NeMo Guardrails vs Guardrails AI vs Lakera: Buy the Detector

Buy Lakera if your prompts are allowed to leave your network, run NeMo Guardrails with classifier rails if they are not, and start nothing new on Guardrails AI. These are not three versions of one product. Lakera is a hosted detection service, which Check Point announced it was acquiring on September 16, 2025. NeMo Guardrails and Guardrails AI are open-source frameworks that run detectors you still have to choose, host and tune — and Guardrails AI's hosted pieces were switched off in August, two weeks before its founders joined Harvey.

Every number below is normalised to one workload: a customer-facing agent handling 1 million turns a day (about 12 requests a second on average), roughly 1,000-character user prompts, with one check on the input before the model call and one on the output after it — about 2 million screening calls a day. Prices were checked on the vendors' own pages on September 19, 2026.

	Lakera (Check Point)	NeMo Guardrails (NVIDIA)	Guardrails AI
What it is	Hosted detection API; self-hosting only on an Enterprise licence	Apache-2.0 framework that orchestrates "rails"	Apache-2.0 framework that chains validators
What it inspects	User input, model output, tool calls, tool responses, RAG documents	Input, dialog, retrieval, execution (tool I/O) and output rails	Input and output Guards around the text you pass it
Injection detector	Its own, vendor-maintained	Bring one: NemoGuard JailbreakDetect, an LLM self-check, or a third party	Bring one: a jailbreak validator wrapping a community classifier
Published added latency	p95 50 ms (1,000 chars, 1 detector) to 300 ms (5,000 chars, 16 detectors), plus network	p95 +0.41 s for the first NIM rail, +0.69 s for three (NVIDIA's own test; averages +0.38 s / +0.53 s)	54 ms GPU / 283 ms CPU per jailbreak check (vendor, Dec 2024)
Where prompt text goes	Check Point's cloud, logged by default	Wherever your rail models run	Your own process, since hosted inference shut on Aug 6, 2026
Price (Sept 19, 2026)	Free Community tier, 10,000 requests/month; Enterprise is quote-only	Free; production NIMs need NVIDIA AI Enterprise, from $4,500/GPU/year	Free; no vendor support announced since the Harvey deal
Verdict	Buy if prompts may leave your network	Pick if they may not	Don't start new deployments

The whole argument in one line: the thing that actually recognises a prompt injection is a detector — a classifier trained on attacks — and only one of these three products is one. The other two decide where checks run and what happens when one fires. That is useful, and for regulated data it may be mandatory, but it means the quality of your filter is set by a model you pick separately.

---

What Does Each One Actually Inspect?

NeMo Guardrails has the widest inspection surface, Lakera covers the same agent paths through one API call, and Guardrails AI inspects only what your code hands it. A runtime guardrail is a check that runs on every request, between your application and the model, and can block, rewrite or flag the text passing through. The buying question is which text.

• NeMo Guardrails defines five rail types in its repository: input rails on the user message, dialog rails that steer the conversation, retrieval rails "applied to the retrieved chunks" in a RAG pipeline, execution rails "applied to input/output of the custom actions (a.k.a. tools)," and output rails. Retrieval and execution rails are the ones that matter for agents, because indirect prompt injection — an instruction hidden in a web page, an email or a tool result — arrives through exactly those paths, not through the user.
• Lakera screens a whole conversation per call. Its Guard API accepts user input and model output, a system prompt passed separately so it is not itself flagged, retrieved documents as extra messages, and assistant tool_calls plus tool responses, which it treats as untrusted content. Its policy catalogue groups detectors into prompt defense, data leakage prevention, content moderation, malicious links and agent behaviour.
• Guardrails AI "runs Input/Output Guards in your application," per its repository. A Guard chains validators — small packages that each check one property, such as "contains no PII" or "matches this regex." Retrieved chunks and tool results are checked only if your code routes them through a Guard. Its original strength was never injection; it was forcing a model's output into a valid structure.

The products compose. NeMo's documentation lists Guardrails AI and Microsoft Presidio among its PII integrations, so a NeMo deployment can run Guardrails validators as rails. And if you already operate Kong AI Gateway, Kong ships a Lakera Guard plugin that inspects the request "before any data leaves the gateway toward the target LLM" and the buffered response before it returns — which puts the check in the layer that already sees every call, the argument we made in the AI gateway comparison.

---

How Much Latency Does Each Add Per Request?

Lakera publishes a p95 of 50–300 ms plus your network round-trip; NVIDIA's own benchmark puts three purpose-built NeMo rails at about 0.7 s of added p95, and NeMo's self-check rails cost a full model call each. Guardrails AI publishes no tail figure at all, and every number here is vendor-measured, so treat each one as a starting hypothesis for your own load test.

Lakera. Its evaluation guide gives p95 latency of 50 ms for about 1,000 characters screened by one detector, 100 ms for the same text with 16 detectors, and 300 ms for about 5,000 characters with 16 — and warns that "latency figures are only meaningful with those conditions attached." On our workload, a full-policy input check sits near the 100 ms line; an output check on a long answer drifts toward 300 ms. Add the round-trip to the nearest regional endpoint.

NeMo Guardrails. The cost depends entirely on which rails you configure. The simplest ones to set up — self-check input and self-check output — "prompt the LLM using a custom prompt," so each is another model call, and NVIDIA's self-check documentation warns that their performance "is strongly dependent on the capability of the LLM to follow the instructions" and that longer check prompts add tokens and latency. One user's multi-rail configuration was, in their words in issue #743, "making 3 calls to LLM." Swap in NVIDIA's purpose-built NemoGuard models and it gets better: NVIDIA's own benchmark measured average response time rising from 0.91 s with no guardrails to 1.29 s with content safety, and 1.44 s with content safety, topic control and jailbreak detection together, in front of Llama 3.1 70B. The tails in the same table are wider: p95 rose from 0.97 s to 1.38 s and then 1.66 s. Running rails in parallel helps for I/O-bound checks, but NVIDIA's parallel-rails tutorial warns that input-rail mutations "can lead to erroneous results" through race conditions.

Guardrails AI. The framework overhead is small — its performance guide says a guard "runs in sub-10ms" and validators should add "around 100ms" — but ML validators "can run in milliseconds on GPU-equipped machines, while they may take tens of seconds on normal CPUs." The company's December 2024 benchmark put its jailbreak validator at 54 ms on GPU and 283 ms on CPU. The real tail risk is the reask action: when a validator fails, Guardrails re-prompts the LLM with the error, which is a whole second generation.

Normalised to 2 million checks a day: Lakera adds roughly 100 ms of p95 per check plus the network; NeMo with self-check rails adds one model call per rail, billed at your LLM's token price; NeMo with NIM classifiers adds about 0.4–0.7 s at p95 on GPUs you run; Guardrails AI adds whatever your validators cost wherever they execute — which, since August, is your own hardware.

---

Does It Catch Prompt Injection? The Evidence, Not the Claims

No independent study has tested all three side by side, and the independent numbers that do exist are far worse than the vendor numbers. That gap is the most important fact on this page.

What the vendors say:

• Lakera tops its own PINT benchmark at 95.22% (tested May 2, 2025), ahead of AWS Bedrock Guardrails at 89.24% and Azure AI Prompt Shield at 89.12%. Lakera built the benchmark, and the dataset blends public and proprietary data. It is a vendor claim.
• NVIDIA's model card for NemoGuard JailbreakDetect reports an F1 of 0.9601 and a 0.42% false-positive rate on the JailbreakHub dataset. The model is a random forest over snowflake-arctic-embed-m-long embeddings, trained on about 8,200 examples.
• Guardrails AI's blog put its jailbreak validator at an F1 of 0.8152 and said it "outperforms the top open source and proprietary jailbreak detectors."

What independent researchers found:

• The InjecGuard paper tested Lakera Guard: 87.61% accuracy on over-defense (benign prompts that merely look like attacks — a strong result) and 90.89% on benign prompts, but 53.19% on malicious ones. Roughly half the injections got through. That version is dated March 2025 and Lakera updates its model continuously, so treat it as a floor from an older release — but it is the only academic measurement of Lakera found for this piece.
• Hackett et al. attacked six detectors with character-injection tricks. NVIDIA's NeMo Guard Jailbreak Detect let through 72.54% of jailbreaks; Meta's Prompt Guard let through 70.44% of injections and 73.08% of jailbreaks. Emoji smuggling — hiding the payload inside emoji — "achieved a 100% ASR for both prompt injections and jailbreaks." Lakera was not in the test set.
• IBM Research built an input-moderation guardrail "inspired by the NeMo input moderation guardrail" on Vicuna-13B. In-distribution precision was 0.311 — more than two of every three flags were false alarms — falling to 0.029 out of distribution, at 0.49 s per sample on a V100 GPU. That is the self-check pattern with a mid-sized open model, which is exactly the setup NVIDIA's own docs warn about.
• A 2026 study of prompt-injection defences for LLM tutors found NeMo Guardrails reached 0% bypass, but at a 16.22% false-positive rate and roughly 1.5 s of latency; Prompt Guard allowed 38.48% bypass at a 3.60% false-positive rate.

The pattern is consistent across every source: lab F1 between 0.8 and 0.96, adversarial evasion between 50% and 100%, and false-positive rates that swing by an order of magnitude with configuration. A detector is a tripwire. It is not a wall.

---

Where Does the Prompt Text Go?

Lakera sends it to Check Point's cloud and logs it by default; NeMo sends it wherever your rails run; Guardrails AI now keeps it in your process. For many regulated buyers this question decides the comparison before latency does.

Lakera. "By default, we record all prompts and model outputs from the screening request for display in the dashboard and for analysis," says its platform documentation. Administrators can switch prompt logging off, and detected PII is redacted before anything is stored. Processing runs in the US, US East, US West, the EU (Ireland) or Singapore, but per the data-regions page the default storage region is EU and it is fixed at organisation creation — it cannot be changed later. Keeping inference inside your own Kubernetes cluster requires "a valid AI Guardrails Enterprise license" plus registry credentials from Check Point, per the self-hosting guide.

NeMo Guardrails. The framework runs in your process or as its own guardrails server. But self-check rails send the prompt to whichever LLM you configured — if that is a hosted API, your guardrail shares its data path. NemoGuard models can run on your own GPUs; NVIDIA's NIM FAQ says production use requires an NVIDIA AI Enterprise licence, which "start[s] at $4500 per GPU per year or ~ $1 per GPU per hour in the cloud," while development and experimentation are free on up to 16 GPUs. Budget GPUs the way you would for any self-hosted model — the operating cost is the same one we priced in the inference runtime comparison.

Guardrails AI. Its hosted validation endpoints were "shut down on August 6, 2026". Validators now run in-process with use_local=True, or against an inference endpoint you host. The prompt stays home — and the validator's model weights now load inside your API worker.

---

Why Guardrails AI Loses This Comparison

Guardrails AI loses because it has no injection detector of its own, no hosted service and, since September 9, no founding team. That is not a judgement on the code, which is good.

Steel-man it first. The framework is Apache-2.0, runs in-process with no third party in the data path, is excellent at validating structured output, and its 0.11.0 release on August 14 moved validators to ordinary public PyPI packages — the more survivable architecture. NeMo can even call its validators.

Now the problem. Its jailbreak validator's standalone repository is archived, the code moved into the Hub monorepo; the README says it "wraps the excellent work done by jackhhao/jailbreak-classifier," a community model, with a default threshold of 0.9. The guardrails hub install command and private registry died on August 25, per GitHub issue #1560. Then Harvey announced that co-founders Shreya Rajpal and Zayd Simjee are joining its product and engineering organisation. Harvey is a legal AI company; nothing in its business requires it to ship a general-purpose injection detector to your request path. Our analysis of that deal covers what to pin and mirror.

For a control that sits in every request and faces attackers who change technique weekly, the question that matters is who ships the next model. For Guardrails AI there is no answer. Keep it for schema validation and deterministic checks — regex, PII via Presidio. Do not make it your injection defence.

---

Who Should Not Pick Each One

Every option here has a buyer it will hurt, and naming them is more useful than another feature matrix.

Don't pick Lakera if:

• Prompt text cannot legally leave your network and you will not sign an Enterprise contract for the self-hosted build.
• Procurement needs a price before a sales call. Enterprise is quote-only, and the free Community tier is capped at 10,000 screening requests a month — about seven minutes of one day at our 2-million-call workload.
• You would rather not have your detector's roadmap set by a network-security vendor's "end-to-end AI security stack." That is a platform strategy, and it will shape what gets built next.

Don't pick NeMo Guardrails if:

• Nobody on your team runs GPUs and model servers today.
• Your latency budget is tight — voice, autocomplete — and you were planning to rely on LLM self-check rails.
• You need every upgrade to be boring. An open issue filed September 6 against version 0.24.0 reports the ONNX build of the jailbreak classifier marking "Hello" and "What is Python?" as jailbreaks, while the pickled model scored "Hello" at 0.0085. NeMo is actively maintained — 0.24.1 shipped September 16 — but a fast release train means you re-test the detector on every bump.

Don't pick Guardrails AI if:

• You need prompt-injection detection at all, or anyone accountable when it misses.

---

What Still Gets Through, and What Tuning Costs

Obfuscated payloads and indirect injection still get through all three, and tuning is a standing cost paid in false positives, not a setup task. OpenAI itself says prompt injection is "unlikely to ever be fully 'solved'".

The newest independent benchmark makes the trade-off explicit. PIDS-Bench, posted September 14, 2026, swept every decision threshold on three detectors its authors trained and found none that reached an F1 of 0.95 while keeping false positives on hard, security-adjacent benign prompts at or below 10%. Meta's PromptGuard 2 scored an F1 of 0.539 on the benchmark's in-distribution split. In plain terms, you choose between missing attacks and blocking legitimate customers, and the threshold is a policy decision someone must own.

What that tuning costs, per product:

• Lakera exposes policies from L1 (lenient) to L4 (strict), advises you to "start lenient," and says a successful evaluation typically reaches about 0.1% false positives on production data, per its evaluation guide. Getting there needs a labelled set of your own benign traffic.
• NeMo Guardrails makes you choose, per rail, between an LLM self-check (flexible, slow, model-dependent) and a classifier (fast, brittle to obfuscation), then rewrite prompts and re-test on each release.
• Guardrails AI leaves thresholds, model hosting and reask budgets entirely to you.

The guardrail is detection. The control is what the agent is allowed to do when detection fails: deny rules that are enforced rather than requested, as in the Claude Code auto-mode change, and scoped agent credentials, as covered in the agent identity comparison.

---

How to Decide: Five Questions That Predict Regret

The criteria that predict regret are data path, agent surface, latency budget, detector ownership and exit cost — in that order.

1. Can prompt text leave your network? Yes → Lakera. No → NeMo, or Lakera self-hosted if you will pay for Enterprise.
2. Do your agents read tools, web pages or retrieved documents? Then screening only the user's message is theatre. You need Lakera's tool-response screening or NeMo's retrieval and execution rails.
3. What is your p95 budget for the whole turn? If guarding must fit in about 300 ms, rule out LLM self-check rails.
4. Who retrains the detector when attacks change? Check Point for Lakera, NVIDIA's model releases for NemoGuard, or you.
5. What does leaving cost? Lakera is one HTTP call — swappable in a sprint. NeMo's Colang flows and rail configs are the stickiest artefact in this comparison.

What changes the answer: if you already run on AWS, Bedrock's ApplyGuardrail API evaluates any text you pass it, including output from models hosted elsewhere, and belongs in your bake-off. If you already run Kong, its Lakera plugin removes most of the integration work.

---

What to Do Before Your Next Release

This Week:

1. Map where screening happens today. If it is on the user's message only, the retrieval and tool paths are your open door.
2. Grep builds for guardrails hub install. It has been dead since August 25; a cached layer is hiding the break.
3. Pull 1,000 real benign prompts from production logs and label them. This is your false-positive set, and no vendor can supply it.

This Month:

1. Run a bake-off on your own traffic: a Lakera Community key (10,000 requests is enough for a test), NeMo with NemoGuard JailbreakDetect, and whatever you run now. Measure added p95 and false-positive rate, plus an attack set that includes emoji smuggling and Unicode-tag variants from Hackett et al.
2. If you choose NeMo, replace self-check rails with classifier rails wherever latency matters, pin the version, and re-run the benign set on every upgrade.
3. If you choose Lakera, decide prompt logging and storage region before creating the organisation. The region cannot be changed afterwards.

Before Q4 Budget Close:

1. Get the Lakera Enterprise quote in writing with the self-hosted option priced, even if you start on SaaS.
2. Write down which layer owns guardrailing — gateway, framework or model provider — the way the 2026 agentic stack guide frames it. The layer inherited from a quickstart is the one nobody tunes.

---

The Bottom Line

The market sold "guardrails" as one category. It is three: a detector, an orchestrator and a validator library, and most regret comes from buying one while believing you bought another. The closest precedent is the web application firewall. Nobody serious believed a WAF made SQL injection impossible; they bought one for telemetry and virtual patching, and they parameterised their queries anyway. For agents, least privilege is the parameterised query, and the detector is the WAF.

Buy the detector. Own the permissions. Measure the false positives yourself — nobody else will.

Continue Reading

• Guardrails' Hub Died Aug 25. Harvey Bought the Team.
• OWASP's LLM Top 10 Is 29 Votes. The Data Disagrees.
• The 2026 Agentic AI Stack: 8 Layers, 3 You Can Skip
• AI Gateway vs API Management: No Managed Gateway Caps Your Spend
• An Eval Sandbox Gave Up Its Keys. Your Gateway Holds Yours.
• How to Red-Team Your AI Agents Before Production
• Braintrust vs Langfuse vs Promptfoo: Don't Pay for the Gate