Are provider-side safety controls enough?

For consumer use cases with tight prompt surfaces, sometimes. For enterprise deployments with retrieval, tool calling, and multi-turn agents, no. The attack surface expands with each of those features, and provider safety training addresses only the payload the provider sees, not the authorization context the deployer owns.

What is the difference between jailbreak and prompt injection?

Jailbreak targets the model's safety training. The attacker persuades the model to produce output the training would refuse. Prompt injection targets the application's use of the model. The attacker persuades the model to follow instructions embedded in untrusted input (retrieved documents, tool outputs, prior turns) instead of the developer's instructions. The two overlap heavily and share defense layers, so production deployments usually treat them together.

Which classifier vendor should we use?

The classifier landscape moves quickly. Meta's Llama Guard, Google's SafeSearch AI, Microsoft's Prompt Shield, Lakera Guard (now part of Check Point), and open-source models like PromptGuard and IBM's Granite Guardian all ship classifier weights or hosted services. The best AI security tools 2026 piece covers the current shortlist.

How often should we update the classifiers?

The novel-pattern rate is high. Production deployments should update input and output classifiers on at least a quarterly cadence, and immediately when a new attack pattern is disclosed against a widely-used framework. The ai red teaming workflow piece covers the test-fix-prove loop that generates the update cadence.

Does the layered pattern hurt user experience?

Adds tens of milliseconds to the request path when classifiers run in parallel with the model call. The dominant latency is still the model itself. False-positive management (prompts blocked that should have passed) is the primary UX cost, addressed through classifier tuning and an appeal path in the user interface.

What is the failure mode when the classifier is down?

Depends on the deployment's fail-open versus fail-closed setting. Fail-closed denies requests when the classifier is unavailable, which is the safer default for regulated deployments. Fail-open permits requests without classifier scoring, which suits deployments where availability outweighs jailbreak risk. The ai gateway fail-closed piece covers the pattern.

LLM Jailbreak Defense Patterns: The Layered Controls That Survive Real Production Traffic

An LLM jailbreak is a prompt or sequence of prompts that induces the model to produce output the model's safety training would otherwise refuse. Provider-side safety training reduces the success rate of common jailbreak patterns, but adversarial research demonstrates a steady flow of new patterns that succeed on the current-generation models. In production, treating provider-side safety as the only layer is a design that assumes the attacker never reads the safety research. The layered defense pattern that survives real production traffic runs three controls around the model. Each layer catches attacks the others miss. Each layer produces an audit signal. I want to walk through the pattern, the residual failure modes, and where each layer sits in the request path.

Provider safety catches the majority. The other layers catch the remainder that reaches production traffic anyway.

Layer one: input-side classifiers

The first layer sits between the calling application and the model. It scores incoming prompts against a classifier trained on known adversarial patterns: DAN prompts, "developer mode" prompts, role-play jailbreaks, prompt injection embedded in retrieved documents, prompt injection embedded in tool outputs, indirect injection via prior conversation turns.

The classifier's job is not perfect detection. The job is scoring, and the score feeds a policy decision. Prompts scoring above a high threshold get blocked at the boundary before reaching the model. Prompts scoring above a lower threshold pass to the model but get flagged in the audit stream for review. Prompts scoring at background rates pass unflagged.

Two classifiers dominate production deployments in 2026. Model-based classifiers (smaller LLMs trained specifically on prompt-attack detection) achieve higher recall on novel patterns at higher latency and cost. Rule-based classifiers (regex, keyword lists, structural pattern matches) achieve higher throughput and lower cost with lower recall on paraphrased attacks. Deployments frequently run both in sequence, with the rule-based classifier gating access to the model-based classifier.

The OWASP Top 10 for Agentic Applications 2026 piece covers the specific categories where input classifiers are the primary defense.

Layer two: output-side classifiers

The second layer sits between the model response and the calling application. It scores the model output against classifiers for policy violations that the input side could not predict: leaked system prompt content, leaked training data, unsafe code (SQL injection, XSS payloads, prompt injection intended for downstream systems), regulated data types (PII, PHI, PCI), competitor mentions, brand-off-message content.

The output-side classifier is the defense that catches successful jailbreaks the input side missed. A prompt that scored under the input threshold, either because the pattern was novel or because the attack was distributed across a conversation, still produces an output the output-side classifier can flag. The classifier's response options are the same as the input side: block, transform (redact, rewrite), or pass with flag.

The llm response content filter piece covers the transformation patterns.

Layer three: identity-aware policy at the request boundary

The third layer is the layer that limits what a successful jailbreak can accomplish. The first two layers operate on payload content. The third layer operates on the request path: which identity called which model with which tool set, and what data classifications the response is authorized to include for that identity.

The distinction matters when the jailbreak succeeds against the first two layers. A support agent that gets jailbroken into calling a refund tool with an out-of-scope amount still hits the tool-scoping policy the ai agent tool scoping piece covers. A customer service agent jailbroken into revealing another customer's data still hits the data-classification-to-identity policy that denies cross-customer PII in the response.

The layer produces the audit evidence regulators and incident-response teams need. When a jailbreak succeeds and produces impact, the incident review has to reconstruct which identity, which model, which policy version, and which classification. The ai audit logs format spec covers the fields.

The residual failure modes

The layered pattern does not eliminate jailbreak risk. Three residual modes persist.

Novel attack patterns. A jailbreak pattern that no classifier has seen scores below both input and output thresholds. The identity-aware policy layer is the only remaining defense, and it catches the pattern only if the impact of the jailbreak crosses an authorization boundary. A jailbreak that produces text (a policy violation but not a boundary crossing) reaches the calling application undetected.

Distributed attacks. A jailbreak that spans multiple conversation turns, with each turn scoring below individual-turn thresholds, evades classifiers that evaluate single turns. Session-aware classifiers that evaluate turn sequences catch some of these; not all.

Attacks on the classifier itself. Adversarial attacks on the classifier (prompts designed to fool the classifier into producing a low score for a jailbreak) are documented. The counter is classifier ensembles and adversarial training on classifier-specific patterns.

The residual risk is why identity-aware policy at the request boundary is the layer that limits blast radius, not just the detection layer. When the first two layers fail, the third contains the impact.

Regulatory framing

The EU AI Act's Article 15 sets three technical properties high-risk AI systems must achieve: accuracy, resilience, and cybersecurity, appropriate to the system's intended purpose. The AI Office's guidance on Article 15 lists resistance to prompt injection and jailbreaking as a specific resilience property.

The OWASP AISVS 1.0 standard shipped June 24, 2026 with 514 testable requirements. The requirements on prompt-injection input handling, output filtering, and per-request logging map to the three layers above.

DeepInspect

This is exactly what DeepInspect does. DeepInspect sits at the AI request boundary as an external enforcement layer that runs all three defense layers on every request. Input-side and output-side classifiers evaluate payload content. Identity-aware policy evaluates the request against the calling identity's authorization scope. The audit record includes the scores from each classifier, the policy decision, and the identity claim.

The three-layer pattern runs at sub-50ms p95 latency inline. Classifier updates deploy through the same policy-as-code pipeline that ships identity policies. The policy-as-code piece covers the deployment pattern.

Book a technical deep dive at deepinspect.ai.