Granite Guardian vs LlamaFirewall

Granite Guardian

One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.

LlamaFirewall

One scan() call runs several checks on the owner's machine and returns a short typed result. The last PyPI release is 1.0.3 from 29 May 2025, and its Prompt Guard loader imports a huggingface_hub class that current versions no longer export, so a fresh install needs older pins. The classifier weights also need Meta's manual approval.

Granite Guardian

1. Append the <guardian> block as the final user message, with the mode line, ### Criteria: and ### Scoring Schema:. Copy the strings from the model card, because no package builds them
2. Use the no-think instruction for gating and parse <score>. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens
3. Treat yes as the criterion being met, which for built-in criteria means the risk is present. Treat a missing <score> tag as a failed check
4. Pass retrieved text through documents= and tool schemas through available_tools= in apply_chat_template, not inside the message text
5. Under Ollama, set num_ctx in the request options. IBM's docs say the default context is short and long requests are truncated

LlamaFirewall

1. Pin huggingface_hub below 1.0 and a matching transformers 4.x before importing the Prompt Guard scanner from the 1.0.3 wheel, or install from main
2. Get access to meta-llama/Llama-Prompt-Guard-2-86M and set a Hugging Face token first. Without one the loader prompts for a login and a headless run stalls
3. Call scan_async inside a running event loop. scan() wraps asyncio.run and fails there. scan_async returns score 0.0 and reason default on every allow
4. Split text longer than 512 tokens yourself before a Prompt Guard scan. The library truncates and does not chunk
5. Do not feed a block reason back to the model. The Prompt Guard reason quotes the full scanned text, and the hidden ASCII reason decodes the hidden payload