Security & Guardrails
Prompt injection defence, input/output guards, PII redaction and the security stack.
Security & guardrails
Production LLM systems face: prompt injection (user or retrieved content overriding instructions), data leakage (model revealing system prompt or PII), harmful outputs, and abuse (cost attacks, jailbreaks). The defence is layered: input guards (before the model), structured prompting (delimiters, primacy), output guards (before the user), and audit logging.
Why security matters
A prompt injection in a RAG system can exfiltrate your system prompt, access restricted documents (via the model), or generate harmful outputs attributed to your product. In regulated industries, PII leakage is a compliance violation. Security is not optional — it's a production gate.
Guardrail architecture
User input → input guard (injection classifier + PII redaction + length limit) → prompt construction (system prompt + delimiters around untrusted content) → LLM → output guard (secret detection + harmful content classifier + PII check) → audit log → response. Each layer fails closed (block on uncertainty).
Input + output guards
def handle(query: str, retrieved: list[str]) -> str:
prompt = f"Answer: {query}\n\nContext: {retrieved}"
return llm.generate(prompt)
# No input guard, no output guard, no delimiters, no audit.
# Injection via retrieved doc → model reveals system prompt.
# PII in query → sent to provider unredacted.
# Secret in output → leaked to user.Experiment: attack vectors
See how each guardrail defends against a specific attack.
What to observe
No single guard catches all attacks. Input guard catches user injection but misses retrieved-doc injection. Delimiters catch retrieved-doc injection. Output guard catches secrets and leaks. You need ALL layers — defence in depth. Even then, red-team regularly; sophisticated attacks evolve.
Production security
Production security: input + output guards, delimiters + system-prompt primacy, PII redaction, secret detection, audit log of every query + answer + blocked attempt, red-team injection test suite in CI, bypass monitoring (alert if bypass rate rises), per-tool output sanitisation (injection via tool result), and least-privilege tools (model can't do destructive things even when injected).
Challenge
Your RAG system started revealing the system prompt to some users. One user uploaded a document that 'broke' the assistant. Diagnose and fix. (See the 'Injection via Retrieved Documents' challenge.)
Production checklist
Production checklist
0 of 10 checked
Knowledge check
Retrieved documents contain injection. Where do you defend?
Complete
You can now build a layered security stack. This completes the Production AI Systems series — you can ship AI to production.
Mark this chapter as complete
Track your progress and unlock the next chapter.