Azure AI Content Safety (Prompt Shields) vs LlamaFirewall

Azure AI Content Safety (Prompt Shields)

Prompt Shields checks up to five retrieved documents for indirect injection, not only the user prompt. Needs an Azure subscription with a card, a resource and a region that has the feature, before the first call.

LlamaFirewall

One scan() call runs several checks on the owner's machine and returns a short typed result. The last PyPI release is 1.0.3 from 29 May 2025, and its Prompt Guard loader imports a huggingface_hub class that current versions no longer export, so a fresh install needs older pins. The classifier weights also need Meta's manual approval.

Azure AI Content Safety (Prompt Shields)

1. Send retrieved pages and tool results in the documents array of shieldPrompt, not in userPrompt, so document attacks are reported separately
2. Call text:shieldPrompt over REST with api-version=2024-09-01. The Python SDK 1.0.0 has no method for it
3. Keep each request under 10,000 characters across prompt and documents, and split long tool results
4. Create the resource in a region that lists Prompt Shields, since not every region has it
5. On F0 you get 5 requests a second. Queue checks or move to S0 before load testing

LlamaFirewall

1. Pin huggingface_hub below 1.0 and a matching transformers 4.x before importing the Prompt Guard scanner from the 1.0.3 wheel, or install from main
2. Get access to meta-llama/Llama-Prompt-Guard-2-86M and set a Hugging Face token first. Without one the loader prompts for a login and a headless run stalls
3. Call scan_async inside a running event loop. scan() wraps asyncio.run and fails there. scan_async returns score 0.0 and reason default on every allow
4. Split text longer than 512 tokens yourself before a Prompt Guard scan. The library truncates and does not chunk
5. Do not feed a block reason back to the model. The Prompt Guard reason quotes the full scanned text, and the hidden ASCII reason decodes the hidden payload