routing for high-confidence attack detections.
Published detection figures: none. Aporia appears in neither the Palit study nor PINT. Vendor-stated detection quality is a claim, not a measurement, so run it against your own held-out set before enforcement mode.
The monitoring and alerting layer is Aporia’s differentiator. Most guardrail products log blocked events; Aporia surfaces patterns across them — an uptick in injection attempts from a specific user cohort, jailbreak attempts clustering around a specific system prompt weakness, etc. For security operations teams who want LLM threat intelligence, not just blocking, Aporia is worth evaluating.
Nyckel
Nyckel is a general-purpose ML classification platform that teams use to build custom content classifiers. Several companies use it to build bespoke guardrails — training classifiers on their own labeled attack examples rather than using off-the-shelf detection models.
Published detection figures: none, and by construction there could not be a single one. Detection quality for a custom-trained classifier is a function of your labelled data and the attack families it covers, which is the point: a well-trained custom classifier can outperform an off-the-shelf tool on the specific attacks you care about, and will underperform badly on the ones your training set never saw.
Best for: Teams with attack data from their own application who want to train classifiers calibrated to their specific threat model.
Bedrock Guardrails (AWS)
Amazon’s Bedrock Guardrails is deeply integrated into the Bedrock platform and provides content filtering, denied topics, word filters, PII redaction, and grounding checks for RAG applications. Per the AWS documentation, the ApplyGuardrail API evaluates content without invoking a model, so one guardrail can front models hosted outside Bedrock.
Published detection figures (PINT, Lakera’s own benchmark): 89.24%, second in that suite and the strongest of the cloud-native options scored there. No independent study in this comparison evaluated it.
Latency: AWS does not publish a per-call figure, and the added time depends on which filters you enable and how long the response is. Grounding checks on long RAG answers cost materially more than a denied-topic check on a short prompt. Measure it in your own configuration before committing to a p95 budget.
LLMOps Report has a detailed analysis of Bedrock Guardrails’ performance impact at scale.
The Recall Gap: Roughly Half of the Attacks Get Through
The independent Palit numbers are the ones to plan around, and they are humbling. The highest recall in the group was 0.604; the most precise tool managed 0.501. Against that test set, four in ten attacks got past the best-recall tool and half got past the most precise one. That is performance against a known corpus. Novel attacks with low similarity to a detector’s training data perform worse still.
This is not a product failure; it’s a reflection of the fundamental difficulty of the problem. Jailbreaks are an adversarial arms race, and any static detection model will degrade against new techniques. The implication for deployment:
-
Don’t rely solely on guardrails. Layer them with system prompt hardening, output validation, and monitoring. See AI Defense for layered defense patterns.
-
Monitor what’s being blocked. Patterns in blocked content are often early indicators of targeted attack campaigns. AI Alert tracks reported jailbreak campaigns and emerging techniques.
-
Update your guardrail models. Most commercial providers release model updates; subscribe to update notifications and test new versions against your corpus before promoting to production.
Recommendation by Team Profile
Startup/small team, cost-sensitive: self-hosted Llama Prompt Guard 2 open weights, or NeMo Guardrails where you need conversational policy as well as classification. Both run on your own infrastructure with no per-call fee, and both are maintained, which LLM Guard no longer is.
Mid-market, want managed service: Lakera Guard. Best scores on both published evaluations, reasonable pricing, minimal operational overhead.
Enterprise, existing ML security stack: Evaluate Prisma AIRS (formerly Protect AI Guardian) or Aporia based on whether a unified security platform or threat intelligence matters more. Neither has a published third-party detection score, so budget a pilot on your own traffic.
AWS-native deployments: Bedrock Guardrails is the strongest cloud-native option in the PINT scores. Measure the added latency in your own configuration, and supplement with Lakera if recall on your corpus falls short.
Track updates to this landscape at AI Sec Reviews and AI Sec Digest.
