Lakera Guard Alternatives (2026): Six Prompt Injection Detectors Compared, and How to Read Their Benchmarks

The best Lakera Guard alternative depends on where you want detection to run. If your AI tools read outside material and you did not build them, a hosted gateway such as Constellation Gate AI screens every request and response in the traffic path, tool output included. If you are building your own app, Azure AI Content Safety Prompt Shields is the closest like-for-like prompt injection detection API. If you want to run it yourself, Llama Prompt Guard 2 with LlamaFirewall, or NeMo Guardrails. Two old open-source favourites, LLM Guard and Rebuff, are now archived. Everything below was checked on primary sources on 23 September 2026.

Why people are looking for a Lakera Guard alternative

Lakera built one of the best-known prompt injection detectors. Check Point has since completed its acquisition of the company, and the product has been folded into a broader platform: lakera.ai now sells AI Agent Security, Workforce AI Security and AI Red Teaming, the old /lakera-guard page redirects to AI Agent Security, and the documentation calls the screening service Check Point AI Guardrails.

The API itself is still there. The /v2/guard endpoint at api.lakera.ai takes a conversation in chat format and screens "the input and output contents of an LLM interaction", including tool calls, what a tool returns and the tool definitions you expose to the model. It returns a flagged result, and optionally a breakdown per detector. Lakera's own docs say Community (free) customers are "restricted to 10k screening requests per month"; Enterprise gets larger request packages, role-based access and SIEM export, on a quote.

None of that is a problem in itself. But an acquisition is a fair moment to check whether the roadmap, pricing and target buyer still match yours, and a product positioned inside an enterprise security platform may suit a bank better than a five-person agency. That, not any failing of the detector, is why this search exists.

Three ways to replace it

Decide where detection should sit first; it matters more than any benchmark number. (For the full map of guardrail layers, see our AI firewall explainer; this page only compares detectors.)

1. A hosted gateway in the traffic path. Every request and response is screened, whatever the tool's author did. The only option that covers software you did not write: Claude Code, ChatGPT, Cursor, an MCP server.
2. A cloud API your code calls. Your application sends text to the detector and acts on the verdict. Lakera works this way, and so does Azure. It protects exactly the calls you remember to wrap.
3. An open-source model or framework you run. No per-call fee, no data leaving your servers, and all of the hosting, tuning and patching is yours.

Lakera Guard alternatives compared

Checked on each vendor's own pages, documentation or repository on 23 September 2026.

Tool	Type	Where it runs	Screens prompts / responses / tool output	Open source	Price and free tier	Published benchmark
Lakera (Check Point AI Guardrails), for reference	Detection API	Cloud API your code calls	Yes / yes / yes	No	Community: 10k screening requests/mo; Enterprise on quote	PINT (Lakera's own, last scored May 2025)
Constellation Gate AI	Hosted gateway	Traffic path, no code change	Yes / yes / yes (tool output on Pro)	No	Free: 20,000 recorded requests/mo, basic pattern screen; Pro $20/user/mo	arXiv:2606.02959 (Gate's own)
Azure AI Content Safety Prompt Shields	Detection API	Azure cloud API, or built into Foundry	User prompts and documents; tool responses in Foundry	No	Free tier: 5,000 text records/mo; then per 1,000 records	None of its own found; scored in Lakera's PINT
Portkey guardrails	Gateway feature	Portkey gateway	Inputs and outputs; LLM checks and partners	Gateway core MIT	Deterministic checks free; LLM and partner guardrails on $49/mo plan	None found
Cloudflare AI Security for Apps	WAF add-on	In front of your own AI endpoint	Incoming prompts to your app	No	Enterprise add-on	None found
Llama Prompt Guard 2 + LlamaFirewall	Open-source model and framework	Your own hardware	Prompt Guard 2: text you pass it; LlamaFirewall adds agent checks	Llama 4 Community License	Free; you host it	Meta's model card; PINT scored it
NVIDIA NeMo Guardrails	Open-source framework	Inside your app or as a server	Input, output, retrieval and tool (execution) rails	Apache 2.0	Free; you host it	NVIDIA's vulnerability-scanning results

Not in the table, on purpose: Protect AI's LLM Guard and Rebuff. Both GitHub repositories are archived. LLM Guard's README now opens with "THIS PROJECT HAS BEEN ARCHIVED", and says its Hugging Face models are no longer maintained either. Protect AI itself was acquired by Palo Alto Networks in July 2025 and its technology went into Prisma AIRS. If an older comparison sends you to either project, treat it as out of date.

The alternatives, one by one

Constellation Gate AI: a gateway, not an API call

Constellation Gate AI is the option that works the other way round from Lakera. Affiliate link: we earn a commission on Pro seats that start from our link, which pays for the testing and has no say in the verdict. Gate calls itself "the accountability layer for AI" and sits "between your agent and the model". It is a hosted gateway, not an API you call per message: you point a tool at it once (the Gate Connect app does this for Claude Code, Codex, Cursor, ChatGPT and others), and every request and response passes through it.

Each one gets a verdict: allowed, flagged, blocked or redacted. The screening covers direct injection in what you send and indirect injection hidden in web pages, documents and tool output, which is where agent attacks usually arrive. Screening takes a median 53 milliseconds, with a deeper path for hard cases at 571 ms at the 95th percentile. The same gateway also compresses repeated context, redacts personal data and credentials, enforces spend limits and keeps a hash-chained audit log; the Gate AI page has a cost calculator.

What you get depends on the plan. Free is $0 with 20,000 recorded requests a month and a basic pattern-based injection screen. Full detection, tool-result scanning, blocking, redaction and limits are Pro, at $20 per user per month. Our full review covers the rest.

Best for: solo operators and small teams whose AI reads things nobody on the team wrote, using tools they did not build.

See what reaches your model. Start free with Gate: no card, one change of address. Free records, Pro blocks: the free plan shows you the attack; stopping it is Pro.

Azure AI Content Safety Prompt Shields

The closest like-for-like swap for Lakera's API. Prompt Shields detects two things: user prompt attacks (attempts to override system rules, role-play, encoding tricks) and document attacks, meaning "hidden instructions in third-party content, such as documents, emails, and web pages". The standalone API takes a user prompt and up to five documents and returns attackDetected for each. Inside Microsoft Foundry you attach it as a guardrail and can scan at the tool-response intervention point too.

The free tier covers 5,000 text records a month. A record is up to 1,000 characters, so a 7,500-character document counts as eight. The same service moderates hate, violence, sexual content and self-harm, which injection-only tools do not.

Best for: developers already on Azure building their own app.

Portkey guardrails

If you already route model calls through Portkey, its guardrails run inside the gateway on inputs, outputs or both. Deterministic checks (regex, JSON schema, code detection) come with the free plan; LLM-based checks, including prompt injection scanning, and partner guardrails need the $49-a-month Production plan. Partners include Azure's Prompt Shields, Palo Alto Networks Prisma AIRS, Pangea and Prompt Security, so Portkey can also be how you plug in a detector from someone else. Our LLM gateway comparison covers it on routing and fees.

Best for: product teams who want injection checks alongside routing and prompt management in one console.

Cloudflare AI Security for Apps

Formerly Firewall for AI. It runs in Cloudflare's web application firewall in front of your own AI endpoint and scans incoming requests for prompt injection, personal data and unsafe or custom topics. The detections are a paid add-on for Enterprise customers. It protects an AI app you publish from its users, not your team's use of other people's AI tools.

Best for: companies already on Cloudflare Enterprise with a public-facing AI feature.

Llama Prompt Guard 2 and LlamaFirewall

The strongest open-source prompt injection detection option still maintained. Llama Prompt Guard 2 is a classifier that labels text benign or malicious, in two sizes: 86M parameters (multilingual: English, French, German, Hindi, Italian, Portuguese, Spanish and Thai) and a faster 22M version with weaker multilingual performance. It reads 512 tokens at a time, so long documents must be split. Meta's model card says it remains vulnerable to adaptive attacks built to evade it.

LlamaFirewall is Meta's open-source framework that puts Prompt Guard 2 alongside AlignmentCheck, which watches an agent's reasoning for goal hijacking and indirect injection, and CodeShield for generated code. That combination is what covers agents; Prompt Guard 2 on its own only sees what you pass it.

Best for: engineers who want detection on their own hardware and will do the integration.

NVIDIA NeMo Guardrails

An Apache 2.0 toolkit that runs inside your Python app or as a server. It is broader than a detector: input, dialog, retrieval, execution (tool) and output rails, with jailbreak and injection detection built in. You configure it, so what it catches depends on what you set up.

Best for: teams building a conversational product who want every rail in one framework.

Prompt injection benchmark: how to read one

Searches for "prompt injection benchmark" are up about 175% on a year ago, mostly from people trying to compare tools like these. Every vendor has a chart. Here is how to tell whether it means anything.

1. Catch rate means nothing without a false-positive rate. A detector that flags everything catches 100% of attacks. The honest pair is recall (share of attacks caught) or F1 (a balance of catches and false alarms) at a stated false-positive rate. "95% detection" with no false-positive figure is a slogan.

2. Check over-blocking on benign sets. The failure you will feel first is a detector blocking your own ordinary requests. Two public datasets measure this: NotInject, benign prompts deliberately full of trigger words (from the InjecGuard paper, arXiv:2410.22770), and the benign split of WildGuard (arXiv:2406.18495). A tool that over-blocks a sixth of these will be switched off by your team within a week.

3. Ask whether the tool has seen the test. Public datasets leak into training data. Lakera built its PINT benchmark on a private dataset for exactly that reason. The trade-off: nobody outside can check it.

4. Match the benchmark to your risk. Most datasets test direct attacks typed by a user. If your risk is an agent reading a poisoned web page, look for indirect-injection sets such as BIPIA, and results on tool output. Our prompt injection explainer shows why these are different problems.

5. Note who ran it, and when. No independent leaderboard covers these products today. Every figure below is vendor-published.

What the published numbers say

Gate's report (arXiv:2606.02959, Goehausen and Sousa, June 2026, marked as a working preprint) evaluates 16 public benchmarks with 12,111 samples, at a single threshold capped at a 1-in-100 false-positive rate. At that point Gate reports catching 95.4% of attacks, which is 97.4% F1. The authors list their own gaps: possible pretraining contamination, no image or audio coverage, limited non-English testing, no adaptive attacker, no long-context document injection.

The head-to-head with Lakera is a separate claim, and it is worth reading closely:

Metric (vendor-published by Gate)	Gate AI	Lakera Guard (as reported by Gate)
Average F1 at matched false-positive rate (Gate's website, summarising the report)	96.6%	83.7%
Over-block rate on NotInject	2.7%	12.4%
Over-block rate on WildGuard-benign	1.4%	17.4%

Lakera's side of this table is not a fresh test. The report takes Lakera's scores from third-party papers, then re-tunes Gate's threshold to the false-positive rate each paper published for Lakera. The authors call it point-in-time and tied to the Lakera version those papers measured, and they note that Lakera markets a much lower false-positive rate (0.1 to 0.2%) from its own internal benchmark with per-customer calibration. So the comparison is careful, but it is still one vendor grading another.

Lakera's PINT benchmark is the mirror image. On its own dataset, scored in May 2025, it lists Lakera Guard at 95.22%, Azure Prompt Shields (documents and user prompts) at 89.12% and Llama Prompt Guard 2 (86M) at 78.76%. The repository is now archived, and Lakera wrote it.

Read both the same way: each vendor wins its own benchmark. The useful signal is the over-blocking figures and the dataset list, which you can check.

Before you swap: the free fixes

A detector is one layer. Whichever you pick, give agents only the tools they need, require a human click for anything irreversible, keep secrets out of prompts, and treat MCP servers like software you install (our MCP security guide). All seven defences are in how to prevent prompt injection, and the wider risk list is in our OWASP LLM Top 10 guide.

Which one

• You use AI tools you did not build (Claude Code, ChatGPT, Cursor) and they read outside material: Gate. A gateway is the only kind of detector that sees their traffic.
• You want tool output screened for an agent, without writing screening code: Gate on Pro.
• You are building on Azure and want a Lakera-shaped API: Prompt Shields.
• You already route through Portkey: switch on its guardrails, or plug a partner detector in.
• You publish an AI app on Cloudflare Enterprise: AI Security for Apps.
• Nothing may leave your servers and you have an engineer: Llama Prompt Guard 2 with LlamaFirewall, or NeMo Guardrails.
• You are happy with Lakera and on Enterprise: stay, and ask Check Point for its roadmap in writing.

Your first fifteen minutes

Following the rule we apply to every tool: real input, one output, hard stop.

1. Minutes 0 to 3. Write down where your current detection runs: in your code, in a gateway, or nowhere. List which tools send text to a model without passing it.
2. Minutes 3 to 6. Pick one line from "Which one" above.
3. Minutes 6 to 11. Set up the free tier of that option on one tool. For most readers of this site that is Gate: no card, and Gate Connect switches Claude Code or Cursor over in one toggle.
4. Minutes 11 to 15. Send ten ordinary requests from your real work, then paste in one page you know contains "ignore previous instructions". Write down two things: did it flag the attack, and did it flag any of your ten normal requests? That second number is your own over-block rate, and it matters as much as any benchmark.

Output: one tool screened, and two numbers you measured yourself. Free records, Pro blocks: if the attack shows up flagged and you want it stopped next time, that is what the $20 Pro seat is for. Start free with Gate (affiliate link; we earn a commission on Pro seats).

Sources, all checked 23 September 2026: lakera.ai (AI Agent Security product page); Check Point AI Security documentation at docs.lakera.ai (Guard API endpoint, Screening Agent Conversations, Dashboard); Check Point press release on completing the Lakera acquisition; Microsoft Learn, "Prompt Shields in Azure AI Content Safety", and the Azure Content Safety pricing page; Portkey guardrails documentation; Cloudflare AI Security for Apps documentation; Llama Prompt Guard 2 model card on Hugging Face; Meta PurpleLlama repository (LlamaFirewall); NVIDIA NeMo Guardrails repository; protectai/llm-guard and protectai/rebuff repositories (both archived); Palo Alto Networks press release on completing the Protect AI acquisition (22 July 2025); lakeraai/pint-benchmark repository (archived); Constellation Gate AI homepage and pricing page; Goehausen and Sousa, "Gate AI: LLM Security Benchmark Evaluation Methodology and Results", arXiv:2606.02959. All benchmark figures are vendor-published. If anything above has changed, tell us and we will fix it with a dated note.