Architecture
Where Defend’s input and output guards sit relative to your application and the LLM.
Defend assumes a three-hop pattern: your user (or upstream system) sends text to your app, your app may call an LLM, and your app returns a response. Defend evaluates text at the first and last hops.
Pipeline detail
For the ordered stages on the input path (normalization through classifier and modules), see Pipeline.
Input guard
Your application calls POST /v1/guard/input with the inbound user text (or equivalent). The service returns an action (pass, flag, or block) and a session_id. If the action is block, you should not call the LLM with that input.
Your LLM
Defend does not call your model for you. After a passing or flagged input (your policy), your app invokes the LLM as usual.
Output guard
After the model responds, call POST /v1/guard/output with the model text and the same session_id when possible. Output evaluation can incorporate stored input context for that session.
Session store
Input context for linking turns is stored server-side and expires based on configuration (see Sessions). Operational monitoring uses Health and Production.