Amazon Bedrock Guardrails vs Llama Guard 4

Amazon Bedrock Guardrails

ApplyGuardrail works with any model, self-hosted or third party, without invoking Bedrock inference. Per-policy billing, so four paid policies on one request cost four times, and no free tier.

Llama Guard 4

A single self-hosted model classifies text and multi-image prompts against 14 MLCommons-aligned hazard categories and answers in a few tokens. The weights have not changed since 29 April 2025, download access needs Meta's manual approval, and the licence withholds the grant from individuals and companies based in the European Union.

Amazon Bedrock Guardrails

1. Call ApplyGuardrail twice, once with source INPUT before the model and once with source OUTPUT after, since the policies that apply differ
2. Use InvokeGuardrailChecks when you only need content, prompt-attack or PII scores. It needs no guardrail id and runs in detect-only mode
3. Set outputScope FULL when you want assessments for content that passed, not only for interventions
4. Budget in text units of 1,000 characters per policy. A 5,000-character tool result is five units on every paid policy
5. Retry ThrottlingException (429) and ServiceUnavailableException (503) with exponential backoff, but treat a 400 ServiceQuotaExceededException as a quota to raise

Llama Guard 4

1. Request access on the Hugging Face page before anything else. Approval is manual, and the form cannot be edited after submission
2. Send only the user turn to check an input, and the user turn plus the model's answer to check an output. The template picks the role from the message count
3. Parse the first line for safe or unsafe and the second for category codes. Set max_new_tokens to about 10 and turn sampling off
4. Do not send an image with no text. Meta says the model is not an image-only classifier, and S14 is skipped when an image is present
5. Pair it with a prompt-attack detector. The card says the model can itself be moved by adversarial or injected text