Using Model Armor in ADK callbacks

Key Takeaways

[music] Building your own AI agents can completely change the way users experience your business. But this new level of access introduces threats like prompt injection, data leakage, and harmful content generation. When using ADK, the key to mitigating these risks is using callbacks to create security checkpoints in the agents interaction with a model. Model Armor is the dedicated service for enforcing policies that filter user prompts and model responses, protecting against these threats. I've made a few videos about it in the description below if you want to get caught up. We can integrate model armor with an ADK agent using the callback mechanism. The callback mechanism provides powerful hooks to observe, customize, and control the agents behavior. The most critical control point is right before the agent calls the LLM. We use the before model call back to implement an input guard rail. This function runs just before the LLM request is sent, allowing us to inspect and sanitize the user's prompt using the model armor API's sanitize user prompt method. If our model armor check detects a prompt injection attempt or other harmful content, the callback will skip the LLM call and return a predetermined response. This prevents the request from reaching the model entirely. After the model has generated a response, we must implement an output validation guardrail. We use the after model callback to inspect the raw LLM response before it's finalized and returned to the user. This callback calls the sanitize model response method from model armor. If the response contains leaked data or harmful output, we can replace or block the response. Replacing is useful if we want to preserve most of the response but just filter out a small part such as a name or a credit card number. See my video below for some detailed examples. First, we ask a benign question that is allowed to proceed, demonstrating the default behavior of the agent. When the model armor policy is satisfied, the model armor check passes. The callback prints that it is proceeding and the LLM is called. We receive a normal response as the call back returned no issues. Now, for the real test, we include a telltale sign of something a miss in our prompt. This simulates an attempt at prompt injection or a policy violation. The before model callback intercepts the request. Model Armor detects the attempt. Instead of sending the request to the LLM, the callback returns a static safe response. The LLM is skipped entirely, protecting the model from exposure. We must also secure the agents response when it comes directly from the LLM. The after model call back allows inspection and modification of the raw LLM output before it's processed further by the invoking agent. This is critical for preventing data leakage when the model inadvertently generates sensitive information. For example, if the LLM output contains a credit card number or CCN, a piece of data it should not be generating, this callback can enforce a policy to redact it. If a sequence matching a CCN is detected, the callback modifies the text to remove all but the last four digits, preventing disclosure, but still giving a user the information they need. By inserting these model armor security checkpoints with callbacks, you add a layer of defense to each point of your agents interaction with the model. Check out some useful ADK callback and model armor documentation in the links below, as well as the agent factory episode where we discuss how to use this in an agent that has access to your cloud environment. I'd really like to know what you're building and what issues you run into and what you want to see more of next. I read every comment, so please let me know below and I'll see you next time when we use anti-gravity to vibe code an agent in ADK that uses model armor based on the ideas we discussed in this video. Thanks for watching. Heat. Heat. N. >> [music]