Configuring AI Model Check Rules for Security and Compliance of LLM Applications

On the Text Check Rules tab, add a text check rule to check AI model prompts and responses.

1. On the Text Check Rules tab, click Add Rule.
2. In the Add Text Check Rule dialog box, configure the following parameters and click OK.

   Table 1 Parameters for an AI model text check rule

   Parameter	Description	Example Value
   Basic Information
   Rule Name	Name of the AI model check rule. The name can contain a maximum of 128 characters. Only letters, digits, underscores (_), hyphens (-), colons (:), and periods (.) are allowed.	waf-text
   Protocol Template	Templates supported by model application firewall (MAF) in WAF: OpenAI Response: This is a preset template. It can meet the security needs of most application scenarios. You can adjust the template based on actual service requirements. By default, the following content is configured in the template: Model Q&A Path: /v1/chat/completions Prompt Verification: Injection Detection is enabled by default. Compliance Check is enabled by default. Prompt Index: $.messages[-1].content. It means that the value of the content parameter of the last element in the messages array is extracted. Protective Action: Log only Response Compliance: Response Compliance Check is enabled by default. Response Content Index: $.choices[-1].delta.content. It means that the value of the content parameter of the last element in the choices array is extracted. Protective Action: Anonymize Custom: This is a blank template. It does not contain any default task configuration. You need to customize parameters based on your service details.	OpenAI Response
   Model Q&A Path	Enter the URL of the model Q&A. You can enter a maximum of 4,096 characters. The value cannot start or end with a space. The following special characters are not allowed: <>	/v1/chat/completions
   Description (Optional)	Description of the rule.	-
   Prompt Verification
   Injection Detection	This function detects attacks like reverse engineering and role playing attacks that target AI models. If you enable this function, WAF will block malicious inputs crafted by attackers as prompts.
   Compliance Check	This function detects content that is violent, biased, illegal, or immoral. If you enable this function, WAF can effectively filter out the non-compliant information entered by users.
   Prompt Index	An index is a way to identify or locate the position or number of a prompt in a specific data structure. You can configure prompt indexes to easily search for, access, and process information related to prompts. Prompt indexes use the JSONPath of the request body. They must comply with JSONPath syntax. All examples in Table 5 are supported.	$.messages[-1].content
   Protective Action	Action taken by the rule when a prompt matches the detection requirements. The options are as follows: Log only: If a prompt matches the detection requirements, WAF only generates an attack record. Block: If a prompt matches the detection requirements, WAF blocks the request. If you set Protective Action to Block, you still need to configure HTTP Return Code, Block Page Type, and Page Content for the block page. For details about how to configure the Block action, see Example 1: Prompt Verification.	Block
   Response Compliance
   Response Compliance Check	This function checks AI model response data. If you enable this function, WAF can effectively filter out the non-compliant outputs returned by protected AI models.
   Response Content Index	You can configure response content indexes to easily search for, access, and process information related to response content. This parameter uses the JSONPath of the request body. It must follow JSONPath syntax. Examples 1, 2, 3, and 5 in Table 5 are supported.	$.choices[-1].delta.content
   Protective Action	Action taken by the rule when an output matches the detection requirements. The options are as follows: Log only: If an AI model output matches the detection requirements, WAF only generates an attack record. Anonymize: If an AI model output contains sensitive words, WAF identifies them based on context and masks them with hyphens (-) in final responses. Terminate response: If an AI model output contains sensitive words, WAF returns the modified content according to the termination response protocol, terminates the ongoing request, and ignores any subsequent responses from the origin server of the AI model.	Anonymize
   Protocol for Terminating Response	If you set Protective Action to Terminate response, you need to configure Protocol for Terminating Response. It defines the final response content. By default, MAF presets the following protocol to terminate a response: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 [ { "$.choices": [ { "finish_reason": "content_filter", "index": 0, "delta": { "content": "Sorry, I cannot answer this question right now. Let's try a different topic.", "role": "assistant" } } ], "$.model": "$.model", "$.created": "$.created", "$.id": "$.id", "$.service_tier": "$.service_tier", "$.object": "$.object", "$.usage": "$.usage" }, { "$": "[DONE]" } ] You can customize the default response termination protocol template. The protocol syntax must comply with the following rules: The value must be a JSON array, where each element is a JSON object. An object can be empty, represented as {}. If an object is empty, the blocked response data is copied. The key value syntax follows the same rules as the response index syntax. If an invalid value is detected, the configuration of the corresponding object will be skipped. A response termination protocol list accepts up to five objects. Each object supports up to 10 indexes. Any data beyond these limits will be ignored. The indexes in an object must be unique. Otherwise, the check result may be inaccurate. If the response content remains unchanged, you can configure a constant, for example, $.data.choices in Scenario 2: Protective Action is set to Terminate response. If the response content is different but can still be obtained from the response containing card, configure the object value following the response index syntax, for example, $.data.model in Scenario 2: Protective Action is set to Terminate response. When multiple operations are performed on an index, later operations will overwrite earlier ones. For example, if you assign a value to $.data.model and then assign a value to $.data, the value assigned to $.data.model will not take effect. For array-type objects, you can assign values to their subobjects. For non-array objects, attempting to access or modify them using array subscript syntax will result in unexpected errors. Take the following raw request data as an example: 1 {"data":{"arr":["1","2","3"],"item":{"sub_item":1}}} In the preceding example, $.data.arr.new_index or $.data.item[1].new_index is invalid. If you have to make such modifications, clear $.data.arr or $.data.item and then assign a value, as shown in the following content: 1 2 3 4 5 6 [ { "$.data.arr": "{}", "$.data.arr.new_index": "new_data" } ] For array-type objects, assigning values to non-existent negative subscripts is not supported. Take the following raw request data as an example: 1 {"data":{"arr":["1","2","3"],"item":{"sub_item":1}}} The value assigned to $.data.arr[-4] is invalid. To insert 0 at the beginning of $.data.arr, assign values to $.data.arr in reverse order. Assigning values in the original order will change the original values, resulting in unexpected results. 1 2 3 4 5 6 7 8 [ { "$.data.arr[3]": "$.data.arr[2]", "$.data.arr[2]": "$.data.arr[1]", "$.data.arr[1]": "$.data.arr[0]", "$.data.arr[0]": "0" } ] For details about how to configure the response termination protocol, see Example 2: Response Compliance Check.	For details about examples, see Example 2: Response Compliance Check.