Little CanaryLittle Canary
v0.3.5 · sources checked 2026-09-07

Compare Little Canary with adjacent defenses

What Little Canary does and does not do, how it compares with Llama Prompt Guard 2, Check Point AI Guardrails, NeMo Guardrails, and promptfoo, and when to combine them.

Jobs, operating layers, and boundaries, taken from each project's own documentation. This is not a ranking and it makes no benchmark claim. Machine-readable version

Direct answers

What job does Little Canary do?

Little Canary screens untrusted inbound text before a production model or agent acts. Structural checks catch known input shapes first. Then the text is given to a small sacrificial model with no application tools or authority, and that model's response is inspected for compromise residue. It returns a routing decision of pass, flag, or block together with explicit coverage state. A failed or unavailable canary is reported as degraded rather than as a clean pass.

Why use Little Canary rather than a pattern filter or classifier alone?

A pattern filter or classifier scores how an input looks. Little Canary keeps a structural check as its first layer and adds a second signal: what the input does to a powerless model that has no tools or authority. It also reports whether that behavioral coverage was actually exercised, so an unavailable canary shows up as degraded instead of passing silently.

Is Little Canary a security guarantee?

No. Little Canary is an inbound risk sensor, not a security guarantee or an agent runtime. It does not prove an input harmless, prevent every injection, or replace containment. Its README says it should be combined with least privilege, tool policy, data boundaries, monitoring, and output or runtime controls.

What does Little Canary not do?

Its maintained sources are explicit about what it does not do.

  • It is an inbound risk sensor, not a security guarantee or an agent runtime.
  • It does not prove an input harmless, prevent every injection, or replace containment.
  • It checks inbound user input and does not protect downstream tool calls or agent actions.
  • It fails open by default. Fail-open is availability-first, not a clean verdict, and degraded traffic should be treated as uninspected pass-through.
  • The selected backend receives the raw input, so a remote endpoint sends data off-machine. Audit logs store an unsalted SHA-256 hash of the input, which supports correlation but is not anonymity.
  • The loopback server is a local adapter, not a production gateway. It has no authentication, TLS, concurrency hardening, or remote-deployment design in this release.
  • Its maintained sources make no aggregate detection, false-positive, latency, or token-savings claim, and historical benchmark artifacts are not a performance certificate.

What happens when the canary model is unavailable?

Routing stays fail-open by default, so the verdict may still allow the input through. The same verdict is marked degraded, reports the failed coverage state, and leaves the risk measurement unset, and a failed or skipped layer is never serialized as passed. Deployments should check backend health at startup and monitor readiness and degradation. The Gemini CLI extension is visibly fail-open by default and can be switched to deny the run on those failures.

Where does the input go?

The canary backend receives the raw input together with the known canary system prompt, and an optional LLM judge also receives the canary response. With a local Ollama backend that stays on your machine. With an OpenAI-compatible remote endpoint, the input leaves the machine. Audit logs omit raw input and store an unsalted SHA-256 hash instead.

Which release does this page describe?

This page describes Little Canary 0.3.5, the release documented on this site, and its wording was checked against the maintained repository on 2026-09-07. GitHub Releases and PyPI are the live authorities on publication state. Comparison statements come from each project's own documentation, checked on the same date.

Little Canary sources inspected

Jobs and boundaries, side by side

Four tools people weigh against Little Canary for the same or an adjacent job. Each entry says when to choose it, when to choose Little Canary, and how the two combine.

Meta

Llama Prompt Guard 2

Job
Llama Prompt Guard 2 is a pair of small classifier models that label a text segment as benign or malicious, covering prompt injections and jailbreaks. Meta describes them as a filter for user inputs and untrusted third-party data before they reach the language model.
Operating layer
Self-hosted text classifier in 86M and 22M parameter variants, applied to segments of up to 512 tokens. Model weights are published on Hugging Face under the Llama 4 Community License.
Choose Llama Prompt Guard 2 when
Choose Llama Prompt Guard 2 when you want a fast, self-hosted classifier score per segment, you need to scan third-party data as well as user prompts, and you can split longer inputs into 512-token pieces.
Choose Little Canary when
Choose Little Canary when you want to observe what an input does to a powerless model rather than score its surface form, and you need each verdict to say whether behavioral coverage was exercised, degraded, or unexercised.
Combine them by
Run Llama Prompt Guard 2 as an inexpensive first-pass score on every segment and reserve Little Canary's behavioral probe for inbound user text. Meta's model card notes that adversaries may develop attacks that get past the classifier, and Little Canary states it is not a security guarantee, so pair either one with least privilege and tool policy.

Official sources inspected

Check Point, documented at docs.lakera.ai

Check Point AI Guardrails

Job
Check Point AI Guardrails is a runtime screening service reached through the Guard API. One call screens the inputs and outputs of an LLM interaction for prompt attacks, data leakage, content violations, malicious links, and off-policy agent behavior, including tool responses and tool descriptions.
Operating layer
External API service in front of the model, offered as SaaS or self-hosted, configured per project with policies and a detect or enforce mode.
Choose Check Point AI Guardrails when
Choose Check Point AI Guardrails when you want a single screening call across many threat categories, central policy management and monitoring, and coverage of tool responses and tool descriptions in agent workflows.
Choose Little Canary when
Choose Little Canary when you need an open-source preflight you can read and audit, want raw input to stay on a local Ollama backend, or want the behavioral probe as a distinct signal on inbound text.
Combine them by
Keep Check Point AI Guardrails as the broad policy and monitoring layer and add Little Canary's behavioral verdict on inbound user text as a separate, inspectable signal. Treat a degraded Little Canary result as unscreened rather than as agreement between the two.

Official sources inspected

NVIDIA

NeMo Guardrails

Job
NeMo Guardrails is an open-source toolkit for adding programmable guardrails to LLM applications. It supports input, dialog, retrieval, execution, and output rails defined in YAML and Colang, and ships a jailbreak detection heuristics input rail.
Operating layer
Orchestration framework around the whole conversation, run in-process through the Python SDK or as a server. Licensed under Apache 2.0.
Choose NeMo Guardrails when
Choose NeMo Guardrails when you need to control dialog flow, retrieved chunks, tool execution, and model output together, not just screen inbound text.
Choose Little Canary when
Choose Little Canary when you want a single-purpose inbound sensor with a behavioral probe and explicit coverage state, without adopting a rails framework.
Combine them by
Call Little Canary from a custom input rail so its block, flag, or degraded state can drive the NeMo flow, and keep the retrieval, execution, and output rails for the stages Little Canary does not cover. NVIDIA states that its built-in guardrails may or may not suit a given production use case, and documents its jailbreak heuristics as intended for English and as failing open, so review both fail-open paths together.

Official sources inspected

promptfoo

promptfoo

Job
promptfoo is an open-source evaluation and red-teaming tool. It generates adversarial inputs, including prompt injection and indirect prompt injection cases, and reports which ones your application follows, before deployment and in CI.
Operating layer
Test-time harness run from the CLI or a CI pipeline, not a request-time guard. Licensed under MIT.
Choose promptfoo when
Choose promptfoo when the question is whether your application can be hijacked and whether a change improved that, and you want repeatable adversarial test suites in CI.
Choose Little Canary when
Choose Little Canary when the question is what to do with one untrusted input at request time.
Combine them by
Use promptfoo to exercise your application with and without Little Canary in the path, and to test how your code handles flagged and degraded verdicts. Little Canary's own sources say it is not a benchmark suite, so keep measurement in the test harness.

Official sources inspected

How should I combine Little Canary with other defenses?

Start from the problem you have, then add the other layers around it.

  1. 01

    You need to decide what to do with one untrusted inbound input at request time.

    Start with Little Canary.

  2. 02

    You need a fast score on every text segment, including retrieved documents and tool output.

    Start with Llama Prompt Guard 2.

  3. 03

    You need one managed policy across prompt attacks, data leakage, content, and agent actions, with central monitoring.

    Start with Check Point AI Guardrails.

  4. 04

    You need to shape dialog flow, retrieval chunks, tool execution, and model output as one configuration.

    Start with NeMo Guardrails.

  5. 05

    You need to know whether your application is vulnerable and whether a change made it better or worse.

    Start with promptfoo.