Guardrails
without a GPU.

The checks

Prompt injection: deepset/prompt-injections test split plus hand-written indirect injections, wording chosen on a separate tuning split; Laya at threshold 0.30, Clef at the default 0.5 (see models). AUC 1.0 means the check separates the two perfectly, 0.5 is a coin toss. Small sets: measure on your own data.

One call per check

import os, requests

def check(text, template, model=None):
    r = requests.post(
        "https://layahost.com/v1/decide",
        headers={"Authorization": f"Bearer {os.environ['LAYAHOST_API_KEY']}"},
        json={"text": text, "template": template, **({"model": model} if model else {})},
        timeout=5,
    )
    r.raise_for_status()
    return r.json()

def chunks(text, size=3000):
    # Laya reads about 1,000 tokens and the API takes up to 32,000 characters:
    # check long pages piece by piece so nothing at the end goes unread.
    return [text[i:i + size] for i in range(0, len(text), size)] or [""]

page = fetch_page(url)  # whatever your agent just read
if any(check(c, "prompt_injection")["probabilities"]["injection"] > 0.3 for c in chunks(page)):
    page = "[removed: this page tried to give the assistant instructions]"

reply = check(llm_answer, "pii")
llm_answer = reply["redacted"] if reply["decision"] else llm_answer

To run several checks with one call, put the templates in a decision flow and call it as one endpoint; only the questions on the path are billed. Your own questions can also go together in one /v1/systemone request. Agents can call the same checks as tools through the layahost MCP server.

Pick the model per check

The pii check runs its own detector. The others run on Laya by default: about 0.1 s on our EU servers, $15 per million checks. For the hard ones, add "model": "clef-flash" or "clef": Cloudflare’s larger open decision models, 0.4 to 1 s, billed by input tokens. On our held-out indirect injections, Laya caught them all but also flagged three harmless texts in ten; Clef made no mistakes. Run your own examples through both in a test set and keep the cheaper one if it is good enough.

Llama Guard, NeMo Guardrails, LLM Guard?

They solve neighbouring problems, and you can combine them with layahost.

• Llama Guard (Meta) is an open safety classifier: an LLM you host on a GPU that labels prompts and responses against a fixed list of hazard categories. Choose it if you want a self-hosted model for that taxonomy. layahost checks are hosted, answer questions you write yourself, and cover injection and personal data as well.
• NeMo Guardrails (NVIDIA) is a toolkit for programmable rails around a conversation. It decides when to check and what to do next; a layahost call can be the check inside a custom action.
• LLM Guard (Protect AI) is a Python library of scanners that run their models locally. Good when nothing may leave your machines; layahost avoids hosting those models yourself.

Honest limits

• No guardrail is a security boundary on its own. Treat injection checks as one layer: also limit what tools an agent may call and ask a human before irreversible actions.
• Judging whether an agent’s tool call is risky is still hard for small models: our held-out test of Laya reached AUC 0.76 and caught 61% of risky calls. Use a larger model for that question and measure it on your own calls.
• English is measured; other languages work less reliably.
• Text only. Images and audio are out of scope.

What it costs

Each check is one decision on Laya ($15 per million, less on a plan), or billed by input tokens on Clef. $1 of free credit after email verification, no card. See pricing.