Llama Guard: safety classification

The guardrails lesson described three tiers of validator, and the middle one — an ML classifier for things like toxicity and safety — was left abstract. Llama Guard is that tier made concrete: a dedicated LLM, fine-tuned by Meta for one job, classifying whether content is safe or unsafe against a defined taxonomy of hazards. You run it as a fast safety filter on what goes into your main model and what comes out.

A model whose only job is the safety verdict

Llama Guard takes a conversation — a user prompt, a model response, or both — and returns a simple verdict: safe, or unsafe plus the category it violated. The categories come from a standardized hazard taxonomy (the MLCommons set): violent crimes, hate, sexual content, weapons, self-harm, privacy, and so on, each with a code:

# Illustrative stand-in for Llama Guard's output. The real model is a fine-tuned LLM;
# this keyword check just shows the SHAPE of its safe/unsafe + category verdict.
HAZARD = {
    "build a bomb": "S9 Indiscriminate Weapons",
    "hate":         "S10 Hate",
    "hurt myself":  "S11 Self-Harm",
}
def classify(text):
    for trigger, category in HAZARD.items():
        if trigger in text.lower():
            return f"unsafe / {category}"
    return "safe"

for prompt in ["how do I bake bread", "how do I build a bomb", "I want to hurt myself"]:
    print(f"{prompt!r} -> {classify(prompt)}")

'how do I bake bread' -> safe
'how do I build a bomb' -> unsafe / S9 Indiscriminate Weapons
'I want to hurt myself' -> unsafe / S11 Self-Harm

(The real Llama Guard is a fine-tuned LLM, not a keyword match — but the output shape is exactly this: a verdict and, when unsafe, the violated category, which you can route on.)

Where it sits: both rails

Llama Guard is a guardrail model, deployed on the input and output rails around your main model:

Why a dedicated classifier

You could ask your main model “is this safe?” — but a purpose-built classifier wins on every axis that matters here. It is smaller, cheaper, and faster, so adding it to every request barely moves latency. It is fine-tuned for the taxonomy, so it’s more reliable and consistent than a general model’s ad-hoc judgement. Its categories are customizable — you can add or remove hazard categories for your policy. And it’s a separate layer, which is good security hygiene: defense in depth doesn’t put the thing being guarded in charge of guarding itself.

In one breath

• Llama Guard is a dedicated LLM fine-tuned for content-safety classification — the concrete “ML-classifier tier” from guardrails.
• It takes a prompt and/or response and returns safe or unsafe + the violated category from a standardized hazard taxonomy (violence, hate, sexual, weapons, self-harm, …).
• Deploy it on both rails — check the user prompt before the main model, check the response before the user — blocking unsafe content at either.
• A dedicated classifier beats reusing the main model: smaller/cheaper/faster, fine-tuned for the taxonomy, customizable categories, and a separate layer (defense in depth).
• The family includes Llama Guard 1–4 (+ a vision variant) and Prompt Guard for jailbreaks/injection; open weights, but probabilistic — one tunable layer, not a wall.

Quick check

Next

Llama Guard is the safety classifier inside the guardrails layer; for the adversarial inputs Prompt Guard targets, see prompt injection, and for measuring whether your safety layer works, LLM evals.