Configuring AI Model Check Rules for Security and Compliance of LLM Applications

On the Text Check Rules tab, add a text check rule to check LLM prompts and responses.

1. On the Text Check Rules tab, click Add Rule.
2. In the Add Text Check Rule dialog box, configure the following parameters and click OK.

   Table 1 Parameters for an LLM text check rule

   Parameter	Description	Example Value
   Basic Information
   Rule Name	Name of the LLM check rule. The name can contain a maximum of 128 characters. Only letters, digits, underscores (_), hyphens (-), colons (:), and periods (.) are allowed.	waf-text
   Protocol Template	MAF supports the following templates: OpenAI Response: This template preset in MAF can meet most application scenarios. You can also adjust the template based on the actual service requirements. This template is configured with the following information by default: Model Q&A Path: /v1/chat/completions. Prompt Verification: Injection detection is enabled by default. Compliance check is enabled by default. Prompt Index: $.messages[-1].content, which indicates that the value of content of the last element in the messages array is extracted. Protective Action: Log only. Response Compliance: Response check is enabled by default. Response Content Index: $.choices[-1].delta.content, indicating that the value of the content parameter of the last element in the choices array is extracted. Protective Action: Anonymize Custom: a blank template. It does not contain the default task configuration. You need to customize parameters based on service details.	OpenAI Response
   Model Q&A Path	Enter the URL of the model Q&A. Enter a maximum of 4,096 characters. The value cannot start or end with a space. The following special characters are not allowed: <>	/v1/chat/completions
   Description (Optional)	Description of the rule.	-
   Prompt Verification
   Injection Detection	Injection detection detects attacks like reverse engineering and role-playing attacks that target large models. If you enable this function, WAF will block malicious inputs designed by attackers as prompts.
   Compliance Check	Compliance check detects violent, discriminatory, illegal, and immoral content. If you enable this function, WAF can effectively filter out non-compliant information entered by users.
   Prompt Index	An index is used to identify or locate a prompt in a specific data structure. You can configure prompt indexes to easily search for, access, and process information related to prompts. The index is the JSONPath of the request body and complies with the JSONPath syntax. All examples in Table 5 are supported.	$.messages[-1].content
   Protective Action	Protective action taken when a prompt matches the detection requirements. The options are as follows: Log only: If a prompt matches the detection requirements, attack information is only logged. Block: If a prompt matches the detection requirements, the request is blocked. If you set Protective Action to Block, set HTTP Return Code, Block Page Type, and Page Content for the block page. For details about how to configure the Block action, see Example 1: Prompt Verification.	Block
   Response Compliance
   Response Compliance Check	Compliance check checks the model response data. If you enable this function, WAF can effectively filter out non-compliant outputs of the large models.
   Response Content Index	You can configure response content index to easily search for, access, and process information related to response content. This parameter is the JSONPath of the request body. The JSONPath syntax is used. Examples 1, 2, 3, and 5 in Table 5 are supported.	$.choices[-1].delta.content
   Protective Action	Protective action taken when an output matches the detection requirements. The options are as follows: Log only: If an output matches the detection requirements, attack information is only logged. Anonymize: If an AI model output contains sensitive words, WAF identifies sensitive words based on the context and masks them as - in final responses. Terminate response: If an AI model output contains sensitive words, WAF returns the content modified according to the termination response protocol, ends the on-going request, and ignores the subsequent responses from the origin server of the AI model.	Anonymize
   Protocol for Terminating Response	If you set Protective Action to Terminate response, you need to set Protocol for Terminating Response. Protocol for Terminating Response is used to define the response content if the Terminate response action is taken. By default, MAF presets the following protocol to terminate response: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 [ { "$.choices": [ { "finish_reason": "content_filter", "index": 0, "delta": { "content": "Sorry, I cannot answer this question right now. Let's try a different topic.", "role": "assistant" } } ], "$.model": "$.model", "$.created": "$.created", "$.id": "$.id", "$.service_tier": "$.service_tier", "$.object": "$.object", "$.usage": "$.usage" }, { "$": "[DONE]" } ] You can customize the default response termination protocol template. The syntax of the protocol for terminating response must comply with the following rules: The value must be in the form of a JSON array, with each element being a JSON object. The object can be empty, that is, {}. If the object is empty, the blocked response data is copied. The key value syntax is the same as the response index syntax. If an invalid value is detected, the configuration of this object will be skipped. The response termination protocol list accepts up to five objects, each supporting up to 10 indexes. Any data beyond these limits will be ignored. Each object requires unique indexes. Duplicate entries may produce incorrect results. If the response content remains unchanged, you can configure a constant, for example, $.data.choices in Scenario 2: Protective Action is set to Terminate response. If the response content is different but can be obtained from the response containing card, configure the object value following the response index syntax, for example, $.data.model in Scenario 2: Protective Action is set to Terminate response. When multiple operations are performed on the same index, later operations will overwrite earlier ones. For example, if you assign a value to $.data.model and then assign a value to $.data, the value assigned to $.data.model will not take effect. For array-type objects, you can assign values to their elements. For non-array objects, using an array index causes errors. For example, the raw request data is as follows: 1 {"data":{"arr":["1","2","3"],"item":{"sub_item":1}}} So, $.data.arr.new_index or $.data.item[1].new_index is invalid. If you have to make such modifications, clear $.data.arr or $.data.item and then assign a value, as shown in the following: 1 2 3 4 5 6 [ { "$.data.arr": "{}", "$.data.arr.new_index": "new_data" } ] Array objects do not allow value assignment to non-existent negative subscripts. For example, the raw request data is as follows: 1 {"data":{"arr":["1","2","3"],"item":{"sub_item":1}}} So, $.data.arr[-4] is invalid. To insert 0 at the beginning of $.data.arr, assign values to $.data.arr in reverse order. Assigning values in the original order will change the original values, resulting in unexpected results. 1 2 3 4 5 6 7 8 [ { "$.data.arr[3]": "$.data.arr[2]", "$.data.arr[2]": "$.data.arr[1]", "$.data.arr[1]": "$.data.arr[0]", "$.data.arr[0]": "0" } ] For details about how to configure the response termination protocol, see Example 2: Response Compliance Check.	For details about examples, see Example 2: Response Compliance Check.