layered safety harness + red-team range
defense in depth (5 layers)
1 / input sanitize
strip zero-widths, decode base64/rot13, normalize
2 / NeMo Guardrails rails
off-domain, role, policy-forbidden
3 / classifier gate
Llama Guard 4 + X-Guard + ShieldGemma-2 + Nemotron 3
4 / target model
the application being protected
5 / output filter
Llama Guard 4 + Presidio PII + citation check
6 / HITL tier
flagged outputs -> Slack queue
every layer emits a span;
block at any layer halts and attributes
XSTest benign rate measured continuously
over-refusal vs jailbreak: the Pareto curve
red-team range
PAIR + TAP autonomous
GCG suffix
encoding (ASCII / base64)
multi-turn persona
code-switch multilingual
outputs
CVSS 4.0 per finding
disclosure timeline
before / after harmlessness delta
per-family success rate
XSTest benign pass rate trend
constitutional self-critique run
cron scheduler + Slack alerts
garak + PyRIT + NVIDIA Aegis shape