AI teams · Safety
Apinizer's AI Gateway applies policy on the way in and on the way out — jailbreak detection, PII redaction, injection scoring, regex denylists, and policy-driven blocks — without changing the application.
The problem
Every model has a jailbreak; every prompt can carry PII; every completion can leak. The fix isn't waiting for a perfect model — it's putting a firewall in front of every model and a filter in front of every completion. Apinizer's AI Gateway does both: detect, redact, score, block, audit. Same plane as the API.
Capabilities
An attack wrapped in base64 is still an attack. Encoded content — base64, hex, URL encoding, unicode escapes, HTML entities — is decoded before any guard reads it, with depth and size ceilings so a decode bomb cannot stall a request. Only the inspection sees the decoded form; the body forwarded to the provider is never rewritten.
Preset pattern libraries score every inbound prompt, and an external guardrail engine — an LLM-as-judge endpoint, or any OpenAI-compatible judge (vLLM, Ollama) — gives a second opinion when a pattern is not enough. Versioned signature packs mapped to OWASP LLM Top 10 and MITRE ATLAS keep the pattern libraries current, and a drift channel tells you when yours is versions behind. Run it inline, async, or in shadow mode while you tune it.
Twelve built-in identifier types — TCKN, IBAN, Turkish phone, card, email, IP, passport, SSN, and more — validated by checksum before masking, so real identifiers get redacted and ordinary numbers do not. Applied to the prompt on the way in and the completion on the way out, including across streaming chunk boundaries. Where the workflow needs the real value back, the placeholder is restored for authorized roles only — deny-by-default, and every restore audited.
Fourteen hazard categories from the MLCommons AILuminate taxonomy ship built in, and a catalog screen adds your own without waiting for a release. The same check runs on streaming responses, so a completion that drifts into a blocked category is caught on the way out — and each guard decides for itself whether system, user, assistant, or tool messages are in scope.
Forged role sequences and model control tokens are caught structurally before the model sees a tampered conversation. MCP and A2A tool results run through the same masking pipeline as prompts, so a poisoned tool response is not a side door.
DLP presets catch credentials and secrets in both directions, and your own regex and element rules catch whatever else must not leave the model. Versioned built-in rule packs cover the 18 HIPAA Safe Harbor identifiers and PCI DSS cardholder data behind a fast-scan gate, and a file embedded in a body is identified by its signature bytes rather than the content type it claims. A block sticks across the whole exchange, not just the offending chunk.
Firewall rules ship as data, not code. Review in Git, apply via APIops, propagate to every Worker in seconds.
Every block and redaction captured with reason, score, and policy reference. Auditors and developers see the same explanation.
Use cases
Outbound filter detects 16-digit patterns adjacent to keywords. Blocked completions log an explanatory event; the user gets a safe fallback message.
Inbound redaction strips names, IDs, dates. The model summarizes; the completion is re-keyed back to the patient on the gateway side, never inside the model.
0 PHI to model
1.8% of citizen-chatbot prompts flagged jailbreak-suspicious. Half rerouted to a hardened model with a stricter system prompt; half blocked outright.
Documents uploaded by customers occasionally carry 'ignore previous instructions' patterns. Scorer blocks the prompt; SOC reviews the document offline.
Outbound filter blocks any response containing API keys or repo paths. Editorial productivity unchanged; risk posture significantly improved.
Each jurisdiction's national identifiers — tax IDs, citizen numbers, social-security formats — redacted with the right pattern in the right locale. Same firewall, different rules per region.
An adversarial document tried to coerce an operations agent into changing SCADA parameters. Injection scorer caught it; the agent never saw it.
Per-locale PII patterns, jailbreak rules, and outbound denylist tuned for the local language. The compliance officer signs the audit pack without changes.
Recommended products
Prompt firewall built in — jailbreak detection, PII redaction, injection scoring, outbound filters.
Open the AI Gateway pageBlocks and redactions appear in the same telemetry as cost and latency.
Open the Analytics pageSeverity-aware alarms when block rate spikes or new jailbreak patterns appear.
Open the Monitoring pageTie firewall outcomes to consumer identity — repeat offenders revoked at the auth layer.
Open the Identity pageResources
Inbound and outbound rules, scoring blends, policy-as-data — how the firewall composes.
The lane the firewall runs on — alongside routing, caching, and audit.
Anomaly detection on block rates and emerging patterns.
Firewall rules ship as data, review in Git, apply idempotently.
How firewall outcomes feed KVKK / GDPR / BDDK evidence.
Where the firewall sits in the AI lane.
Safety as a runtime property
A 30-minute walkthrough — jailbreak, PII, injection, outbound filters — on a Kubernetes of your choice.