IBM Granite Guardian
IBM's open-source guardrail model family that scores prompts and responses for jailbreaks, prompt injection, and harm
162+
GitHub Stars
2B-8B
Model Sizes
Apache 2.0
License
Overview
Granite Guardian is IBM's open-source family of guardrail models, fine-tuned from Granite base models to act as a judge over the inputs and outputs of an LLM pipeline. Instead of generating content, each model scores prompts and responses against a set of risk dimensions—jailbreak and prompt-injection attempts, harmful or profane content, social bias, and violence—plus RAG-specific risks like groundedness and answer relevance, and agentic risks like function-calling hallucination. The latest release, Granite-Guardian-4.1-8B, adds expanded "Bring Your Own Criteria" (BYOC) support, letting teams define custom judging rules (formatting, length, domain-specific policy) on top of the pre-baked detectors. Models range from lightweight 38M/125M HAP (hate/abuse/profanity) classifiers up through 2B, 3B, 5B, and 8B variants, so teams can trade off latency and accuracy for a given deployment.
The Verdict
Who Should Use IBM Granite Guardian?
Best For
- Teams already running watsonx or Granite models who want a native guardrail layer
- Self-hosted deployments that need risk detection to stay in-VPC rather than calling an external moderation API
- Applications needing more than binary block/allow—Granite Guardian outputs calibrated risk scores per category
- RAG and agentic/tool-calling systems that need hallucination and function-call-risk detection alongside prompt injection
- Teams wanting to define custom judging criteria via BYOC instead of relying only on fixed risk categories
Not Ideal For
- Teams wanting a drop-in hosted API with no model-serving infrastructure to manage
- Ultra-low-latency inline filtering where even the smallest classifier (e.g., DeBERTa-scale) adds too much overhead versus the 2B+ Guardian models
- Non-English-heavy workloads where language coverage hasn't been independently verified
- Teams that need a turnkey, pre-integrated firewall product rather than a model they must wire into their own pipeline
What's Great
- Covers a broad risk taxonomy in one family: jailbreak/prompt injection, harm, profanity, bias, RAG hallucination, and agentic tool-call risk
- Bring Your Own Criteria (BYOC) lets teams judge custom policies beyond the built-in detectors
- Multiple model sizes (38M HAP classifiers up to 8B) so teams can tune the latency/accuracy tradeoff
- Apache 2.0 licensed and downloadable from Hugging Face for fully self-hosted use
- Backed by a published technical report and benchmark methodology for risk-detection accuracy
Watch Out For
- Requires self-hosting or watsonx access—no standalone hosted moderation endpoint outside IBM's platform
- Larger variants (5B/8B) add meaningful inference cost and latency compared to lightweight DeBERTa-style classifiers built specifically for prompt injection
- Documentation and versioning span multiple generations (3.1, 3.2, 3.3, 4.1, HAP), which can make it unclear which checkpoint to pick for a new project
- As a judge/classifier model it still requires prompt-engineering the risk definitions correctly to get reliable scores, especially for BYOC criteria
Pricing
Open Source
Free
Apache 2.0 licensed weights, self-host or run via watsonx / Hugging Face
Hugging Face Hub
Free
Download individual model checkpoints (HAP 38M/125M through Guardian 2B-8B)
View all features & details
Key Features
- Judges both prompts and model responses for risk, returning a risk probability per category
- Detects jailbreak attempts and prompt injection alongside harm, profanity, bias, and violence
- RAG-specific checks: groundedness, context relevance, and answer relevance
- Agentic/tool-use checks: function-calling hallucination and tool-call risk
- Bring Your Own Criteria (BYOC, expanded in 4.1) for custom, domain-specific judging rules
- Lightweight HAP (hate, abuse, profanity) classifiers at 38M/125M parameters for low-latency filtering
- Larger Guardian checkpoints at 2B, 3B, 5B, and 8B parameters across the 3.1–4.1 generations
Use Cases
- Input-side prompt injection and jailbreak detection before a request reaches the main LLM
- Output-side moderation of generated responses for harm, bias, and profanity
- Hallucination scoring for RAG pipelines to flag ungrounded answers
- Risk scoring for agentic systems that make tool/function calls
- Custom policy enforcement (formatting, length, domain rules) via BYOC prompts
How It Compares
| Feature | Granite Guardian | LlamaFirewall (PromptGuard) | ProtectAI DeBERTa | Meta Llama Guard |
|---|---|---|---|---|
| Primary Focus | Broad risk taxonomy: injection, harm, RAG & agentic risk, custom criteria | Prompt injection / jailbreak detection | Prompt injection detection | Content-safety moderation (with injection coverage) |
| Model Size | 38M (HAP) up to 8B | ~86M (mDeBERTa-based) | ~86M (DeBERTa-based) | 1B-8B |
| Custom Criteria (BYOC) | Yes, expanded in 4.1 | No | No | No |
| RAG / Agentic Risk Checks | Groundedness, relevance, function-call risk | No | No | No |
| Inference Cost | Higher at 5B/8B, low at HAP tier | Very low—built for inline filtering | Very low—built for inline filtering | Moderate |
| License | Apache 2.0 | MIT | Apache 2.0 | Llama license (custom, some use restrictions) |
| Ecosystem | watsonx, Hugging Face, IBM Granite docs | Meta PurpleLlama project | Hugging Face, LangChain integrations | Meta Llama ecosystem |
User Reviews
Loading reviews...