Google Cloud Model Armor vs LlamaFirewall

Google Cloud Model Armor

2 million free tokens a month, then $0.10 per million. OAuth only, and a template must exist in the same location as the endpoint before the first call.

LlamaFirewall

One scan() call runs several checks on the owner's machine and returns a short typed result. The last PyPI release is 1.0.3 from 29 May 2025, and its Prompt Guard loader imports a huggingface_hub class that current versions no longer export, so a fresh install needs older pins. The classifier weights also need Meta's manual approval.

Google Cloud Model Armor

1. Create one template per location you call from. A template in us-central1 doesn't answer on the europe-west2 endpoint
2. Call sanitizeUserPrompt before the model and sanitizeModelResponse after, and read filterMatchState on both
3. Treat EXECUTION_SKIPPED as unchecked, not clean. It means the input went over the filter's 65,536-token cap
4. Pin the template to the Stable alias and move off v1 and v2 before 17 December 2026. In asia-northeast3, v1 stays the Stable version
5. Retry 500, 502, 503 and 504 with truncated exponential backoff, and keep fan-out under the 1,200 queries a minute shared by the project

LlamaFirewall

1. Pin huggingface_hub below 1.0 and a matching transformers 4.x before importing the Prompt Guard scanner from the 1.0.3 wheel, or install from main
2. Get access to meta-llama/Llama-Prompt-Guard-2-86M and set a Hugging Face token first. Without one the loader prompts for a login and a headless run stalls
3. Call scan_async inside a running event loop. scan() wraps asyncio.run and fails there. scan_async returns score 0.0 and reason default on every allow
4. Split text longer than 512 tokens yourself before a Prompt Guard scan. The library truncates and does not chunk
5. Do not feed a block reason back to the model. The Prompt Guard reason quotes the full scanned text, and the hidden ASCII reason decodes the hidden payload