Changelog

April 2, 2025

Container version: 2.0.73, tag: stable

New Features

Platform

  • Allow user-defined prompt Allow/Deny lists to customise detection behaviour. See documentation here.
  • Allow/Deny lists detections have been added to the Request Details page.
  • A dedicated “request created” timestamp was added to request logs.

Improvements

Guard

  • Improved models for self-hosted customers with reduced False Positive Rate and better policy level alignment.
  • Reduced False Positive Rate for prompt attacks when scanning model responses.

Bug Fixes

Platform

  • Dashboard’s activity graph resolution corrected for sub-day time ranges to show hourly data.
  • Bugs in logs, pagination handling, and filtering.
  • Prompt detection level reporting in Request Logs for certain requests has been made consistent.
  • Policy edit layout fixes for empty input/output settings.
  • Clarified placeholder texts on defense configuration screens for improved understandability.
March 5, 2025

Container version: 2.0.46, tag: stable

New Features

Platform

  • SaaS Platform: added a new Lakera Guard tutorial on https://platform.lakera.ai/, released a “Getting Started” guide, as well as a completely redesigned playground.
  • SaaS Platform: enabled advanced features (policies, projects, dashboard) for community users.
  • Saas Platform: show the “Advanced settings” button for custom regexp-based classifiers.

Improvements

  • Detectors: reduced latencies for PII (short prompts) and prompt injection classifiers.
  • SaaS Platform: updated UI wording to be consistent.
  • Saas Guard: request limits are enforced for the community tier now.

Bug Fixes

  • Detectors: significantly reduced moderation False Positives on non-English languages.
  • SaaS Platform: ensured selected date range is correctly shown in the date picker across the platform.
February 19, 2025

Container version: 2.0.36, tag: stable

New Features

Platform

  • SaaS Platform: Rolled out detailed threat intelligence dashboard to monitor production traffic in real time as well as the ability to investigate threats on a per request level.

Improvements

  • Configuration: Use MAX_CONTENT_LENGTH env variable instead of MAX_INPUT_TOKENS to limit request sizes. See the self-hosting guide.
  • Configuration: Use MAX_WARMUP_INPUT_SIZE env variable instead of MAX_WARMUP_TOKENS to set expected request size to be used for model warmup prior to the first request. See the self-hosting guide.

Bug Fixes

  • SaaS Platform: Improved Request Details page.
  • SaaS Platform: Request Details export: Export historic Policy ID that was active at request time.
  • SaaS Platform: Various Request Log fixes around requests with custom detectors.
  • SaaS Platform API: “projects” endpoint responses are now consistent with “policies” endpoint responses.
  • Detectors: Stop reporting email addresses from popular domains as unknown links.
  • Detectors: Incorporated latest threat intelligence data to increase the accuracy of the prompt attack detector.
February 5, 2025

Container version: 2.0.28, tag: stable

New Features

Platform

  • Added a new button on the SaaS Requests page to submit misclassification prompts
  • Added a beta SaaS API for managing policies
  • Added holistic detection screening for the last user and assistant pair in a request
    • Takes into consideration the response from the LLM along with the user request
    • Improves determination of attack likelihood

Improvements

Content Moderation

  • Enhanced content moderation detectors
  • Improved Spanish language handling for prompt attacks

Bug Fixes

  • Fixed SaaS dashboard display issue with breakdown flag
January 22, 2025

Container version: 2.0.17, tag: stable

New Features

Platform

  • Added new Platform API Key section in the SaaS API Access Page
    • Will be used for upcoming APIs to manage SaaS platform integration

Bug Fixes

  • Fixed policy linter bug that prevented error-free linting
  • Improved overall false positive rates

Security

  • Risk accept note for CVE-2024-7592 in the Guard self-hosted container
    • Listed as High/Low vulnerability depending on scanner
    • CVE.org specifically lists it as low
    • Vulnerability related to http.cookie handling, not part of Lakera Guard REST interface

Changes

  • Removed advanced editing button for custom detectors
    • Advanced editing of custom detectors now visible by default
    • See documentation for more details
January 8, 2025

Container version: 2.0.8, tag: stable

New Features

Self-Hosted

  • Added configurable policy reload period for Self-Hosted containers
    • Controllable via POLICY_RELOAD_INTERVAL_SECONDS environment variable

Bug Fixes

  • Improved prompt defense and content moderation models
  • Fixed 500 status bug when empty strings were in link detector payloads
    • Only affected link detection classifiers

Security

  • Mitigated multiple CVEs in the Guard container:
    • CVE-2024-49766
    • CVE-2024-49767
    • CVE-2024-52303
    • CVE-2024-52304

Changes

  • PII detection now only parses US formatted phone numbers
    • Reduces false positives with other number strings