PromptGuard vs LiteLLM
LiteLLM is an open-source AI gateway: one OpenAI-format API in front of 100+ LLM providers, with virtual keys, spend tracking and load balancing. Its guardrails either run its own content filter, which matches regex patterns and keyword lists, or hand each request to a guardrail provider you configure. PromptGuard is one of those providers. So the useful question is not which one to pick but which layer does which job: LiteLLM routes and meters, PromptGuard decides whether a prompt or a response is an attack or a leak.
We wrote this, so read it accordingly. Everything in the LiteLLM column was taken from their own public material, read 16 October 2026, and each claim links its source with the date we read it. Where their material does not state something we say that, rather than claiming they cannot do it. Our own figures come from the same constants the rest of this site renders, and what we say about how PromptGuard works follows our own documentation.
- What it is
- PromptGuard
A security layer: a detection engine that runs as a gateway in front of your provider, or behind another gateway through our guard API.
LiteLLMAn open-source AI gateway: one OpenAI-format API in front of 100+ LLM providers, with virtual keys, spend tracking, guardrails, load balancing and an admin dashboard.
Source: LiteLLM README, read 16 October 2026
- Using them together
- PromptGuard
Our guard API returns allow, block or redact for each scan, under the policy configured on your project, and on redact it returns the messages with the PII it found replaced. The same policy applies whether the call arrives through LiteLLM, one of our SDKs or our own gateway.
LiteLLMPromptGuard is one of LiteLLM's guardrail providers (`guardrail: promptguard`), in pre_call and post_call modes. A block decision rejects the call, a redact decision replaces the messages with the redacted ones, and block_on_error defaults to failing closed when our API cannot be reached.
Source: LiteLLM: PromptGuard guardrail, read 16 October 2026; LiteLLM PromptGuard hook source, read 16 October 2026
- Detection that ships with it
- PromptGuard
15 detectors across 6 layers; 46 PII entity types detected and redacted.
LiteLLMA built-in content filter that runs locally: prebuilt regex patterns for PII and credentials (for example US SSNs, emails, card numbers, AWS keys and GitHub tokens), custom regex and keyword lists, and keyword-based categories that include prompt injection. Other detection comes from third-party guardrail providers, each configured with its own API key and base URL.
Source: LiteLLM content filter, read 16 October 2026; LiteLLM guardrails quick start, read 16 October 2026
- Evidence behind the detection claim
- PromptGuard
F1 0.887, 95% CI [0.874, 0.900], across 2,369 samples from 8 datasets (5 independently published). Methodology and datasets named.
LiteLLMTheir repository publishes evaluations of the content filter's topic policies, such as investment advice, insults and discrimination, with the eval sets alongside. We found no published figure for its prompt-injection categories. Those evaluations measure a different task on different data, so we do not set them beside ours.Absence of a published claim, not of a capability.
Source: LiteLLM content filter eval results, read 16 October 2026; LiteLLM content filter eval sets, read 16 October 2026; LiteLLM content filter, read 16 October 2026
- Routing, fallbacks and spend
- PromptGuard
Routing rules: priority-ordered rules that rewrite the provider or model, and one retry against a failover provider when the primary returns a 5xx on a non-streaming request. Narrower than a dedicated gateway, by design.
LiteLLMLoad balancing, retry and fallback logic across deployments, virtual keys and multi-tenant spend tracking per project or user.
Source: LiteLLM README, read 16 October 2026
- Licence and pricing
- PromptGuard
Public. $0 with 20K requests/month and no card, then $99/month.
LiteLLMMIT-licensed outside the repository's enterprise directory. LiteLLM Enterprise adds features such as SSO, audit logs and per-key or per-team guardrails under a commercial licence; pricing is not published and depends on deployment size.
Source: LiteLLM licence, read 16 October 2026; LiteLLM Enterprise, read 16 October 2026; LiteLLM guardrails quick start, read 16 October 2026
- Runs inside your network
- PromptGuard
Managed cloud, hybrid self-host in your VPC, or air-gapped behind default-deny egress.
Choose LiteLLM when
- You need one API in front of many providers, with load balancing, fallbacks across deployments, virtual keys and spend tracking. That is what LiteLLM is for. Our own routing is deliberately narrower: priority-ordered rules that rewrite the provider or model, and one retry against a failover provider when the primary returns a 5xx on a non-streaming request.
- Your filtering needs are deterministic, such as keyword lists or patterns for emails, card numbers and cloud keys, and you want them to run locally with no external call. LiteLLM's built-in content filter does exactly that.
- You want the whole gateway as open source you can read and change. LiteLLM's core is MIT-licensed; our detection engine is not open source.
Choose PromptGuard when
- You already run LiteLLM and want a maintained detection engine in its guardrail slot. PromptGuard is a built-in LiteLLM guardrail: set `guardrail: promptguard` and run it before the model call, after it, or both.
- You need a detection claim you can check. Every number we publish names its dataset, its sample count and its confidence interval.
- You need injection detection that goes beyond keyword lists, including obfuscated and encoded attacks, which our pipeline normalizes before it detects.
Sources: LiteLLM README (read 16 October 2026) · LiteLLM: PromptGuard guardrail (read 16 October 2026) · LiteLLM PromptGuard hook source (read 16 October 2026) · LiteLLM content filter (read 16 October 2026) · LiteLLM guardrails quick start (read 16 October 2026) · LiteLLM content filter eval results (read 16 October 2026) · LiteLLM content filter eval sets (read 16 October 2026) · LiteLLM licence (read 16 October 2026) · LiteLLM Enterprise (read 16 October 2026) · Our guard API · Our gateway: routing rules and failover · Our benchmark methodology. Think we have something wrong? Tell us and we will correct it.
Secure your AI applicationin production
Get protected in under 2 minutes — swap a base URL, no code change. Every request is judged before it reaches the provider, in our cloud or entirely inside your network.