Skip to main content
PromptGuard’s detection engine calls a small number of openly licensed machine learning models. This page names every one of them, says which licence it is under, and carries the attribution and use terms those licences require us to give you.
Built with Llama. PromptGuard’s prompt-injection detection uses Meta’s Llama Prompt Guard 2.

​
How we use these models

In Cloud and Hybrid deployments the engine sends text to each model through an inference endpoint.

​
Self-hosted: you fetch the weights

PromptGuard does not ship, host or redistribute model weights. A self-hosted install that runs the encoder models itself (ML_INFERENCE_MODE=local: the prompt-injection and toxicity classifiers and the embedding model) runs them on weights you download:
  • Who fetches them. You do, on a machine with internet access, with your own Hugging Face token, by running the fetch script PromptGuard provides (scripts/setup/fetch_local_models.py, or the Dockerfile.models image build that runs it). The script pins each model to a repository commit.
  • Who accepts which licence. You do, with each model’s author, on your own Hugging Face account. meta-llama/Llama-Prompt-Guard-2-86M is gated: you accept Meta’s Llama 4 Community License and its Acceptable Use Policy before Hugging Face lets your token download it. The other models’ licences (below) apply to your copy in the same way. PromptGuard does not accept a licence on your behalf, and does not pass you a copy of the weights.
  • What the script writes. Each model’s directory gets its licence text, its model card and a NOTICE naming its source and licence; the top-level NOTICE lists them all and opens with “Built with Llama”. KoalaAI/Text-Moderation’s repository publishes no licence file, so its model card, which states the licence and its restrictions, is the copy kept. The script converts the weights of Llama Prompt Guard 2, unitary/toxic-bert and cardiffnlp/twitter-roberta-base-hate-latest to ONNX format on your machine; the weights themselves are not changed.
  • The LLM judges are not fetched by the script. If you run the optional judge server, you download openai/gpt-oss-safeguard-20b yourself too. That server is bring your own GPU model server, not validated by PromptGuard.
Without the weights, the engine still runs, and the classifiers that cannot run are listed on every scan as unavailable.

​
Detection ensemble

These run on scans as part of the toxicity and prompt-injection ensemble.

​
Other models

​
Licence terms

​
Llama 4 Community License

Llama Prompt Guard 2 is made available under the Llama 4 Community License. Llama 4 is licensed under the Llama 4 Community License, Copyright © Meta Platforms, Inc. All Rights Reserved.
  • The licence: https://www.llama.com/llama4/license/
  • Your use of PromptGuard must also comply with Meta’s Llama 4 Acceptable Use Policy, which the licence incorporates and which we pass through to you: https://www.llama.com/llama4/use-policy/
  • Self-hosted, you accept this licence yourself when your Hugging Face account downloads the model. The fetch script keeps the licence and the Acceptable Use Policy beside the weights as LICENSE and USE_POLICY.md, with the attribution notice above in NOTICE.

​
OpenRAIL

KoalaAI/Text-Moderation is released under an Open Responsible AI License (OpenRAIL); its model card’s metadata declares the licence family, and its text names the CodeML OpenRAIL-M 0.1 licence, which the repository does not publish. OpenRAIL licences permit commercial use but attach use-based restrictions that bind everyone downstream of the model, including you. You must not use PromptGuard, or the moderation results it produces, for any use those restrictions prohibit. The OpenRAIL licences and their restrictions are published by the RAIL initiative: https://www.licenses.ai/ai-licenses

​
Creative Commons Attribution 4.0

cardiffnlp/twitter-roberta-base-hate-latest is by Cardiff NLP (Cardiff University), published at https://huggingface.co/cardiffnlp/twitter-roberta-base-hate-latest under the Creative Commons Attribution 4.0 International licence: https://creativecommons.org/licenses/by/4.0/. PromptGuard uses the model’s weights unmodified. Self-hosted, the fetch script converts your downloaded copy to ONNX format and writes the licence text beside it.

​
Apache License 2.0

The models listed under the Apache License 2.0 are used under its terms: https://www.apache.org/licenses/LICENSE-2.0. None of their model repositories publishes a NOTICE file. Self-hosted, the fetch script writes the licence text beside each one you download.

​
Models we stopped using

facebook/roberta-hate-speech-dynabench-r4-target was removed from the detection ensemble in September 2026 because it is published without a licence. Its place is held by cardiffnlp/twitter-roberta-base-hate-latest.