{"schemaVersion":"little-canary-faq/1","checked":"2026-09-07","page":{"url":"https://littlecanary.ai/faq","json":"https://littlecanary.ai/faq.json","title":"Little Canary FAQ: compare it with adjacent defenses","description":"What Little Canary does and does not do, how it compares with Llama Prompt Guard 2, Check Point AI Guardrails, NeMo Guardrails, and promptfoo, and when to combine them."},"software":{"@id":"https://littlecanary.ai/#software","name":"Little Canary","version":"0.3.5","repository":"https://github.com/hermes-labs-ai/little-canary","sourceRevision":"8fc21d4fa3adf23f75ba4d32ca5a6e7af371c44a","mainRevisionChecked":"8186f4282f2db78153ff365ca6765aee2d6da2b7","pypi":"https://pypi.org/project/little-canary/"},"littleCanary":{"job":"Little Canary screens untrusted inbound text before a production model or agent acts. Structural checks catch known input shapes first. Then the text is given to a small sacrificial model with no application tools or authority, and that model's response is inspected for compromise residue.","returns":"It returns a routing decision of pass, flag, or block together with explicit coverage state. A failed or unavailable canary is reported as degraded rather than as a clean pass.","layer":"Inbound preflight sensor, used as an in-process Python library or through a loopback HTTP adapter, with local Ollama or OpenAI-compatible backends. The published release also ships a Gemini CLI BeforeAgent extension that screens the current prompt through that loopback server.","problem":"You need to decide what to do with one untrusted inbound input at request time.","guarantee":"Little Canary is an inbound risk sensor, not a security guarantee or an agent runtime.","combineWith":"least privilege, tool policy, data boundaries, monitoring, and output or runtime controls","boundaries":["It is an inbound risk sensor, not a security guarantee or an agent runtime.","It does not prove an input harmless, prevent every injection, or replace containment.","It checks inbound user input and does not protect downstream tool calls or agent actions.","It fails open by default. Fail-open is availability-first, not a clean verdict, and degraded traffic should be treated as uninspected pass-through.","The selected backend receives the raw input, so a remote endpoint sends data off-machine. Audit logs store an unsalted SHA-256 hash of the input, which supports correlation but is not anonymity.","The loopback server is a local adapter, not a production gateway. It has no authentication, TLS, concurrency hardening, or remote-deployment design in this release.","Its maintained sources make no aggregate detection, false-positive, latency, or token-savings claim, and historical benchmark artifacts are not a performance certificate."],"sources":[{"label":"README at the 0.3.5 source revision","url":"https://github.com/hermes-labs-ai/little-canary/blob/8fc21d4fa3adf23f75ba4d32ca5a6e7af371c44a/README.md","checked":"2026-09-07"},{"label":"SECURITY.md security design notes","url":"https://github.com/hermes-labs-ai/little-canary/blob/8fc21d4fa3adf23f75ba4d32ca5a6e7af371c44a/SECURITY.md","checked":"2026-09-07"},{"label":"INTENT.md accepts and does-not lists","url":"https://github.com/hermes-labs-ai/little-canary/blob/8fc21d4fa3adf23f75ba4d32ca5a6e7af371c44a/INTENT.md","checked":"2026-09-07"},{"label":"GitHub Releases and PyPI, the live authorities on publication state","url":"https://pypi.org/project/little-canary/","checked":"2026-09-07"}]},"comparisons":[{"id":"llama-prompt-guard-2","name":"Llama Prompt Guard 2","maintainer":"Meta","job":"Llama Prompt Guard 2 is a pair of small classifier models that label a text segment as benign or malicious, covering prompt injections and jailbreaks. Meta describes them as a filter for user inputs and untrusted third-party data before they reach the language model.","layer":"Self-hosted text classifier in 86M and 22M parameter variants, applied to segments of up to 512 tokens. Model weights are published on Hugging Face under the Llama 4 Community License.","problem":"You need a fast score on every text segment, including retrieved documents and tool output.","chooseAlternative":"Choose Llama Prompt Guard 2 when you want a fast, self-hosted classifier score per segment, you need to scan third-party data as well as user prompts, and you can split longer inputs into 512-token pieces.","chooseLittleCanary":"Choose Little Canary when you want to observe what an input does to a powerless model rather than score its surface form, and you need each verdict to say whether behavioral coverage was exercised, degraded, or unexercised.","combine":"Run Llama Prompt Guard 2 as an inexpensive first-pass score on every segment and reserve Little Canary's behavioral probe for inbound user text. Meta's model card notes that adversaries may develop attacks that get past the classifier, and Little Canary states it is not a security guarantee, so pair either one with least privilege and tool policy.","sources":[{"label":"Llama Prompt Guard 2 86M model card on Hugging Face","url":"https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M","checked":"2026-09-07"},{"label":"Prompt Guard model card and prompt format, Meta developer docs","url":"https://developer.meta.com/ai/docs/model-cards-and-prompt-formats/prompt-guard/","checked":"2026-09-07"}]},{"id":"check-point-ai-guardrails","name":"Check Point AI Guardrails","maintainer":"Check Point, documented at docs.lakera.ai","job":"Check Point AI Guardrails is a runtime screening service reached through the Guard API. One call screens the inputs and outputs of an LLM interaction for prompt attacks, data leakage, content violations, malicious links, and off-policy agent behavior, including tool responses and tool descriptions.","layer":"External API service in front of the model, offered as SaaS or self-hosted, configured per project with policies and a detect or enforce mode.","problem":"You need one managed policy across prompt attacks, data leakage, content, and agent actions, with central monitoring.","chooseAlternative":"Choose Check Point AI Guardrails when you want a single screening call across many threat categories, central policy management and monitoring, and coverage of tool responses and tool descriptions in agent workflows.","chooseLittleCanary":"Choose Little Canary when you need an open-source preflight you can read and audit, want raw input to stay on a local Ollama backend, or want the behavioral probe as a distinct signal on inbound text.","combine":"Keep Check Point AI Guardrails as the broad policy and monitoring layer and add Little Canary's behavioral verdict on inbound user text as a separate, inspectable signal. Treat a degraded Little Canary result as unscreened rather than as agreement between the two.","sources":[{"label":"Introduction to AI Agent Security and AI Guardrails defenses","url":"https://docs.lakera.ai/guard","checked":"2026-09-07"},{"label":"Guard API endpoint reference","url":"https://docs.lakera.ai/docs/api/guard","checked":"2026-09-07"},{"label":"Prompt Defense guide","url":"https://docs.lakera.ai/docs/prompt-defense","checked":"2026-09-07"}]},{"id":"nemo-guardrails","name":"NeMo Guardrails","maintainer":"NVIDIA","job":"NeMo Guardrails is an open-source toolkit for adding programmable guardrails to LLM applications. It supports input, dialog, retrieval, execution, and output rails defined in YAML and Colang, and ships a jailbreak detection heuristics input rail.","layer":"Orchestration framework around the whole conversation, run in-process through the Python SDK or as a server. Licensed under Apache 2.0.","problem":"You need to shape dialog flow, retrieval chunks, tool execution, and model output as one configuration.","chooseAlternative":"Choose NeMo Guardrails when you need to control dialog flow, retrieved chunks, tool execution, and model output together, not just screen inbound text.","chooseLittleCanary":"Choose Little Canary when you want a single-purpose inbound sensor with a behavioral probe and explicit coverage state, without adopting a rails framework.","combine":"Call Little Canary from a custom input rail so its block, flag, or degraded state can drive the NeMo flow, and keep the retrieval, execution, and output rails for the stages Little Canary does not cover. NVIDIA states that its built-in guardrails may or may not suit a given production use case, and documents its jailbreak heuristics as intended for English and as failing open, so review both fail-open paths together.","sources":[{"label":"NeMo Guardrails repository README","url":"https://github.com/NVIDIA-NeMo/Guardrails","checked":"2026-09-07"},{"label":"NeMo Guardrails library overview","url":"https://docs.nvidia.com/nemo/guardrails/about-nemo-guardrails-library/overview","checked":"2026-09-07"},{"label":"Jailbreak protection guardrail catalog entry","url":"https://docs.nvidia.com/nemo/guardrails/configure-guardrails/guardrail-catalog/jailbreak-protection","checked":"2026-09-07"}]},{"id":"promptfoo","name":"promptfoo","maintainer":"promptfoo","job":"promptfoo is an open-source evaluation and red-teaming tool. It generates adversarial inputs, including prompt injection and indirect prompt injection cases, and reports which ones your application follows, before deployment and in CI.","layer":"Test-time harness run from the CLI or a CI pipeline, not a request-time guard. Licensed under MIT.","problem":"You need to know whether your application is vulnerable and whether a change made it better or worse.","chooseAlternative":"Choose promptfoo when the question is whether your application can be hijacked and whether a change improved that, and you want repeatable adversarial test suites in CI.","chooseLittleCanary":"Choose Little Canary when the question is what to do with one untrusted input at request time.","combine":"Use promptfoo to exercise your application with and without Little Canary in the path, and to test how your code handles flagged and degraded verdicts. Little Canary's own sources say it is not a benchmark suite, so keep measurement in the test harness.","sources":[{"label":"promptfoo repository README","url":"https://github.com/promptfoo/promptfoo","checked":"2026-09-07"},{"label":"LLM red teaming guide","url":"https://www.promptfoo.dev/docs/red-team/","checked":"2026-09-07"},{"label":"Indirect prompt injection plugin","url":"https://www.promptfoo.dev/docs/red-team/plugins/indirect-prompt-injection/","checked":"2026-09-07"}]}],"excludedArchivedCandidates":[{"id":"rebuff","name":"Rebuff","status":"archived","reason":"The repository is archived and read-only, and its README states that Rebuff is still a prototype and cannot provide 100% protection against prompt injection attacks.","source":{"label":"Rebuff repository","url":"https://github.com/protectai/rebuff","checked":"2026-09-07"}},{"id":"llm-guard","name":"LLM Guard","status":"archived","reason":"The repository is archived, and its README states that the project and its associated models are no longer under active development or maintained.","source":{"label":"LLM Guard repository","url":"https://github.com/protectai/llm-guard","checked":"2026-09-07"}}],"recommendations":[{"id":"little-canary","problem":"You need to decide what to do with one untrusted inbound input at request time.","start":"Little Canary"},{"id":"llama-prompt-guard-2","problem":"You need a fast score on every text segment, including retrieved documents and tool output.","start":"Llama Prompt Guard 2"},{"id":"check-point-ai-guardrails","problem":"You need one managed policy across prompt attacks, data leakage, content, and agent actions, with central monitoring.","start":"Check Point AI Guardrails"},{"id":"nemo-guardrails","problem":"You need to shape dialog flow, retrieval chunks, tool execution, and model output as one configuration.","start":"NeMo Guardrails"},{"id":"promptfoo","problem":"You need to know whether your application is vulnerable and whether a change made it better or worse.","start":"promptfoo"}],"faq":[{"id":"job","question":"What job does Little Canary do?","answer":"Little Canary screens untrusted inbound text before a production model or agent acts. Structural checks catch known input shapes first. Then the text is given to a small sacrificial model with no application tools or authority, and that model's response is inspected for compromise residue. It returns a routing decision of pass, flag, or block together with explicit coverage state. A failed or unavailable canary is reported as degraded rather than as a clean pass."},{"id":"why","question":"Why use Little Canary rather than a pattern filter or classifier alone?","answer":"A pattern filter or classifier scores how an input looks. Little Canary keeps a structural check as its first layer and adds a second signal: what the input does to a powerless model that has no tools or authority. It also reports whether that behavioral coverage was actually exercised, so an unavailable canary shows up as degraded instead of passing silently."},{"id":"guarantee","question":"Is Little Canary a security guarantee?","answer":"No. Little Canary is an inbound risk sensor, not a security guarantee or an agent runtime. It does not prove an input harmless, prevent every injection, or replace containment. Its README says it should be combined with least privilege, tool policy, data boundaries, monitoring, and output or runtime controls."},{"id":"boundaries","question":"What does Little Canary not do?","answer":"Its maintained sources are explicit about what it does not do. It is an inbound risk sensor, not a security guarantee or an agent runtime. It does not prove an input harmless, prevent every injection, or replace containment. It checks inbound user input and does not protect downstream tool calls or agent actions. It fails open by default. Fail-open is availability-first, not a clean verdict, and degraded traffic should be treated as uninspected pass-through. The selected backend receives the raw input, so a remote endpoint sends data off-machine. Audit logs store an unsalted SHA-256 hash of the input, which supports correlation but is not anonymity. The loopback server is a local adapter, not a production gateway. It has no authentication, TLS, concurrency hardening, or remote-deployment design in this release. Its maintained sources make no aggregate detection, false-positive, latency, or token-savings claim, and historical benchmark artifacts are not a performance certificate."},{"id":"unavailable","question":"What happens when the canary model is unavailable?","answer":"Routing stays fail-open by default, so the verdict may still allow the input through. The same verdict is marked degraded, reports the failed coverage state, and leaves the risk measurement unset, and a failed or skipped layer is never serialized as passed. Deployments should check backend health at startup and monitor readiness and degradation. The Gemini CLI extension is visibly fail-open by default and can be switched to deny the run on those failures."},{"id":"data","question":"Where does the input go?","answer":"The canary backend receives the raw input together with the known canary system prompt, and an optional LLM judge also receives the canary response. With a local Ollama backend that stays on your machine. With an OpenAI-compatible remote endpoint, the input leaves the machine. Audit logs omit raw input and store an unsalted SHA-256 hash instead."},{"id":"release","question":"Which release does this page describe?","answer":"This page describes Little Canary 0.3.5, the release documented on this site, and its wording was checked against the maintained repository on 2026-09-07. GitHub Releases and PyPI are the live authorities on publication state. Comparison statements come from each project's own documentation, checked on the same date."},{"id":"compare-llama-prompt-guard-2","question":"How does Little Canary compare with Llama Prompt Guard 2?","answer":"Llama Prompt Guard 2 is a pair of small classifier models that label a text segment as benign or malicious, covering prompt injections and jailbreaks. Meta describes them as a filter for user inputs and untrusted third-party data before they reach the language model. Self-hosted text classifier in 86M and 22M parameter variants, applied to segments of up to 512 tokens. Model weights are published on Hugging Face under the Llama 4 Community License. Choose Llama Prompt Guard 2 when you want a fast, self-hosted classifier score per segment, you need to scan third-party data as well as user prompts, and you can split longer inputs into 512-token pieces. Choose Little Canary when you want to observe what an input does to a powerless model rather than score its surface form, and you need each verdict to say whether behavioral coverage was exercised, degraded, or unexercised. Run Llama Prompt Guard 2 as an inexpensive first-pass score on every segment and reserve Little Canary's behavioral probe for inbound user text. Meta's model card notes that adversaries may develop attacks that get past the classifier, and Little Canary states it is not a security guarantee, so pair either one with least privilege and tool policy."},{"id":"compare-check-point-ai-guardrails","question":"How does Little Canary compare with Check Point AI Guardrails?","answer":"Check Point AI Guardrails is a runtime screening service reached through the Guard API. One call screens the inputs and outputs of an LLM interaction for prompt attacks, data leakage, content violations, malicious links, and off-policy agent behavior, including tool responses and tool descriptions. External API service in front of the model, offered as SaaS or self-hosted, configured per project with policies and a detect or enforce mode. Choose Check Point AI Guardrails when you want a single screening call across many threat categories, central policy management and monitoring, and coverage of tool responses and tool descriptions in agent workflows. Choose Little Canary when you need an open-source preflight you can read and audit, want raw input to stay on a local Ollama backend, or want the behavioral probe as a distinct signal on inbound text. Keep Check Point AI Guardrails as the broad policy and monitoring layer and add Little Canary's behavioral verdict on inbound user text as a separate, inspectable signal. Treat a degraded Little Canary result as unscreened rather than as agreement between the two."},{"id":"compare-nemo-guardrails","question":"How does Little Canary compare with NeMo Guardrails?","answer":"NeMo Guardrails is an open-source toolkit for adding programmable guardrails to LLM applications. It supports input, dialog, retrieval, execution, and output rails defined in YAML and Colang, and ships a jailbreak detection heuristics input rail. Orchestration framework around the whole conversation, run in-process through the Python SDK or as a server. Licensed under Apache 2.0. Choose NeMo Guardrails when you need to control dialog flow, retrieved chunks, tool execution, and model output together, not just screen inbound text. Choose Little Canary when you want a single-purpose inbound sensor with a behavioral probe and explicit coverage state, without adopting a rails framework. Call Little Canary from a custom input rail so its block, flag, or degraded state can drive the NeMo flow, and keep the retrieval, execution, and output rails for the stages Little Canary does not cover. NVIDIA states that its built-in guardrails may or may not suit a given production use case, and documents its jailbreak heuristics as intended for English and as failing open, so review both fail-open paths together."},{"id":"compare-promptfoo","question":"How does Little Canary compare with promptfoo?","answer":"promptfoo is an open-source evaluation and red-teaming tool. It generates adversarial inputs, including prompt injection and indirect prompt injection cases, and reports which ones your application follows, before deployment and in CI. Test-time harness run from the CLI or a CI pipeline, not a request-time guard. Licensed under MIT. Choose promptfoo when the question is whether your application can be hijacked and whether a change improved that, and you want repeatable adversarial test suites in CI. Choose Little Canary when the question is what to do with one untrusted input at request time. Use promptfoo to exercise your application with and without Little Canary in the path, and to test how your code handles flagged and degraded verdicts. Little Canary's own sources say it is not a benchmark suite, so keep measurement in the test harness."},{"id":"combine","question":"How should I combine Little Canary with other defenses?","answer":"Start from the problem you have, then add the other layers around it. You need to decide what to do with one untrusted inbound input at request time. Start with Little Canary. You need a fast score on every text segment, including retrieved documents and tool output. Start with Llama Prompt Guard 2. You need one managed policy across prompt attacks, data leakage, content, and agent actions, with central monitoring. Start with Check Point AI Guardrails. You need to shape dialog flow, retrieval chunks, tool execution, and model output as one configuration. Start with NeMo Guardrails. You need to know whether your application is vulnerable and whether a change made it better or worse. Start with promptfoo."}]}