开源AI安全工具9个：保护你的LLM技术栈
LLM应用有新的攻击面。这些开源工具覆盖扫描、红队和运行时防护。
AI Security Tools Open Source 2026: 9 Projects to Protect Your LLM Stack
Securing an LLM application means defending prompt injection, data leakage, tool misuse, and model abuse. The open-source ecosystem now covers the full lifecycle: scan, test, monitor, protect. Here are nine projects worth knowing in 2026.
The 9 Projects
1. OWASP LLM Top 10 + llm-verification. Not a tool but the checklist that organizes everything. The OWASP Top 10 for LLM Applications is the de facto standard threat model.
2. garak (NVIDIA). An LLM vulnerability scanner that runs hundreds of probes: prompt injection, jailbreak, data leakage, hallucination, encoding attacks. CLI-first, model-agnostic. The standard red-teaming entry point.
3. PyRIT (Microsoft). Python Risk Identification Toolkit for automated red teaming. Includes jailbreak strategies, scoring, and conversation management. Designed to run at scale against APIs.
4. promptfoo. Open-source LLM evaluation and red-teaming with regression testing. You write test cases (including injection payloads), it scores model outputs, and it fails CI on regressions.
5. LLM Guard (Protect AI). Input/output sanitization: detects jailbreak attempts, PII, and prompt injection before they reach the model; filters secrets from outputs.
6. NeMo Guardrails (NVIDIA). Adds rails around the dialog flow: topical rails block off-topic/harmful directions; fact-checking rails validate claims. Config-driven (Colang).
7. Guardrails AI. Python library that validates LLM outputs against validators (regex, PII, toxicity, custom). Pairs with any model provider.
8. LangSmith / Langfuse (observability). Langfuse is the open-source option: traces every prompt and tool call, making prompt injection and data exfiltration visible.
9. OWASP LLM Pentesting tools (garak + promptfoo + custom). The practical stack most teams run: garak for breadth, promptfoo for regression, and a logging layer for runtime anomalies.
The Minimal Production Setup
- Scan - garak against every model before launch
- Regression - promptfoo in CI with your injection test set
- Filter - LLM Guard or NeMo Guardrails at the input/output boundary
- Observe - Langfuse to trace and alert
FAQ
Are these free? All are open source (Apache-2.0/MIT mostly); some offer paid cloud versions.
Which one first? garak - run it against your model and see what breaks. It takes 10 minutes to set up.
Do these protect against all LLM attacks? No - they reduce risk. The model itself, your deployment, and your data pipeline are all part of the attack surface.
