Filtrado de salidas (Llama Guard, NeMo)

¿Por qué filtrar las salidas?

Llama Guard

from transformers import AutoTokenizer, AutoModelForCausalLM
model = AutoModelForCausalLM.from_pretrained('meta-llama/Llama-Guard-3-8B')
# Outputs 'safe' or 'unsafe' with category.

NeMo Guardrails

# pip install nemoguardrails
from nemoguardrails import RailsConfig, LLMRails

config = RailsConfig.from_path('./config')
rails = LLMRails(config)
response = rails.generate(messages=[{'role': 'user', 'content': '...'}])

Guardrails AI

Clasificador constitucional de Anthropic

Filtro personalizado basado en LLM

FILTER_PROMPT = '''
Analyse the output. Return JSON: {safe: true/false, reason: str, categories: list}

Unsafe categories: PII leak, harmful instructions, copyright violation, prompt-injection echo.

Output:
{output}
'''

result = guard_llm.invoke(FILTER_PROMPT.format(output=text))

Filtros de regex y reglas

import re
EMAIL_RE = re.compile(r'[\w\.-]+@[\w\.-]+')
SSN_RE = re.compile(r'\b\d{3}-\d{2}-\d{4}\b')

def has_pii(text):
    return bool(EMAIL_RE.search(text) or SSN_RE.search(text))

# --- demo ---
samples = ['Contact me at jane@example.com', 'My SSN is 123-45-6789', 'No PII in this sentence']
for s in samples:
    print(f'{s!r} -> has_pii={has_pii(s)}')

Redacción de PII

def redact(text):
    text = EMAIL_RE.sub('[email]', text)
    text = SSN_RE.sub('[ssn]', text)
    return text

Filtro de dos capas

def filter_output(text):
    if has_obvious_pii(text):
        return BLOCKED
    result = guard_llm.invoke(...)
    return result

Salidas en streaming

buf = ''
for token in stream:
    buf += token
    if buf.endswith(('. ', '! ', '? ', '\n')):
        if not safe(buf):
            stream.close()
            emit_to_client('[content filtered]')
            break
        emit_to_client(buf)
        buf = ''

Falsos positivos frente a falsos negativos

Los registros del filtro son sensibles

log.warning('Blocked output', extra={'reason': r, 'category': c}, sanitize_payload=True)

Informe al usuario

def handle_privacy_request():
    return 'I cannot share that information for privacy reasons.'

print(handle_privacy_request())

Filtro multicapa

Resumen