Lakera Guard · Prompt injection defense

Lakera Guard + Leanroute

Lakera is the hosted SaaS for prompt-injection defense. They maintain a continually-updated catalogue of adversarial techniques (the "ignore previous instructions" family plus dozens more) and screen prompts against it across many model families. Add their /v2/guard endpoint as a pre-check in your application code, and Leanroute handles the actual model dispatch downstream.

When to use this

You take untrusted user input directly into a prompt (chatbot, agent, support workflow).
You've seen jailbreak attempts in your logs and regex isn't keeping up.
You operate a Slack bot / Discord bot / customer-facing agent where adversarial inputs are the norm, not the exception.

For static block patterns (a forbidden company name, a known secret string) Leanroute's built-in block patterns are enough. For adversarial input from real users, Lakera is the right specialist.

Setup

Sign up at lakera.ai and create an API key.
Set the env var LAKERA_API_KEY wherever your application code runs.
Add a Lakera check before every model call. Block on a flagged response.

Example

import os
import requests
from openai import OpenAI

LAKERA_KEY = os.environ["LAKERA_API_KEY"]
leanroute = OpenAI(
    api_key="gw_live_YOUR_KEY",
    base_url="https://api.leanroute.dev/v1",
)

def safe_chat(user_input: str, model: str = "anthropic/claude-sonnet-4-6") -> str:
    # 1. Screen the user input through Lakera Guard
    r = requests.post(
        "https://api.lakera.ai/v2/guard",
        headers={"Authorization": f"Bearer {LAKERA_KEY}"},
        json={"input": user_input},
        timeout=5,
    )
    verdict = r.json()
    if verdict.get("flagged"):
        # Refuse and log — Lakera's response includes which category fired
        # (prompt_injection, jailbreak, pii, etc.) for incident triage.
        raise ValueError(f"Lakera blocked input: {verdict.get('categories')}")

    # 2. Safe to dispatch through Leanroute
    response = leanroute.chat.completions.create(
        model=model,
        messages=[
            {"role": "system", "content": "You are a helpful assistant."},
            {"role": "user", "content": user_input},
        ],
    )
    return response.choices[0].message.content

The Lakera response includes which categories fired (prompt_injection, jailbreak, pii, hate, etc.) so you can differentiate the action taken — e.g. silently ignore an injection attempt but escalate a hate-speech event to a moderator.

Combining with Leanroute's built-in checks

Lakera in your app code + Leanroute's block patterns on the gateway double up cleanly. Lakera is the heavier, more adaptive layer; Leanroute's patterns are organization-wide and static. Use them together: Lakera catches the adversarial variability, Leanroute enforces your org-wide content policy.

Latency budget: Lakera adds ~100–300ms. Run it in parallel with whatever async work your app does between user input and dispatch when possible.

Caveats

Lakera is paid. Generous free tier; production usage hits paid plans. For high-volume customers it's a meaningful line item.
No detection catches everything. Lakera publishes a model card and updates the catalogue continually; novel attacks land before defenses do. Treat as defense-in-depth, not a single line of trust.
Adds an external dependency. If Lakera is down, your requests fail unless you fail-open. We'd recommend fail-open for low-trust inputs and fail-closed for higher-stakes flows.