AI input moderation arrives in Firewall for AI

With LLM applications now central to customer-facing products, security teams face a new class of risk: a single crafted prompt can expose sensitive data, influence a model's future behavior, or push toxic content into user interactions. Cloudflare's Firewall for AI now includes unsafe content moderation directly in its existing rules engine, letting teams block harmful prompts at the network edge without touching application code.

The feature, built on Meta's Llama Guard model, is available immediately to current Firewall for AI users; others can request beta access through their account team. It addresses several entries in the OWASP Top 10 for LLM applications, including prompt injection, PII disclosure, and unsafe content, with detection handled in the same layer used for other application security controls.

Unlike the built-in moderation of individual model providers, Firewall for AI is model-agnostic. It sits in front of any LLM—third-party, self-hosted, or custom—and applies a consistent policy layer across all of them. Security teams define guardrails once and enforce them everywhere: a financial services firm, for example, could allow only finance-related prompts while blocking unrelated or sensitive topics for every model it runs.

Why prompt-level moderation matters

LLM interactions are inherently unpredictable, which is what makes them useful—and exploitable. Unsafe prompts can propagate misinformation, biased responses, or offensive content. Repeated harmful inputs also risk model poisoning, degrading output quality over time. The well-documented case of Microsoft's Tay chatbot shows the failure mode: trolls flooded the model with toxic prompts and it began repeating them, not because the model was flawed in isolation, but because there was no gate on the input side.

Llama Guard, an open-source model fine-tuned for content safety classification, analyzes prompts in real time across categories such as hate, violence, sexual content, criminal planning, and self-harm. With it running inside Firewall for AI, unsafe inputs can be blocked before they reach the model, while flagged content can be logged for review. These checks combine with existing protections like Bot Management and Rate Limiting to build layered defenses around an LLM endpoint.

Architecture: parallel detection with consistent latency

Keyword blocklists were an early attempt at unsafe topic detection but are trivially bypassed and context-blind. Probabilistic models like LDA improved recall but missed word order and nuance. LLMs capable of zero-shot and few-shot classification represent the practical breakthrough, which is why Cloudflare chose Llama Guard 3—based on the Llama architecture and fine-tuned specifically for content safety—for its detection engine.

The current deployment covers 13 default categories, with broader coverage planned. Teams should note that Llama 3's training has a fixed knowledge cutoff, so time-sensitive categories like defamation or elections may not fully reflect events after that point.

Under the hood, Firewall for AI uses an asynchronous design. When a request reaches a protected application, a Cloudflare Worker fans out parallel, non-blocking requests to each detection module—one for PII, one for unsafe topics, and more as they're added. Because the modules run concurrently, adding detections does not increase latency; response time is bounded only by the slowest model in the chain.

Llama Guard runs on Workers AI and Cloudflare's GPU fleet, with model instances scaling automatically under load. A hard two-second limit per analysis ensures that if a detection model stalls, the request falls back to whatever checks already completed, protecting application latency.

Enforcement through familiar rules

Once enabled, Firewall for AI exposes new fields in Security Analytics and expanded logs. Teams can filter by unsafe topic categories, track trends, and examine individual requests for detection outcomes—without the prompt text itself being stored or exposed.

From analytics, enforcement happens in Custom rules. A rule to log sensitive categories uses the expression:

If (any(cf.llm.prompt.unsafe_topic_categories[*] in {"S10" "S12"})) then Log

A broader block-all approach uses:

If (cf.llm.prompt.unsafe_topic_detected) then Block

Rules apply automatically to all discovered HTTP requests containing prompts, keeping guardrails consistent across AI traffic.

Roadmap

Upcoming Firewall for AI releases will add prompt injection and jailbreak detection, richer analytics visibility, and response-side controls that govern what an LLM outputs as well as what it accepts. Token-based rate limiting and additional safety categories are also planned. The beta is available today; both existing and prospective Cloudflare customers can reach out to their account teams to begin testing with production traffic.