Circuit Breaker

Circuit breakers monitor a sliding time window for a specific metric—such as toxicity scores, jailbreak attempts, or out-of-distribution queries. When the count of violations exceeds a predefined critical threshold within that window, the breaker trips and immediately halts inference. This prevents attackers from slowly probing the model by enforcing a strict rate limit on dangerous activity.

• Metric: Policy violations per minute
• Action: Instant inference denial
• Reset: Automatic cooldown period

Circuit breakers implement distinct failure modes to handle different risk profiles. A fail-open state allows traffic to pass while logging violations for audit, whereas a fail-closed state blocks all requests until manual intervention. The half-open state permits a limited probe of traffic to test if the system has recovered before fully restoring service.

• Fail-Closed: Total block on trip
• Fail-Open: Log-only mode for low-severity events
• Half-Open: Gradual recovery with canary requests

Beyond simple violation counting, advanced circuit breakers use statistical process control to detect shifts in the baseline distribution of inputs. A sudden spike in embedding drift, prompt length, or semantic entropy can trigger the breaker even if individual requests pass a safety classifier. This defends against distributional attacks that exploit blind spots in point-in-time filters.

• Drift metrics: Embedding cosine distance, perplexity shift
• Baseline: Calibrated on normal production traffic
• Response: Preemptive throttling before violations occur

Circuit breakers operate as a defense-in-depth layer that wraps around existing safety classifiers and guard models. While a guard model scores individual prompts, the circuit breaker aggregates those scores over time to detect coordinated attacks. This pairing ensures that a slow, low-confidence adversarial campaign that evades per-request detection is still caught by the temporal aggregation logic.

• Upstream: Safety classifier, PII redaction, jailbreak detector
• Downstream: Circuit breaker as final arbiter
• Signal: Aggregated risk scores over time

In production MLOps pipelines, a circuit breaker can be wired into the model serving infrastructure to automatically roll back a canary deployment. If a new model version exhibits a statistically significant increase in violation rates compared to the stable baseline, the breaker severs traffic and reverts to the last known good configuration without human intervention.

• Canary monitoring: Compare violation rates between versions
• Action: Automatic traffic shift to stable model
• Latency: Sub-second rollback on trip

Every trip event generates an immutable audit record capturing the window of requests that triggered the breaker, the specific thresholds breached, and the remediation action taken. This forensic log is essential for compliance with frameworks like the EU AI Act, providing evidence of real-time risk management and enabling post-incident analysis to refine safety policies.

• Logged: Triggering payloads, timestamps, threshold values
• Compliance: EU AI Act, NIST AI RMF
• Use case: Incident response and policy tuning

A specialized model that evaluates an input prompt or generated output to assign a risk score. When a toxicity or policy threshold is breached, it triggers a refusal or sanitization action. Safety classifiers often serve as the detection layer that feeds into a circuit breaker's decision logic.

• Operates in real-time during inference
• Common categories: hate speech, violence, self-harm, PII leakage
• Can be a fine-tuned BERT variant or a general-purpose LLM-as-a-judge

The real-time identification and blocking of adversarial prompts specifically engineered to bypass an LLM's safety guardrails. A circuit breaker may monitor the rate of jailbreak attempts within a time window, tripping when an attacker is systematically probing the system.

• Detects patterns like role-playing, encoding tricks, or multi-turn manipulation
• Often uses a dedicated Prompt Injection Classifier
• Critical for preventing cascading bypasses across sessions

A defense-in-depth architecture that combines multiple heterogeneous safety classifiers via a voting or cascading mechanism. A circuit breaker can act as the final arbiter in this ensemble, halting all inference if the ensemble's aggregate risk score exceeds a critical threshold.

• Layers: regex filters, semantic embedding checks, neural classifiers
• Reduces false negatives through redundancy
• Each layer operates at different latency and precision trade-offs

An immutable, chronological log of all prompts, model decisions, guardrail interventions, and human overrides. When a circuit breaker trips, the audit trail provides forensic traceability for incident response and compliance reporting.

• Captures the exact query that triggered the breaker
• Records the time window and violation count
• Essential for regulatory frameworks like the EU AI Act

A fine-tuning process that explicitly teaches a model to decline compliance with harmful requests by generating a safe refusal string. While circuit breakers operate at the infrastructure level, refusal training embeds safety at the model level, creating overlapping layers of defense.

• Uses datasets of harmful prompts paired with refusal responses
• Can lead to Over-Refusal if not calibrated
• Complements runtime guardrails rather than replacing them

A runtime inference technique that applies a logit bias or token mask to force the LLM to generate outputs that strictly adhere to a predefined grammar or schema. Unlike a circuit breaker which stops generation entirely, constrained decoding proactively prevents unsafe tokens from being sampled.

• Guarantees structural compliance with JSON schemas or API contracts
• Prevents generation of disallowed content categories at the token level
• Often used alongside circuit breakers for layered safety