--- title: Developing LLM guardrail configs locally with NeMo... description: A hands-on walkthrough shows how to develop and test NeMo Guardrails prompt injection configurations entirely locally in a Jupyter notebook, without needing a... canonical: https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Developing LLM guardrail configs locally with NeMo Guardrails | daily.dev og:description: A hands-on walkthrough shows how to develop and test NeMo Guardrails prompt injection configurations entirely locally in a Jupyter notebook, without needing a... og:url: https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn og:image: https://api.daily.dev/og/posts/MOjfZKRcn.png og:image:alt: Developing LLM guardrail configs locally with NeMo Guardrails og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Developing LLM guardrail configs locally with NeMo Guardrails **[Red Hat Developer](https://daily.dev/sources/rhdev)** · 14 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough shows how to develop and test NeMo Guardrails prompt injection configurations entirely locally in a Jupyter notebook, without needing a Kubernetes cluster, GPU, or cloud resources. Three approaches are compared: a trivial regex check (easily bypassed with a unicode obfuscation trick), a more nuanced regex set (still fooled by novel rephrasing and prone to false positives on innocent prompts), and a DeBERTa-based text classifier (protectai/deberta-v3-base-prompt-injection-v2, a 200M parameter model) that correctly handles 12 of 13 test prompts. The piece also introduces the new 'hf classifier check input' rail, contributed by Red Hat into NeMo Guardrails 0.23 and released in Red Hat OpenShift AI 3.5, and suggests layering regex and classifier rails for defense-in-depth. A follow-up article will cover scaling evaluation with EvalHub. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the hf classifier check input rail in NeMo Guardrails and where does it come from? The hf classifier check input rail passes user input to a Hugging Face text-classification model to detect issues like prompt injection, based on a named model configuration under config.hf_classifier. It is a feature contributed by Red Hat into NeMo Guardrails 0.23 and released in Red Hat OpenShift AI 3.5, letting you specify a model repo, task type, threshold, and blocked labels. _daily.dev surfaces updates like new NeMo Guardrails releases for teams building LLM safety layers._ ### Can a simple regex pattern reliably block prompt injection attacks like 'ignore all previous instructions'? No, a single literal regex pattern is trivially bypassed by minor obfuscation, such as swapping a letter for a visually similar unicode character (e.g. 'Ignóre' instead of 'Ignore'), which lets the attack slip through undetected. Even an expanded set of nuanced regex patterns still misses rephrased or novel attacks and produces false positives on innocent prompts like asking about laptop recovery mode. _Developers deciding between regex and ML-based guardrails can track real-world tradeoffs on daily.dev._ ### How accurate is the protectai/deberta-v3-base-prompt-injection-v2 model at detecting prompt injection attacks? Testing against 13 prompts covering benign queries, obvious attacks, subtle rephrased attacks, and false-positive-prone innocent prompts, the 200-million-parameter deberta-v3-base-prompt-injection-v2 model correctly classified 12 out of 13 cases, only missing one subtle roleplay-framed jailbreak attempt. It runs on CPU in about 90 ms per query after an initial ~750MB model download from Hugging Face. _Engineers evaluating prompt injection classifiers can follow benchmark results and updates via daily.dev._ ## Similar posts on daily.dev - [Evaluating LLM guardrail configs locally with EvalHub](https://daily.dev/posts/evaluating-llm-guardrail-configs-locally-with-evalhub-xoalu4ioe) · Red Hat Developer · 0 upvotes · 0 comments - [Configure input guardrails for an OpenShift AI voice agent](https://daily.dev/posts/configure-input-guardrails-for-an-openshift-ai-voice-agent-etxmshydw) · Red Hat Developer · 1 upvotes · 0 comments - [How to Self-Host a Validated AI Coding Assistant with NVIDIA NeMo Guardrails](https://daily.dev/posts/how-to-self-host-a-validated-ai-coding-assistant-with-nvidia-nemo-guardrails-r5uow8grh) · NVIDIA Developer · 0 upvotes · 0 comments - [Guardrails: Enterprise safety shields with Llama Stack](https://daily.dev/posts/guardrails-enterprise-safety-shields-with-llama-stack-pyyaptds7) · Red Hat Developer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#machine-learning](https://daily.dev/tags/machine-learning), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Developing LLM guardrail configs locally with NeMo Guardrails","url":"https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn"},"datePublished":"2026-09-01T03:37:39.330Z","dateModified":"2026-09-01T06:17:46.724Z","description":"A hands-on walkthrough shows how to develop and test NeMo Guardrails prompt injection configurations entirely locally in a Jupyter notebook, without needing a...","image":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","thumbnailUrl":"https://media.daily.dev/image/upload/s--foaA6JGU--/f_auto/v1722860399/public/Placeholder%2004","isAccessibleForFree":true,"articleSection":"Red Hat Developer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Red Hat Developer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2a8895f3216c4900bdc455585a4ad3e4","url":"https://daily.dev/sources/rhdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,machine-learning,prompt-injection","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Red Hat Developer","item":"https://daily.dev/sources/rhdev"},{"@type":"ListItem","position":3,"name":"Developing LLM guardrail configs locally with NeMo Guardrails"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/developing-llm-guardrail-configs-locally-with-nemo-guardrails-mojfzkrcn#faq","mainEntity":[{"@type":"Question","name":"What is the hf classifier check input rail in NeMo Guardrails and where does it come from?","acceptedAnswer":{"@type":"Answer","text":"The hf classifier check input rail passes user input to a Hugging Face text-classification model to detect issues like prompt injection, based on a named model configuration under config.hf_classifier. It is a feature contributed by Red Hat into NeMo Guardrails 0.23 and released in Red Hat OpenShift AI 3.5, letting you specify a model repo, task type, threshold, and blocked labels. daily.dev surfaces updates like new NeMo Guardrails releases for teams building LLM safety layers."}},{"@type":"Question","name":"Can a simple regex pattern reliably block prompt injection attacks like 'ignore all previous instructions'?","acceptedAnswer":{"@type":"Answer","text":"No, a single literal regex pattern is trivially bypassed by minor obfuscation, such as swapping a letter for a visually similar unicode character (e.g. 'Ignóre' instead of 'Ignore'), which lets the attack slip through undetected. Even an expanded set of nuanced regex patterns still misses rephrased or novel attacks and produces false positives on innocent prompts like asking about laptop recovery mode. Developers deciding between regex and ML-based guardrails can track real-world tradeoffs on daily.dev."}},{"@type":"Question","name":"How accurate is the protectai/deberta-v3-base-prompt-injection-v2 model at detecting prompt injection attacks?","acceptedAnswer":{"@type":"Answer","text":"Testing against 13 prompts covering benign queries, obvious attacks, subtle rephrased attacks, and false-positive-prone innocent prompts, the 200-million-parameter deberta-v3-base-prompt-injection-v2 model correctly classified 12 out of 13 cases, only missing one subtle roleplay-framed jailbreak attempt. It runs on CPU in about 90 ms per query after an initial ~750MB model download from Hugging Face. Engineers evaluating prompt injection classifiers can follow benchmark results and updates via daily.dev."}}]} ```