Crate cerberust 

cerberust — fast Rust guardrails for LLM input/output, a Rust llm-guard.

Two tiers

• Inner — Scanner + ScannerStack. A Scanner is a pure scan(text, &mut ScanCtx) -> Verdict. The ScannerStack runs scanners in order, threads the (maybe-rewritten) text and a shared Vault, short-circuits on a Block scanner returning valid = false, aggregates risk as the max, and on the output path restores in LIFO order.
• Outer — Middleware + MiddlewareChain. A Vercel-AI-SDK-shaped interface that nests middlewares around a model call. One middleware is implemented — the GuardrailRunner — which wraps a ScannerStack (input scan before, output scan after).

The Vault is the keystone: a request-scoped placeholder↔original map, zeroized on drop, with nonce-tagged sentinels. Reversibility is a per-scanner RestorePolicy (RoundTrip vs OneWay), not a property of the data type.

Scanners shipped

• PiiScanner — reversible PII tokenization (RoundTrip).
• SecretScanner — secret detection (OneWay by default).
• RestoreScanner — the output-path restore for RoundTrip redactions.
• RegexScanner — caller-supplied custom patterns (ReDoS-safe, configurable RestorePolicy and direction).
• BanSubstringsScanner — block or redact configured literal substrings.
• BanTopicsScanner — keyword-per-topic blocking.
• TokenLimitScanner — reject over-budget input.

ML prompt-injection (feature prompt-injection)

With the prompt-injection feature, PromptInjectionScanner classifies a prompt with a DeBERTa-v3 sequence classifier (protectai/deberta-v3-base-prompt-injection-v2, the model llm-guard ships) and blocks when P(injection) crosses a threshold. Inference is ONNX Runtime via ort (binaries downloaded at build time, no system ORT); the tokenizer is the Hugging Face tokenizers crate. The ~739 MB weights are not vendored — scripts/fetch-model.sh downloads them into a directory the scanner loads.

Sandboxed WASM guards (feature wasm)

With the wasm feature, WasmScanner loads a third-party guard compiled to a WebAssembly Component (wit/guard.wit: scan(text) -> verdict) and runs it as an ordinary Scanner — same scan(text, ctx) -> Verdict surface as the native scanners. The guest is instantiated against an import-less wasmtime linker, so it has no filesystem, network, or clock: a custom guard sees the text it is handed and returns a verdict, and can do nothing else. Egress is impossible by construction — a component that imported any host capability is rejected at load.

Re-exports

pub use middleware::Chunk;

pub use middleware::ChunkSink;

pub use middleware::ChunkSource;

pub use middleware::GuardrailRunner;

pub use middleware::Middleware;

pub use middleware::MiddlewareChain;

pub use middleware::MiddlewareError;

pub use middleware::Model;

pub use middleware::ModelSpec;

pub use middleware::Params;

pub use middleware::PrivacyTier;

pub use middleware::StreamModel;

pub use middleware::TierPolicy;

pub use scanner::Blocked;

pub use scanner::Direction;

pub use scanner::Disposition;

pub use scanner::HoldBack;

pub use scanner::NonceStrategy;

pub use scanner::RestoreEncoder;

pub use scanner::RestorePolicy;

pub use scanner::ScanCtx;

pub use scanner::ScanEntry;

pub use scanner::ScanError;

pub use scanner::ScanMetrics;

pub use scanner::ScanReport;

pub use scanner::ScanResult;

pub use scanner::Scanner;

pub use scanner::ScannerId;

pub use scanner::ScannerStack;

pub use scanner::Threshold;

pub use scanner::Vault;

pub use scanner::Verdict;

pub use scanners::BanSubstringsScanner;

pub use scanners::BanTopicsScanner;

pub use scanners::PiiScanner;

pub use scanners::RegexRule;

pub use scanners::RegexScanner;

pub use scanners::RestoreScanner;

pub use scanners::SecretScanner;

pub use scanners::TokenLimitScanner;

pub use scanners::Topic;

pub use wasm::WasmLoadError;

pub use wasm::WasmScanner;

Modules

middleware

The outer tier: a Vercel-AI-SDK-shaped Middleware trait and a MiddlewareChain that nests middlewares around a model call.

scanner

The inner tier: the Scanner trait, the request-scoped ScanCtx, and the ScannerStack that composes scanners in order.

scanners

The shipped scanner set: pii::PiiScanner and secrets::SecretScanner, plus the shared restore::RestoreScanner that rehydrates RoundTrip redactions on the output path; and the pattern scanners (regex::RegexScanner, ban_substrings::BanSubstringsScanner, ban_topics::BanTopicsScanner, token_limit::TokenLimitScanner).

wasm

The WASM guard runner: load a user-submitted guard compiled to a WebAssembly Component and run it as a Scanner, sandboxed.