Guardrails currently uses Llama Guard 3 8B ↗ on Workers AI to perform content evaluations. The underlying model may be updated in the future, and we will reflect those changes within Guardrails.
Since Guardrails runs on Workers AI, enabling it incurs usage on Workers AI. You can monitor usage through the Workers AI Dashboard.
Guardrails evaluate content against the following hazard categories. Each category is identified by a code that appears in your Guardrail configuration and in AI Gateway Logs. You can independently set each category to Flag, Ignore, or Block for prompts and responses.
Guardrails evaluate categories S1 through S13, a subset of the Llama Guard 3 ↗ ↗ hazard categories, using the @cf/meta/llama-guard-3-8b model on Workers AI. The Llama Guard 3 category S14 (Code interpreter abuse) is not evaluated by Guardrails. Category P1 is prompt injection, evaluated separately by the @cf/meta/prompt-guard-2-86m model.
These codes also appear in the guardrails property of the AI Gateway REST API, where you configure each category's action programmatically. See the create and update methods.
| Code | Category |
|---|---|
S1 |
Violent Crimes |
S2 |
Non-Violent Crimes |
S3 |
Sex-Related Crimes |
S4 |
Child Sexual Exploitation |
S5 |
Defamation |
S6 |
Specialized Advice |
S7 |
Privacy |
S8 |
Intellectual Property |
S9 |
Indiscriminate Weapons |
S10 |
Hate |
S11 |
Suicide & Self-Harm |
S12 |
Sexual Content |
S13 |
Elections |
P1 |
Prompt Injection |
- Model availability: If at least one hazard category is set to
block, but AI Gateway is unable to receive a response from Workers AI, the request will be blocked. Conversely, if a hazard category is set toflagand AI Gateway cannot obtain a response from Workers AI, the request will proceed without evaluation. This approach prioritizes availability, allowing requests to continue even when content evaluation is not possible. - Latency impact: Enabling Guardrails introduces additional latency to requests. Typically, evaluations using Llama Guard 3 8B on Workers AI add approximately 500 milliseconds per request. However, larger requests may experience increased latency, though this increase is not linear. Consider this when balancing safety and performance.
- Handling long content: When evaluating long prompts or responses, Guardrails automatically segments the content into smaller chunks, processing each through separate Guardrail requests. This approach ensures comprehensive moderation but may result in increased latency for longer inputs.
- Supported languages: Llama Guard 3.3 8B supports content safety classification in the following languages: English, French, German, Hindi, Italian, Portuguese, Spanish, and Thai.
- Streaming support: Streaming is not supported when using Guardrails.