> For the complete documentation index, see [llms.txt](https://docs.mozilla.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mozilla.ai/any-guardrail/api-reference/index/prompt-injection/lakera-guard.md).

# Lakera Guard

Hosted API for prompt-injection, jailbreak, content-moderation, and PII detection.

Lakera Guard exposes a single `/v2/guard` endpoint that returns whether a message (or message list) was flagged. `validate(content)` accepts either a plain string (wrapped as a single user-role message) or a pre-formed chat-message list (`[{"role": "user", "content": "..."}]`), so both prompts and full conversations (including assistant turns) can be screened. By default this guardrail also opts into the endpoint's richer outputs so callers get the full picture of *why* something was flagged:

* `breakdown` (requested via `breakdown=True`): one entry per detector the policy ran, with its `detector_type`, whether it `detected` a threat, and an ordinal confidence `result` (`l1_confident` … `l5_unlikely` / `no_level`).
* `payload` (requested via `payload=True`): the string location (`start` / `end`), matched `text`, `detector_type`, and `labels` of any PII, profanity, or custom-regex matches.

Auth is via a bearer token; obtain an API key from <https://platform.lakera.ai/> (free Community tier: 10k requests/month) and set it via the `LAKERA_API_KEY` environment variable or pass it directly.

`GuardrailOutput` mapping: - `valid = not flagged`. - `score` is the highest detector confidence among *detected* threats, mapped from the ordinal level to a float (`l1_confident` → `1.0` … `l5_unlikely` → `0.2`, higher = riskier); `0.0` when nothing was detected. If `breakdown` is disabled, `score` falls back to `1.0` when flagged else `0.0`. - `categories` lists one `CategoryResult` per `breakdown` entry (`name` = `detector_type`, `triggered` = whether it detected, `score` = the mapped confidence). - `extra` carries the `flagged` flag, the `payload` list, the request `metadata` (`request_uuid`), the convenience `detected_detector_types` list, and `dev_info` when requested. - `raw` is the full Lakera response body (including the per-detector `breakdown`).

Research backing: - Pfister et al., *Gandalf the Red: Adaptive Security for LLMs* (<https://arxiv.org/abs/2501.07927>, 2025) introduces the D-SEC threat model and releases the 279k-prompt Gandalf attack dataset that informs Lakera's training pipeline. - The differentiator vs. OSS DeBERTa-based prompt-injection detectors is the proprietary Gandalf-derived training data: 1M+ players and 80M+ adversarial prompts collected via Lakera's public Gandalf challenge platform. The Gandalf paper shows OSS detectors underperform on adaptive attacks at scale.

For more information, see:

* [Lakera platform (API keys, free Community tier)](https://platform.lakera.ai/)
* [Product overview: prompt defense](https://www.lakera.ai/prompt-defense)
* [API docs: Guard](https://docs.lakera.ai/docs/api/guard)
* [API reference: screen content (`/v2/guard`)](https://docs.lakera.ai/api-reference/lakera-api/guard/screen-content)
* [Gandalf the Red: Adaptive Security for LLMs (arXiv:2501.07927)](https://arxiv.org/abs/2501.07927)

Brand transition note: Lakera was acquired by Cisco in 2025 and is being folded into Cisco AI Defense. The `docs.lakera.ai` API remains the public surface for now, with Pro/Enterprise tiers sales-gated through Cisco. Endpoint consolidation under Cisco AI Defense is expected within 12-18 months; expect the constructor's `endpoint` default to be revised at that point.

## Supported Models

* `lakera-guard`

## Constructor

| Parameter    | Type              | Required | Default                            | Description                                                                                                                                                                                          |
| ------------ | ----------------- | -------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `api_key`    | \`str             | None\`   | No                                 | `None`                                                                                                                                                                                               |
| `endpoint`   | `str`             | No       | `"https://api.lakera.ai/v2/guard"` | Lakera Guard API endpoint URL. Defaults to the v2 endpoint at `https://api.lakera.ai/v2/guard`; override for self-hosted or regional deployments.                                                    |
| `project_id` | \`str             | None\`   | No                                 | `None`                                                                                                                                                                                               |
| `breakdown`  | `bool`            | No       | `True`                             | If `True` (default), request the per-detector `breakdown` list, which also enables the graded `score` / `categories` mapping. If `False`, `score` degrades to `1.0`/`0.0` and `categories` is empty. |
| `payload`    | `bool`            | No       | `True`                             | If `True` (default), request the `payload` list locating PII / profanity / custom-regex matches (`start` / `end` offsets, matched `text`, `labels`), surfaced in `extra["payload"]`.                 |
| `dev_info`   | `bool`            | No       | `False`                            | If `True`, request Lakera build information (git revision, model version) in the response, surfaced in `extra["dev_info"]`. Defaults to `False`.                                                     |
| `metadata`   | \`dict\[str, Any] | None\`   | No                                 | `None`                                                                                                                                                                                               |

Initialize the Lakera Guard guardrail with the provided configuration.

Does not perform any network I/O — the API is only contacted when `validate()` is called.

## validate

Validate a string or chat-message list against the Lakera Guard API.

**Parameters**

| Parameter | Type  | Required                 | Default | Description |
| --------- | ----- | ------------------------ | ------- | ----------- |
| `content` | \`str | list\[dict\[str, str]]\` | Yes     | —           |

**Returns:** `GuardrailOutput`

## Benchmarks

No benchmark results recorded yet. See the [benchmark methodology](/any-guardrail/api-reference/benchmarks.md) for how numbers are harvested (published) or measured and added.

## License

* **Vendor:** Lakera
* **Default license:** `proprietary` (of the default model/service)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mozilla.ai/any-guardrail/api-reference/index/prompt-injection/lakera-guard.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.