NVIDIANVIDIA-Certified Professional: Agentic AI2026-107.1 Integrate NVIDIA NeMo Guardrails for compliance and safety enforcement.
Measure NemoGuard detectors on your traffic
Completed by the knowledge check
Learning objective
Integrate NemoGuard NIMs and measure detection quality, false positives, and latency overhead.
Core idea
A detector answers a specific classification question. Content safety, topic relevance, and jailbreak detection need different integrations and different labels. Combining them does not turn their individual scores into a single measure of application safety.
Evaluate the complete configured path: which detector ran, what policy it applied, whether it returned a usable verdict, and how much time it added before an allowed response reached the caller. See 7.1.1 for placement and 7.1.2 for configuration structure. This lesson focuses on the specialized model integrations and their measured operating point; 9.3.2 owns broader bias and toxicity test design.
How it works
Wire the detector to its documented interface
For content safety, declare a task model in models with a role such as type: content_safety, engine: nim, and the endpoint’s matching model identifier. A self-hosted OpenAI-compatible endpoint uses parameters.base_url. Activate content safety check input $model=content_safety under rails.input.flows and, when required, content safety check output $model=content_safety under rails.output.flows.
The $model reference must match a declared model role. Configure the corresponding prompt tasks, including content_safety_check_input $model=content_safety, with the prompt and output_parser appropriate to the chosen model. A model endpoint that answers HTTP requests is only one part of the integration: the verdict format must also match the checking action. NVIDIA’s Content Safety page includes an example using nvidia/llama-3.1-nemotron-safety-guard-8b-v3; select the actual endpoint and its documented prompt together.
For topic control, the documented example declares type: topic_control, engine: nim, parameters.base_url, and parameters.model_name: llama-3.1-nemoguard-8b-topic-control. Activate topic safety check input $model=topic_control. Define allowed topics in the prompt task topic_safety_check_input $model=topic_control. The flow appends the restriction requiring on-topic or off-topic, so the classifier’s output vocabulary is part of its interface.
NemoGuard JailbreakDetect uses a different path. Activate jailbreak detection model and configure rails.config.jailbreak_detection. NVIDIA’s hosted example uses nim_base_url: https://ai.api.nvidia.com, nim_server_endpoint: /v1/security/nvidia/nemoguard-jailbreak-detect, and api_key_env_var: NVIDIA_API_KEY. The API key comes from that environment variable. This detector needs no prompts.yml; do not route it as if it were a topic-control chat model.
Separate a safety verdict from detector failure
The Jailbreak Protection page explicitly documents fail-open behavior: connection failures, timeouts, and error responses allow the request, log the failure, and return no error to the caller. That behavior applies on both LLMRails and IORails. A successful application response therefore does not prove the jailbreak detector was available.
Include detector outage cases in integration tests and monitor detector availability separately from allowed/blocked outcomes. Pair the external detector with checks that do not depend on that service, as NVIDIA recommends. If the application requires a stronger outage response, its owner must implement and test that requirement around this documented behavior; the rail itself does not supply it. See 9.4.3 for risk-based failure and escalation policy.
An allowed verdict and a detector outage both end in a successful application response.
A content-safety refusal also needs diagnosis. For reasoning safety models, an insufficient completion budget can produce empty content with finish_reason="length"; the parser typically treats that empty verdict as unsafe. Set the corresponding prompt task’s max_tokens to cover reasoning plus the verdict, then retest. Counting every such block as a correctly detected harmful request would conceal a configuration defect.
Measure quality and overhead independently
Produce a labeled test set with expected allowed/blocked decisions for each detector’s purpose. For a policy where blocked is the positive class, compute recall as detected harmful cases divided by all harmful cases. Compute the false-positive rate as blocked benign cases divided by all benign cases. Precision divides correctly blocked harmful cases by all blocked cases. Keep detector errors in a separate result category so a timeout is neither a clean benign verdict nor a successful detection.
NVIDIA’s evaluation tools distinguish harmful prompts blocked from helpful prompts allowed. The documented nemoguardrails evaluate moderation --config=CONFIG_PATH workflow, where CONFIG_PATH is the configuration directory, uses a one-prompt-per-line dataset and helpful or harmful splits for its moderation evaluation. That workflow is not a published benchmark for every possible NIM combination. Retain its separate accounting of permitted and prohibited cases when building integration-specific replay tests.
Enable tracing.enabled to inspect executed rails, calls, errors, and timing. A FileSystem adapter can write a development replay to a chosen filepath. For production tracing, the OpenTelemetry adapter requires nemoguardrails[tracing] and application-level OpenTelemetry SDK configuration. Content capture is disabled by default; timing measurement does not require collecting prompt and response text.
Measure a matched workload with and without the selected detectors. Compare complete end-to-end latency distributions, plus individual detector timing, at the expected concurrency. A chain’s added p95 is not reliably calculated by summing each detector’s p95. Report allowed-request latency separately: early rejection can make the aggregate look faster while legitimate requests wait through every check.
Key distinctions and trade-offs
Choose detectors by the question they answer:
| Detector | Deciding condition | Mechanism | Cost or blind spot |
|---|---|---|---|
| Content safety | User or generated text may violate safety categories | content safety check input / content safety check output with $model | Adds model calls; safety does not establish topic relevance |
| Topic control | Permitted subject matter is narrower than general safety | topic safety check input $model=topic_control | Policy wording can reject legitimate adjacent questions |
| Jailbreak detection | Input may attempt to subvert instructions | jailbreak detection model and rails.config.jailbreak_detection | External detector outages remove this protection through fail-open behavior |
For independent I/O-bound checks without shared state, set parallel: True under rails.input or rails.output to overlap detector calls on LLMRails. Input mutations can race and change results; keep dependent transformations sequential. Parallel checks spend every detector call even when a sequential chain could stop after the first rejection.
The Guardrails Configuration page lists IORails parallel support for content safety check input, content safety check output, topic safety check input, and jailbreak detection model. Use Guardrails(config, use_iorails=True, require_iorails=True) to reject unsupported configurations at initialization instead of silently accepting fallback. Engine Feature Support lists input, output, and tool rails on IORails; dialog, retrieval, and custom-action execution require LLMRails.
Architecture / decision scenario
A travel company launches a customer itinerary assistant. The release owner requires at least 95% recall on each of 200 labeled jailbreak attempts and 100 prohibited-content requests, no more than 2% false positives on 1,000 benign travel requests, and at most 350 ms of added p95 latency for allowed requests at the scenario’s test concurrency of 32.
Candidate A combines jailbreak detection and content safety: it blocks 194 jailbreak attempts, 98 prohibited-content requests, and 15 benign requests, adding 290 ms. Candidate B adds a topic prompt: it blocks 196 jailbreak attempts, 98 prohibited-content requests, and 70 benign requests, adding 410 ms. These are hypothetical replay results. A tempting proposal chooses B for its higher attack count, but A meets all three targets while B violates both the benign-traffic and latency budgets.
The owner re-measures B on LLMRails with rails.input.parallel: True, after confirming its checks do not mutate shared input. Added p95 falls to 330 ms, but the 7% false-positive rate still fails the release target. Parallelism fixes that measured latency problem, not the topic policy. The owner provisionally selects A and asks the topic-policy owner to revise B. Before release, the integration owner disconnects JailbreakDetect and verifies the documented fail-open outcome separately from A’s 97% attack recall.
Common exam traps
- Using one endpoint shape for all three detectors.
- Reporting blocks without the harmful and benign denominators.
- Counting detector errors as successful safety decisions.
- Assuming a successful caller response means JailbreakDetect ran successfully.
- Using rejected-request latency to represent the allowed path.
- Treating input content safety as output checking or topic enforcement.
Where the exam guide differs
The objective uses “NemoGuard NIMs.” NVIDIA retains NemoGuard naming for TopicControl and JailbreakDetect, while its Content Safety documentation also uses Nemotron Content Safety and a Nemotron Safety Guard model identifier. Read an exam option by the classifier’s task and integration interface, rather than assuming the shared family name implies one model or endpoint.
What to remember
Bind each detector’s model role, flow, prompt, and endpoint correctly. Measure harmful recall, benign false positives, availability, and allowed-request latency separately. An outage and an unsafe verdict require different diagnoses, even when the application returns a superficially normal response.
Knowledge check
During a load test, the network path from NeMo Guardrails to the hosted NemoGuard JailbreakDetect endpoint is cut for ten minutes. Callers receive normal responses throughout, and no error reaches the application. What does this observation establish about that window?
LLMRails and ran the check locallyA release owner requires at least 95% recall on 300 labeled jailbreak attempts and at most a 2% false-positive rate on 2,000 benign requests. A replay of four detector configurations gives these scenario results:
- Candidate A blocks 288 attempts and 36 benign requests.
- Candidate B blocks 294 attempts and 56 benign requests.
- Candidate C blocks 282 attempts and 24 benign requests.
- Candidate D blocks 285 attempts and 44 benign requests.
Which candidate meets both targets?
A team’s LLMRails input rails run mask sensitive data on input, then content safety check input, then jailbreak detection model. To meet a latency budget, an engineer proposes setting rails.input.parallel: True. Which concern must the owner resolve before accepting the change?
LLMRails runs parallel input rails, parallelism does not revise the detectors’ policies or replace end-to-end measurement, and parallel checks spend every detector call rather than stopping early.After a team adds input detectors, the aggregate p95 latency of a scenario replay falls from 1.9 to 1.6 seconds; 30% of the replayed requests are attacks that the detectors reject. The owner must decide whether legitimate users still meet a 2-second p95 budget. What should the owner measure?
A travel assistant already uses content safety checks, but the owner also needs to reject harmless requests about subjects outside travel. The team has declared the documented topic_control model role and endpoint. Which addition connects that detector to the intended policy?
jailbreak detection model and put the subjects in its configurationtopic safety check input $model=topic_control and define its prompttopic_safety_check_input $model=topic_control prompt defines those boundaries. Content safety checks safety categories, bot instructions do not activate this detector, and JailbreakDetect uses its own integration for instruction-subversion attempts.References
- NVIDIA, Content Safety
- NVIDIA, Topic Control
- NVIDIA, Detect Jailbreak Attempts with NVIDIA NemoGuard JailbreakDetect NIM
- NVIDIA, Jailbreak Protection
- NVIDIA, Evaluate NeMo Guardrails Library Performance
- NVIDIA, Tracing Configuration for the NVIDIA NeMo Guardrails Library
- NVIDIA, Guardrails Configuration
- NVIDIA, Engine Feature Support