Policy Configuration - HiddenLayer Docs

There are different policy groups, each with specific environment variables and header keys, which can be tailored to the specifications and requirements of your organization. Additionally, you can set the conviction severity levels to determine the appropriate threat level for your organization to trigger a conviction or a block. By default, the policy is to alert only for all detections (all blocks are set to False by default). Policy configurations can in most (not all) cases additionally be sent at runtime via an additional request header. As stated above, please note that the headers will override deployment-level policy settings, enabling unique policies for different use cases within a single LLM proxy deployment.

Policy SettingsThe environment variables on this page are for policy configuration. If you use these during the Runtime deployment (values.yaml), it could impact making policy changes in the future. For example, if you set HL_LLM_BLOCK_UNSAFE: "true" as a deployment setting, this will affect your output if you try setting "block_unsafe": false in your policy because the deployment set it to true.

Global

By default, the policy will be alert only for all detections. Most configuration settings are true or false, with false being the default setting. For configurations with different settings, the settings are identified in the Description.

Environment Key	Header Key	Default	Required	Description
`HL_LLM_BLOCK_MESSAGE`	`n/a`	Message was blocked.	False	The message that displays when a message is blocked.
`HL_LLM_BLOCK_UNSAFE`	`X-LLM-Block-Unsafe`	False	False	If overall verdict is true, the message will be blocked.
`HL_LLM_BLOCK_UNSAFE_INPUT`	`X-LLM-Block-Unsafe-Input`	False	False	If unsafe input verdict is true, the message will be blocked.
`HL_LLM_BLOCK_UNSAFE_OUTPUT`	`X-LLM-Block-Unsafe-Output`	False	False	If unsafe output verdict is true, the message will be blocked.
`HL_LLM_CHAT_COMPLETION_CONTEXT_WINDOW`	`X-LLM-Chat-Completion-Context-Window`	LAST	False	Size of chat completion window to perform analysis on FULL or LAST. `LAST` - Only analyze the last message in a chat completion request. `FULL` - Analyze all messages in a chat completion request.
`HL_LLM_INCLUDE_BLOCK_MESSAGE_REASONS`	`X-LLM-Include-Block-Message-Reasons`	True	False	When enabled, the block message reasons will be included in the response.
`HL_LLM_PROXY_ENABLE_PASSTHROUGH_STREAMING`	`X-LLM-Proxy-Enable-Passthrough-Streaming`	False	False	When enabled, the proxy will immediately start streaming the response back to the requester. Currently available for OpenAI.
`HL_LLM_PROXY_ENABLE_HEADER_POLICY`	`n/a`	True	False	Enable security rules to be set per request via HTTP headers. Note: Recommended to set to False for production environments.
`HL_LLM_PROXY_ENABLE_UNSECURED_ROUTE_PASSTHROUGH`	`X-LLM-Proxy-Enable-Unsecured-Route-Passthrough`	True	False	When using Runtime Security as a reverse proxy, all transparent upstream requests passthrough for unsecured routes.
`HL_LLM_PROXY_MAX_REQUEST_SIZE_BYTES`	`X-LLM-Proxy-Max-Request-Size-Bytes`	1000000	False	The maximum size for a request or a response, in bytes.
`n/a`	`x-requester-id`	Requesting IP	False	The ID for the requester. This value takes precedence over `hl-user-id`, the requesting IP address (defined as the IP address communicating directly with the Runtime Security endpoint), and `HL_LLM_PROXY_MLDR_DEFAULT_REQUESTER`.
`n/a`	`hl-user-id`	None	False	The ID for the HiddenLayer user. This value takes precedence over IP address and `HL_LLM_PROXY_MLDR_DEFAULT_REQUESTER`.
`HL_LLM_PROXY_MLDR_DEFAULT_REQUESTER`	`n/a`	Unknown	False	The ID used if no other identification for the requester is found. The default is unknown.

Prompt Injection

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_PROMPT_INJECTION_DETECTION`	`X-LLM-Skip-Prompt-Injection-Detection`	False	False	Flag to skip prompt injection detection.
`HL_LLM_BLOCK_PROMPT_INJECTION`	`X-LLM-Block-Prompt-Injection`	False	False	If prompt injection category is true, the message will be blocked.
`HL_LLM_PROMPT_INJECTION_SCAN_TYPE`	`X-LLM-Prompt-Injection-Scan-Type`	FULL	False	Type of prompt injection scan to perform `FULL` or `QUICK`.
`HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_{{id}}`	`X-LLM-Prompt-Injection-Allow-{{id}}`	`n/a`	False	Optional Identifier for custom Prompt Injections Allowed Expression. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Note: The Allow list takes priority over the Block list.
`HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_{{id}}_SUBSTRING`	`X-LLM-Prompt-Injection-Allow-{{id}}-Substring`	`n/a`	False	The substring whose occurrences are redacted from the text analyzed by the prompt injection classifier, mapped to its identifier. This is an exact string match. It does not treat the overall prompt as benign—only removes matched substrings from classifier input. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Caution: Take care when choosing the substring. A substring that is a commonly used word or phrase could exclude more of the prompt from analysis than intended.
`HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_{{id}}_EXPRESSION`	`X-LLM-Prompt-Injection-Allow-{{id}}-Expression`	`n/a`	False	Same role as `HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_{{id}}_SUBSTRING`, but the value is a regular expression; each match is excluded from the text analyzed by the prompt injection classifier. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Caution: Broad or loosely written patterns can exclude large portions of the prompt from analysis.
`HL_LLM_PROXY_PROMPT_INJECTION_BLOCK_{{id}}`	`X-LLM-Prompt-Injection-Block-{{id}}`	`n/a`	False	Optional Identifier for custom Prompt Injections Blocklist Expression. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Note: The Allow list takes priority over the Block list.
`HL_LLM_PROXY_PROMPT_INJECTION_BLOCK_{{id}}_SUBSTRING`	`X-LLM-Prompt-Injection-Block-{{id}}-Substring`	`n/a`	False	The substring to indicate a prompt is malicious if detected as an input, mapped to its identifier. This is a string match. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Caution: Take care when creating the substring to allow. A substring that is a commonly used word or phrase could block more than expected.
`HL_LLM_PROMPT_INJECTION_CLASSIFICATION_THRESHOLD`	`X-LLM-Prompt-Injection-Classification-Threshold`	default	False	Controls the threshold for prompt injection classification. The default value is `default`. The `high` setting requires a higher classification to trigger a detection, resulting in fewer prompt injection detections. Accepted values: `default` or `high`.

Prompt Injection Scan Types

QUICK - Only run the classifier on a single pass with 512 tokens.
FULL - Run classifier with multiple passes. This will strip certain characters and run the classifier on each line. Additional latency is added when using a FULL scan and increases with the size of input.

Examples

The following are examples for using keys that include variables. Prompt Injection Allow The following is an example config/vaules.yaml where the prompts “digital key” and “digitaler Schlüssel” are allowed.

namespace:
  name: aidr-genai

image:
  repository: images.hiddenlayer.ai/proxy/aidr-genai/ghcr.io/hiddenlayer-engineering/distro-enterprise-aidr-genai:26.6.0

resources:
  requests:
    cpu: 8

replicas:
  min: 1
  max: 1

config:
  HL_LICENSE: <license>
  
  OMP_NUM_THREADS: 8
  
  HL_LLM_PROXY_CLIENT_ID: <client_id>
  HL_LLM_PROXY_CLIENT_SECRET: <client_secret>
  HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_DigitalKey: "digital key"
  HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_DigitalKey_SUBSTRING: "digital key"
  HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_DigitalKeyGerman: "digitaler Schlüssel"
  HL_LLM_PROXY_PROMPT_INJECTION_ALLOW_DigitalKeyGerman_SUBSTRING: "digitaler Schlüssel"

Denial of Service

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_INPUT_DOS_DETECTION`	`X-LLM-Skip-Input-DOS-Detection`	False	False	Flag to skip the LLM denial of service detection.
`HL_LLM_BLOCK_INPUT_DOS_DETECTION`	`X-LLM-Block-Input-DOS-Detection`	False	False	If the LLM denial of service category is true, the message will be blocked.
`HL_LLM_INPUT_DOS_DETECTION_THRESHOLD`	`X-LLM-Input-DOS-Detection-Threshold`	4096	False	Threshold for input denial of service detection.

Personal Identifiable Information (PII)

Environment Key	Header Key	Default	Required	Description
`HL_LLM_REDACT_INPUT_PII`	`X-LLM-Redact-Input-PII`	False	False	Flag to redact input before sending to the LLM.
`HL_LLM_SKIP_INPUT_PII_DETECTION`	`X-LLM-Skip-Input-PII-Detection`	False	False	Flag to skip input PII detection.
`HL_LLM_BLOCK_INPUT_PII`	`X-LLM-Block-Input-PII`	False	False	If input PII category is true, message will be blocked.
`HL_LLM_SKIP_OUTPUT_PII_DETECTION`	`X-LLM-Skip-Output-PII-Detection`	False	False	Flag to skip output PII detection.
`HL_LLM_BLOCK_OUTPUT_PII`	`X-LLM-Block-Output-PII`	False	False	If output PII category is true, message will be blocked.
`HL_LLM_REDACT_OUTPUT_PII`	`X-LLM-Redact-Output-PII`	False	False	Flag to redact output before sending to the caller.
`HL_LLM_REDACT_TYPE`	`X-LLM-Redact-Type`	ENTITY	False	Type of redaction to perform ENTITY (ex [PHONE_NUMBER]) / STRICT (ex [REDACTED]) `ENTITY` - Redaction will be done with the entity type identified. `The company phone number is <PHONE_NUMBER>.` `STRICT` - Redaction will be made with the word REDACTED. `The company phone number is [REDACTED].`
`HL_LLM_ENTITY_TYPE`	`X-LLM-Entity-Type`	STRICT	False	Entity Groups ALL / STRICT. See LLM Entity Types for a list of available types.
`HL_LLM_PROXY_PII_ALLOW_{{id}}`	`X-LLM-PII-Allow-{{id}}`	n/a	False	Optional Identifier for custom PII Allowlist Expression. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Note: The Allow list takes priority over the Block list.
`HL_LLM_PROXY_PII_ALLOW_{{id}}_EXPRESSION`	`X-LLM-Proxy-PII-Allow-{{id}}-Expression`	n/a	False	The expression to allow if detected as PII, mapped to its identifier. This is a string match. Note: `{{id}}` must contain only alpha-numeric characters without spaces. Note: The Allow list takes priority over the Block list.
`HL_LLM_PROXY_PII_CUSTOM_{{name}}`	`X-LLM-PII-Custom-{{name}}`	None	False	Name of custom PII recognizer. If Name is supplied, expression must also be provided under same name.
`HL_LLM_PROXY_PII_CUSTOM_{{name}}_ENTITY`	`X-LLM-PII-Custom-{{name}}-Entity`	False	The entity to replace custom PII with, if found.
`HL_LLM_PROXY_PII_CUSTOM_((name))_EXPRESSION`	`X-LLM-PII-Custom-((name))-Expression`	None	False	The regex expression used to find custom PII.
`HL_LLM_OVERRIDE_INPUT_PII_ENTITIES`	`X-LLM-Override-Input-PII-Entities`	None	False	Override list of input PII entities that should be looked for in the text.
`HL_LLM_OVERRIDE_OUTPUT_PII_ENTITIES`	`X-LLM-Override-Output-PII-Entities`	None	False	Override list of output PII entities that should be looked for in the text.
`HL_LLM_PII_INPUT_ENTITY_CONFIDENCE_THRESHOLD`	`X-LLM-PII-Input-Entity-Confidence-Threshold`	Medium	False	The minimum confidence threshold for detecting an entity in inputs. Accepted values: low, medium, or high.
`HL_LLM_PII_OUTPUT_ENTITY_CONFIDENCE_THRESHOLD`	`X-LLM-PII-Output-Entity-Confidence-Threshold`	Medium	False	The minimum confidence threshold for detecting an entity in outputs. Accepted values: low, medium, or high.
`HL_LLM_PII_INPUT_ENTITY_ENABLE_CONTEXT`	`X-LLM-PII-Input-Entity-Enable-Context`	False	False	Whether to incorporate context of surrounding words in to the confidence score is enabled. This can increase latency is response times.
`HL_LLM_PII_OUTPUT_ENTITY_ENABLE_CONTEXT`	`X-LLM-PII-Output-Entity-Enable-Context`	False	False	Whether to incorporate context of surrounding words in to the confidence score is enabled. This can increase latency is response times.

LLM Entity Types

ALL

PERSON
LOCATION
ORGANIZATION
EMAIL_ADDRESS
CREDIT_CARD
PHONE_NUMBER
IP_ADDRESS
IBAN_CODE
US_BANK_NUMBER
UK_NINO
URL
US_DRIVER_LICENSE
US_PASSPORT
US_SSN
US_ITIN
ABA_ROUTING_NUMBER
ETH_ADDRESS
BTC_ADDRESS
MAC_ADDRESS
VIN_NUMBER
GPS_COORDINATES
GENERIC_API_KEY

ENABLED BY DEFAULT

CREDIT_CARD
PHONE_NUMBER
IP_ADDRESS
IBAN_CODE
US_BANK_NUMBER
US_PASSPORT
US_SSN
US_ITIN

STRICT

PHONE_NUMBER
CREDIT_CARD
IP_ADDRESS
IBAN_CODE
US_BANK_NUMBER
US_PASSPORT
US_SSN
US_ITIN

Code Detection

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_INPUT_CODE_DETECTION`	`X-LLM-Skip-Input-Code-Detection`	False	False	Flag to skip code detection.
`HL_LLM_BLOCK_INPUT_CODE_DETECTION`	`X-LLM-Block-Input-Code-Detection`	False	False	If the input code detection category is true, the message will be blocked.
`HL_LLM_SKIP_OUTPUT_CODE_DETECTION`	`X-LLM-Skip-Output-Code-Detection`	False	False	Flag to skip code detection.
`HL_LLM_BLOCK_OUTPUT_CODE_DETECTION`	`X-LLM-Block-Output-Code-Detection`	False	False	If the output code detection category is true, the message will be blocked.
`HL_LLM_TIMEOUT_INPUT_CODE_SECONDS`	`X-LLM-Timeout-Input-Code-Seconds`	False	False	The number of seconds the code detector should run for an individual request before timing out. Accepted value: integer (example: 10).
`HL_LLM_TIMEOUT_INPUT_CODE_IS_DETECTION`	`X-LLM-Timeout-Input-Code-Is-Detection`	False	False	When the code detector times out, should the time out be considered a positive detection for code. Accepted values: true or false.
`HL_LLM_TIMEOUT_OUTPUT_CODE_SECONDS`	`X-LLM-Timeout-Output-Code-Seconds`	False	False	The number of seconds the code detector should run for an individual request before timing out. Accepted value: integer (example: 10).
`HL_LLM_TIMEOUT_OUTPUT_CODE_IS_DETECTION`	`X-LLM-Timeout-Output-Code-Is-Detection`	False	False	When the code detector times out, should the time out be considered a positive detection for code. Accepted values: true or false.

Guardrail

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_GUARDRAIL_DETECTION`	`X-LLM-Skip-Guardrail-Detection`	False	False	Flag to skip guardrail detection.
`HL_LLM_SKIP_GUARDRAIL_CLASSIFICATION_DETECTION`		False	False	Flag to skip guardrail classification
`HL_LLM_BLOCK_GUARDRAIL_DETECTION`	`X-LLM-Block-Guardrail-Detection`	False	False	If the guardrail detection category is false, the message will be blocked.

Language Detection

Attackers attempting to do prompt injection may use multiple languages. HiddenLayer’s language detector provides more visibility into your AI usage and helps control potentially malicious behavior. It runs on input prompts only. The language detector has two components:

When enabled, it predicts whether a prompt is one of the top 20 most spoken languages, or returns unknown.
It allows you to select a set of supported languages, which lets only those languages through.

Supported languages

HiddenLayer’s prompt injection model is trained and evaluated for seven languages: English, French, German, Italian, Japanese, Korean, and Spanish.
Using language detection can block all unsupported languages, providing an extra layer of security against prompt injection.
The algorithm requires a minimum of 40 characters to recognize and block unsupported languages.

Environment Key Header Key Default Required Description

HL_LLM_SKIP_INPUT_LANGUAGE_DETECTION X-LLM-Skip-Input-Language-Detection True False Skips input language detection and allows the prompt to be analyzed.

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_INPUT_LANGUAGE_DETECTION`	`X-LLM-Skip-Input-Language-Detection`	True	False	Skips input language detection and allows the prompt to be analyzed.
`HL_LLM_BLOCK_INPUT_LANGUAGE_DETECTION`	`X-LLM-Block-Input-Language-Detection`	False	False	Blocks inputs that are not on the allowed language list. See `HL_LLM_INPUT_ALLOWED_LANGUAGES` for allowed languages.
`HL_LLM_INPUT_ALLOWED_LANGUAGES`	`X-LLM-Input-Allowed-Languages`	`n/a`	False	Allows languages included in your allowed list to be analyzed by the prompt injection model. When multiple languages are included in the input, Runtime Security will choose a language it identifies as principal and classify it as such. The default language values are: `en, es, fr, it, de, ja, ko` for English, Spanish, French, Italian, German, Japanese and Korean. So not setting this variable means the default languages are used. Expand to see languages AR - Arabic BN - Bengali DE - German EN - English ES - Spanish FR - French HI - Hindi ID - Indonesian IT - Italian JA - Japanese KO - Korean MR - Marathi PA - Punjabi PT - Portuguese RU - Russian TA - Tamil TE - Telugu TR - Turkish UR - Urdu VI - Vietnamese ZH - Chinese

HL_LLM_BLOCK_INPUT_LANGUAGE_DETECTION

X-LLM-Block-Input-Language-Detection

False

Blocks inputs that are not on the allowed language list.

See HL_LLM_INPUT_ALLOWED_LANGUAGES for allowed languages.

HL_LLM_INPUT_ALLOWED_LANGUAGES

X-LLM-Input-Allowed-Languages

n/a

False

Allows languages included in your allowed list to be analyzed by the prompt injection model.

When multiple languages are included in the input, Runtime Security will choose a language it identifies as principal and classify it as such.

The default language values are: en, es, fr, it, de, ja, ko for English, Spanish, French, Italian, German, Japanese and Korean. So not setting this variable means the default languages are used.

Expand to see languages

AR - Arabic

BN - Bengali

DE - German

EN - English

ES - Spanish

FR - French

HI - Hindi

ID - Indonesian

IT - Italian

JA - Japanese

KO - Korean

MR - Marathi

PA - Punjabi

PT - Portuguese

RU - Russian

TA - Tamil

TE - Telugu

TR - Turkish

UR - Urdu

VI - Vietnamese

ZH - Chinese

Examples

Allowed languages

Example environment keys

HL_LLM_SKIP_INPUT_LANGUAGE_DETECTION="false"
HL_LLM_BLOCK_INPUT_LANGUAGE_DETECTION="false"
HL_LLM_INPUT_ALLOWED_LANGUAGES="en, es, fr, it, de ,ja ,ko, ar, bn, hi, id, mr, pa, pt, ru, ta, te, tr, ur, vi, zh"

Example header key

X-LLM-Skip-Input-Language-Detection="false"
X-LLM-Block-Input-Language-Detection="false"
X-LLM-Input-Allowed-Languages="en, es, fr, it, de, ja, ko, ar, bn, hi, id, mr, pa, pt, ru, ta, te, tr, ur, vi, zh"

Block input language detection

Example environment key

HL_LLM_BLOCK_INPUT_LANGUAGE_DETECTION="true"

Example header key

X-LLM-Block-Input-Language-Detection="true"

Skip input language detection

Example environment key

HL_LLM_SKIP_INPUT_LANGUAGE_DETECTION="true"

Example header key

X-LLM-Skip-Input-Language-Detection="true"

URL Detection

Environment Key	Header Key	Default	Required	Description
`HL_LLM_SKIP_INPUT_URL_DETECTION`	`X-LLM-Skip-Input-URL-Detection`	False	False	Flag to skip input URL detection.
`HL_LLM_SKIP_OUTPUT_URL_DETECTION`	`X-LLM-Skip-Output-URL-Detection`	False	False	Flag to skip output URL detection.

Conviction Severity Level

With these variables, you can set the threat level that is required for the model to convict.

Environment Key	Header Key	Default	Required	Description
`HL_LLM_PROXY_CONVICTION_SEVERITY_GUARDRAIL`	`X-LLM-Conviction-Severity-Guardrail`	”Low”	False	Sets severity for Guardrail conviction category. Accepted values: “Low”, “Medium”, “High”
`HL_LLM_PROXY_CONVICTION_SEVERITY_DATA_LEAKAGE`	`X-LLM-Conviction-Severity-Data-Leakage`	”Medium”	False	Sets severity for Data Leakage conviction category. Accepted values: “Low”, “Medium”, “High”
`HL_LLM_PROXY_CONVICTION_SEVERITY_PROMPT_INJECTION`	`X-LLM-Conviction-Severity-Prompt-Injection`	”High”	False	Sets severity for Prompt Injection conviction category. Accepted values: “Low”, “Medium”, “High”
`HL_LLM_PROXY_CONVICTION_SEVERITY_DENIAL_OF_SERVICE`	`X-LLM-Conviction-Severity-Denial-Of-Service`	”High”	False	Sets severity for Denial-of-Service conviction category. Accepted values: “Low”, “Medium”, “High”
`HL_LLM_PROXY_CONVICTION_SEVERITY_MODALITY_RESTRICTION`	`X-LLM-Conviction-Severity-Modality-Restriction`	”Medium”	False	Sets severity for Modality Restriction conviction category. Accepted values: “Low”, “Medium”, “High”

​Global

​Prompt Injection

​Prompt Injection Scan Types

​Examples

​Denial of Service

​Personal Identifiable Information (PII)

​LLM Entity Types

​Code Detection

​Guardrail

​Language Detection

​Examples

​Allowed languages

​Block input language detection

​Skip input language detection

​URL Detection

​Conviction Severity Level

Global

Prompt Injection

Prompt Injection Scan Types

Examples

Denial of Service

Personal Identifiable Information (PII)

LLM Entity Types

Code Detection

Guardrail

Language Detection

Examples

Allowed languages

Block input language detection

Skip input language detection

URL Detection

Conviction Severity Level