An agent that browses, reads email or opens files puts text written by strangers into its own context. The Prompt Guard 2 model card describes the risk: prompt injections "manipulate untrusted third-party and user data in the context window to make a model execute unintended instructions." This guide adds one check at that boundary. Each tool result is scored before the model sees it, and a flagged result is withheld or sent to a person.
\nThat check is one layer. Classifiers miss attacks, so keep the other layers too: give tools as little power as the task needs, ask a person before anything irreversible, and test the whole agent with AgentDojo.
\n| Tool | What it checks | Runs where | Use it on tool output for |
|---|---|---|---|
| Llama Prompt Guard 2 22M / 86M | Text that "explicitly attempts to override prior instructions" (binary benign/malicious) | Locally, CPU or GPU | The main injection check |
| LlamaFirewall 1.0.3 | Wraps Prompt Guard 2 plus hidden-ASCII, regex, CodeShield and AlignmentCheck scanners | Locally, except AlignmentCheck (a hosted LLM by default) | Hidden Unicode text, known strings, unsafe generated code, auditing the agent's next action |
| Llama Guard 4 12B | Content safety: MLCommons hazard categories S1 to S13, plus S14 Code Interpreter Abuse | Locally, one GPU | Harmful content in inputs or outputs, not injection |
| HOL Guard | Agent actions and, per its README, "prompts and tool results" for prompt injection and sensitive content | Hooks in the agent harness | Coding agents where you can't edit the loop |
Llama Guard is a content-safety classifier, not an injection detector. Its own model card says it "may be susceptible to adversarial attacks or prompt injection attacks" and points to Prompt Guard 2 "for detecting prompt attacks". Use it if you also need to filter harmful content. The rest of this guide is about injection.
\nFrom the model card:
\nMeta's reported numbers:
\n| Model | AUC (English) | Recall at 1% FPR (English) | AUC (multilingual) | Latency, A100, 512 tokens | AgentDojo APR at 3% utility reduction |
|---|---|---|---|---|---|
| Prompt Guard 2 86M | 0.998 | 97.5% | 0.995 | 92.4 ms | 81.2% |
| Prompt Guard 2 22M | 0.995 | 88.7% | 0.942 | 19.3 ms | 78.4% |
| Prompt Guard 1 | 0.987 | 21.2% | 0.983 | 92.4 ms | 67.6% |
None of these figures is 100%, and they are Meta's own measurements on its own test sets. Plan for misses.
\nThe weights are gated. The Hugging Face repositories need an approved access request under the Llama 4 Community License. We had no approved account for this guide, so we did not download the model. Everything below was run, but the classifier was a stand-in. The last section, How we tested, has the details.
\nRequest access on the model page. After approval, download the files to a fixed directory, from a machine where you are logged in:
\nhf auth login\nhf download meta-llama/Llama-Prompt-Guard-2-22M --local-dir ./models/Llama-Prompt-Guard-2-22MYour agent then loads from that directory and needs no Hugging Face token or network access at run time.
\nThis module loads the classifier with local_files_only=True, so it can't download anything or prompt for a login. It splits the text into 512-token windows that overlap by 64 tokens, scores each window and keeps the highest score. The cookbook's inference utilities also take the maximum over chunks. The module also counts characters from the Unicode Tags block, which render as nothing but can carry ASCII text. Input that needs more than max_chunks windows is flagged instead of being partly scored. The result holds numbers and flags only, never the text.
"""Screen untrusted tool or web output with Llama Prompt Guard 2 before an agent reads it.\n\nLoads the model from local files only: it never downloads and never asks for a\nHugging Face login. Results never include the screened text.\n"""\nimport unicodedata\n\nimport torch\nfrom transformers import AutoModelForSequenceClassification, AutoTokenizer\n\nTAG_CHARS = range(0xE0000, 0xE0080) # Unicode Tags block: invisible "hidden ASCII"\n\n\nclass Screener:\n def __init__(self, model_path, threshold=0.9, window=512, overlap=64, max_chunks=64):\n self.tok = AutoTokenizer.from_pretrained(model_path, local_files_only=True)\n self.model = AutoModelForSequenceClassification.from_pretrained(\n model_path, local_files_only=True).eval()\n labels = {v.upper(): int(k) for k, v in self.model.config.id2label.items()}\n if "MALICIOUS" not in labels:\n raise ValueError(f"no MALICIOUS label in {self.model.config.id2label}")\n self.bad = labels["MALICIOUS"]\n self.threshold = threshold\n self.window = window\n self.body = window - len(self.tok("")["input_ids"]) # leave room for [CLS]/[SEP]\n self.step = self.body - overlap\n self.max_chunks = max_chunks\n\n def chunks(self, text):\n ids = self.tok(text, add_special_tokens=False)["input_ids"]\n starts = range(0, max(len(ids) - self.body, 0) + self.step, self.step)\n return [ids[s:s + self.body] for s in starts] or [[]]\n\n @torch.no_grad()\n def score(self, text, batch=16):\n best = 0.0\n parts = self.chunks(text)\n for i in range(0, len(parts), batch):\n texts = [self.tok.decode(p) for p in parts[i:i + batch]]\n enc = self.tok(texts, truncation=True, max_length=self.window,\n padding=True, return_tensors="pt")\n probs = torch.softmax(self.model(**enc).logits, dim=-1)[:, self.bad]\n best = max(best, probs.max().item())\n return best, len(parts)\n\n def screen(self, text):\n hidden = sum(ord(c) in TAG_CHARS for c in text)\n fmt = sum(unicodedata.category(c) == "Cf" for c in text) - hidden\n n = len(self.chunks(text))\n if n > self.max_chunks: # fail closed rather than score part of it\n return {"flagged": True, "score": None, "chunks": n, "too_long": True,\n "tag_chars": hidden, "other_format_chars": fmt}\n score, n = self.score(text)\n flagged = score >= self.threshold or hidden > 0\n return {"flagged": flagged, "score": round(score, 4), "chunks": n,\n "too_long": False, "tag_chars": hidden, "other_format_chars": fmt}The 0.9 threshold matches LlamaFirewall's default for its PromptGuard scanner. Tune it on a sample of your real tool output, because false positives are what make people switch a guard off. other_format_chars (zero-width spaces and similar) is reported but not blocked, since ordinary pages contain them.
Wrap every tool that returns outside text:
\nimport logging\nfrom screen_tool_output import Screener\n\nlog = logging.getLogger("screen")\nscreener = Screener("./models/Llama-Prompt-Guard-2-22M")\n\ndef guarded(tool_name, output):\n verdict = screener.screen(output)\n log.info("screened %s: %s", tool_name, verdict) # the verdict holds no tool text\n if verdict["flagged"]:\n return f"[{tool_name} output withheld: flagged as possible prompt injection, score {verdict['score']}]"\n return outputReturn the placeholder to the model so it knows the call happened. Keep the original in a quarantine store that a person can review. Don't put it in the same log as the verdict.
\nLlamaFirewall assigns scanners per message role. ToolMessage has the role Role.TOOL. With no configuration, tool messages get CodeShield and PromptGuard. When several scanners run, any BLOCK wins.
This configuration ran on CPU with no gated model and no API key:
\nfrom llamafirewall import LlamaFirewall, Role, ScanDecision, ScannerType, ToolMessage\n\nfw = LlamaFirewall({Role.TOOL: [ScannerType.HIDDEN_ASCII, ScannerType.REGEX]})\nresult = fw.scan(ToolMessage(content=tool_output))\nif result.decision != ScanDecision.ALLOW:\n ... # withhold or ask a personWhat we saw with llamafirewall 1.0.3:
ignore previous instructions|ignore all instructions.Role.USER, tool output passes unchecked.Gotchas with ScannerType.PROMPT_GUARD in 1.0.3, the latest release on PyPI (May 2025):
ImportError: cannot import name 'HfFolder' from 'huggingface_hub' with huggingface_hub 2.4.0. The repository's main branch has the fix, but it isn't released. Pin "huggingface_hub<1.0" (we used 0.36.2, with transformers 4.57.6) or use the screener above.meta-llama/Llama-Prompt-Guard-2-86M), and with no saved token it calls Hugging Face's interactive login(). In a non-interactive process that ended in EOFError.truncation=True, max_length=512. An injection further down a long page is never seen. Split long output yourself, as in the screener, before you hand it to the scanner.Full text: "..."). Don't send result.reason to shared logs.AlignmentCheck is different. Instead of looking at the tool output, it asks an LLM whether the agent's latest action still serves the user's original request. That can catch injections a classifier misses. In 1.0.3 the firewall builds it with fixed defaults: meta-llama/Llama-4-Maverick-17B-128E-Instruct-FP8 at https://api.together.xyz/v1, with the key in TOGETHER_API_KEY. It sends the whole trace, user request included, to that endpoint. Check that this is acceptable for your data before you turn it on. We did not run AlignmentCheck.
Run on 2026-11-03 on CPU (Python 3.13.5, torch 2.15.0+cpu, llamafirewall 1.0.3, codeshield 1.0.1).
\n"gated": "manual" on the Hugging Face API), and an unauthenticated download of config.json returned 401. We had no approved account, so we did not measure detection quality. The figures above are Meta's.microsoft/deberta-v3-xsmall checkpoint with an untrained two-label head. The tests checked these code paths:OSError at once, with no download or prompt