NemoGuard-JailbreakDetect

What is NVIDIA NemoGuard-JailbreakDetect?

NVIDIA NemoGuard-JailbreakDetect is a downloadable safety model from NVIDIA for detecting jailbreak attempts and adversarial prompt-injection requests. A jailbreak is an input designed to make a language model ignore its system instructions or safety policies. Prompt injection is a related attack in which instructions embedded in user-controlled content attempt to redirect the model's behavior.

The model is intended to sit in front of another language model as an input screening layer. An application can submit a user's prompt to NemoGuard-JailbreakDetect, inspect the returned classification, and decide whether to continue, block the request, route it for review, or apply another safety policy. The detector is therefore a guardrail component rather than a conversational model.

How the detector works

The underlying downloadable model is a random forest classifier. A random forest combines the decisions of multiple decision trees to classify an input. In this case, the classifier operates on 768-dimensional embeddings generated by Snowflake Arctic Embed M Long. An embedding is a numerical representation of text that captures patterns useful for classification.

This architecture is important because NemoGuard-JailbreakDetect does not directly function as a general-purpose language model. It does not write answers, reason through a conversation, or produce chat completions. Its role is to map an input prompt to a safety classification based on patterns learned during training.

NVIDIA also provides a NemoGuard JailbreakDetect NIM for serving the detector. NIM is NVIDIA's inference-serving format for deploying models as services. The NIM accepts raw prompt text and handles the inference pipeline needed to produce the classification result.

Inputs, outputs, and endpoint

The documented NIM interface uses a /v1/classify endpoint. A request contains an input string representing the prompt to evaluate. The response includes a Boolean jailbreak field and a numeric score field.

The Boolean field provides the direct classification, while the score gives additional information about the detector's result. According to the supplied NVIDIA documentation, the score ranges from -1 to 1. Positive values are associated with inputs classified as jailbreak attempts, and negative values are associated with safer inputs. Applications can use the score when they need more nuanced thresholds than a simple true-or-false decision, although the appropriate threshold should be validated against the application's own traffic.

The service is a classifier, not an OpenAI-compatible chat-completions model. It returns structured classification information rather than generated conversational text. The documented interface also does not establish support for streaming, tool calls, function calling, or text generation.

Documented performance

NVIDIA reports an F1 score of 0.9601, a false-positive rate of 0.0042, and a false-negative rate of 0.0435 for its documented evaluation setup. F1 combines precision and recall into one measure, while the false-positive and false-negative rates describe different types of classification error.

These are provider-reported evaluation results, not guarantees for every deployment. Performance can change with language, domain, prompt formatting, attack strategy, and the types of prompts seen in production. New jailbreak techniques may also differ from the examples represented in the evaluation data. Teams should test the detector on representative traffic before using it as the sole basis for blocking requests.

Supported modalities and capabilities

NemoGuard-JailbreakDetect is a text-input classifier. The supplied specifications identify text input as supported and do not identify image, audio, or video input. It does not produce text, images, audio, video, embeddings, speech, or other generative media as its primary output. Its output is a jailbreak classification and score.

Because it is not a generative language model, conventional measures such as context window, maximum output tokens, reasoning score, and coding score are not documented for this item. The available research also does not specify a maximum input character or token limit. Applications should confirm operational limits in the selected NIM version and deployment configuration rather than assuming limits from another NVIDIA model.

Pricing and deployment

NemoGuard-JailbreakDetect is available as a downloadable NVIDIA NIM for local or infrastructure-based deployment. No official per-token price, hosted API price, or recurring subscription price was identified in the supplied research. As a result, there is no verified price that can be used to compare it directly with hosted classification APIs.

Deployment costs will depend on the infrastructure used to run the NIM and the surrounding application. Those costs may include compute, storage, networking, operations, and monitoring, but the supplied research does not provide a standardized total-cost figure. The downloadable deployment model can nevertheless be relevant to organizations that need to keep prompt screening within their own environment or want control over service placement.

Main strengths and limitations

Strengths

• Focused purpose: The model is specifically designed to detect jailbreak and prompt-injection attempts rather than trying to cover unrelated generative tasks.
• Simple integration pattern: The NIM exposes a classification endpoint that accepts an input string and returns a Boolean decision plus a score.
• Deployable as a service: The downloadable NIM supports infrastructure-based deployment rather than requiring the detector to be consumed only as an unspecified hosted service.
• Strong reported evaluation results: NVIDIA reports an F1 score of 0.9601 with a false-positive rate of 0.0042 and a false-negative rate of 0.0435 on its documented evaluation setup.
• Low output complexity: Applications receive a compact classification result instead of needing to parse generated prose to determine whether a prompt should be allowed.

Limitations

• Narrow scope: It is not a general-purpose language model, chat assistant, content generator, embedding service, or complete content-moderation system.
• No documented context or token limits: The supplied specifications do not state a conventional context window or maximum input size.
• Evaluation does not guarantee production accuracy: False positives and false negatives remain possible, particularly for new attack styles, unusual prompt formats, or domains different from the evaluation data.
• Not a complete guardrail policy: Jailbreak detection does not by itself determine whether an otherwise compliant request is harmful, disallowed, private, or unsuitable for a particular application.
• No verified hosted pricing: The research does not identify a standard per-request or per-token price.

When to choose NemoGuard-JailbreakDetect

Choose NemoGuard-JailbreakDetect when the main requirement is to screen text prompts for attempts to override model instructions before those prompts reach a generative model. It is especially suitable for teams that want a dedicated first-stage detector, a compact classification response, and a downloadable NVIDIA NIM deployment option.

For example, an application could submit a user message to the classifier, reject requests marked as jailbreak attempts, and send other requests to its normal language model. The score can also support a review path: high-confidence positives might be blocked automatically, while borderline cases could be sent to a human reviewer or evaluated by additional safeguards.

Another reason to choose it is architectural separation. A general-purpose language model can generate an answer, but using that same model to judge every input may be slower, more expensive, or less predictable than placing a specialized classifier before it. NemoGuard-JailbreakDetect is designed for the narrower screening step.

When another option may be more appropriate

Use a general-purpose language model instead when the primary task is conversation, writing, coding, analysis, or other text generation. NemoGuard-JailbreakDetect cannot replace that model because it does not generate responses.

Use a broader content-safety solution when the application needs to detect categories beyond jailbreaks and prompt injection. The supplied research does not establish that this detector identifies every type of unsafe content, privacy violation, abusive request, or policy breach. It should therefore be combined with application-level rules, monitoring, and other safety controls when those requirements matter.

A hosted safety API or another managed classifier may be more appropriate when a team does not want to operate a downloadable NIM or manage its infrastructure. Conversely, an alternative detector may be preferable if testing shows better results for the application's languages, domains, or attack patterns. The NVIDIA-reported metrics are useful reference points, but they should not replace an evaluation on real workloads.

Bottom line

NVIDIA NemoGuard-JailbreakDetect is a specialized, deployable input guardrail for identifying jailbreak and prompt-injection attempts. Its random-forest architecture, embedding-based design, and focused /v1/classify interface make it different from a conversational model: it screens prompts and returns a decision rather than producing an answer. Its reported evaluation results are promising, but the model should be treated as one layer in a broader safety design, with production testing and additional policy controls used to address risks outside jailbreak detection.