Rule-based versus model-based LLM guardrails

WHAT THIS TESTS The interviewer wants you to distinguish cheap deterministic checks from learned classifiers, and to recognize that safety lives outside the model in auditable code. It is a foundational applied-safety question.

A GOOD ANSWER COVERS Definition: a guardrail is a programmatic safeguard that sits around the LLM and inspects either incoming prompts or outgoing responses, enforcing policy by blocking, redacting, rewriting, or routing. It is independent of the model's own reasoning so it remains reliable even when the model misbehaves. Simple rule-based example: a regex or keyword blocklist that detects specific banned terms, profanity, or structured PII patterns like credit-card or social-security number formats, and blocks or redacts them. It is fast, transparent, and deterministic but brittle, easily evaded by paraphrase or obfuscation, and prone to false positives. Advanced model-based example: a dedicated classifier or moderation model, such as a toxicity or safety classifier, that scores text for hate, harassment, sexual content, violence, or self-harm based on meaning rather than surface tokens, catching harmful intent that no keyword list anticipates. The trade-off is added latency and the need to maintain and update the classifier. In practice you layer both: cheap rules as a first pass, model-based checks for nuance.

COMMON WRONG ANSWERS Claiming the LLM can fully police itself via the system prompt with no external guardrail. Saying a single keyword filter suffices. Conflating rule-based and model-based as the same thing. Ignoring that guardrails apply to both input and output.

LIKELY FOLLOW-UPS Why do keyword filters fail, obfuscation and paraphrase. What latency does a classifier add. How do you reduce false positives. Where do guardrails sit, input and output stages.

ONE CONCRETE EXAMPLE A blocklist catches the literal slur but misses a misspelled or coded variant; the model-based toxicity classifier scores the message as hateful by meaning and blocks it, showing why the learned layer complements the rule.