Apppublic

ArvindAkula/owasp-llm-guardrail-demo

sourceHugging Faceapache-2.0updated 2mo agoView on Hugging Face

0likes

App README

OWASP LLM Top 10 (2025) — Guardrail Demo

An interactive walkthrough of the OWASP Top 10 for LLM Applications (2025), paired with a live pattern-based prompt-injection input guardrail — a Python port of the PromptInjectionGuardrail contributed to LangChain4j (PR #5619).

What this is

A defensive demo. Three tabs:

1.Guardrail playground — paste any input (or load a sketch) and watch the guardrail run: which patterns fired, in which OWASP LLM01 sub-category, at what severity, and in how many milliseconds. Includes benign controls so you can check for false positives.
2.The Top 10 — each 2025 risk with a plain-English explanation, a sanitised structural sketch, mitigations, and an honest note on whether an input guardrail is even the right control for it.
3.Pattern coverage — the 22 patterns broken out across six LLM01 sub-categories.

What this is not

There is no model endpoint here to attack and no working exploits. The payload sketches are truncated, defanged, or replaced with placeholders — they exist to teach the recognisable shape of each risk and to exercise the guardrail. The interactive surface is the defense.

The honest limitation

A pattern layer is fast and deterministic but evadable by novel obfuscation. My AgentGuard Bench results document a case where a regex bypass was missed by patterns and caught 100% of the time by a model classifier — at roughly a 6,000× latency cost.

Neither layer is sufficient alone. The demo makes this concrete: the LLM02 sketch, a politely phrased data-extraction probe, deliberately does not trip any pattern. That is not a bug in the demo — it is the gap the classifier layer exists to cover.

OWASP coverage mapping

Risk	Guardrail relevance
LLM01 Prompt Injection	Direct — the category the guardrail targets
LLM07 System Prompt Leakage	Direct — dedicated pattern class
LLM02 Sensitive Information Disclosure	Mitigation — cuts the delivery path
LLM06 Excessive Agency	Mitigation — stops hostile instructions reaching the agent
LLM05 Improper Output Handling	Partial — flags prompts soliciting executable output
LLM08 Vector & Embedding Weaknesses	Partial — applies when scanning retrieved content
LLM03, LLM04, LLM09, LLM10	Out of scope — training-time or infrastructure controls

Injection is the vehicle; disclosure and rogue agent actions are the payloads. The guardrail is a choke point, not blanket coverage — and the table says so.

Run locally

bash

pip install -r requirements.txt
python app.py

Related work

—LangChain4j `PromptInjectionGuardrail` (PR #5619) — the original Java contribution
—AgentGuard Bench — pattern vs. classifier guardrail benchmark
—The Guardrail Stack — two-axis taxonomy (placement × decision mechanism)

References

Built by Arvind Akula · Apache-2.0