ApplyGuardrail API and guardrail input tags for AIP-C01

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. A company's research assistant calls the Amazon Bedrock Converse API with tool use. When the model requests a web search, the application fetches the text of public web pages and returns that text to the model in toolResult content blocks. The application already calls the ApplyGuardrail API on each user question with a guardrail that has a prompt attack filter. A red team shows that instructions hidden in a fetched web page can redirect the assistant. The company must screen all fetched page text with its existing guardrail before the model processes that text. Which solution will meet these requirements?

   Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

   Not that one: C is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

   Your answerA.Associate an AWS WAF web ACL that uses the Known bad inputs managed rule group with the Amazon API Gateway stage that receives user questions. Block every request that matches a rule in the rule group.WAF inspects the incoming user request; the injected instructions arrive later, inside pages the application fetches.Your answerB.Add an instruction to the system prompt that tells the model to treat all tool results as data. Tell the model to ignore any instructions inside the fetched pages.A system prompt instruction is advice to the model, not a screening step, and it does not use the guardrail.The answerC.Call the ApplyGuardrail API with the source set to INPUT on the text of each fetched page. Return the text to the model in a toolResult block only when the guardrail does not intervene.ApplyGuardrail evaluates any text you send it, independent of a model call. The ApplyGuardrail page (guardrails-use-independent-api.html) says: "You can use the ApplyGuardrail API to assess any text using your pre-configured Amazon Bedrock Guardrails, without invoking the foundation models."Your answerD.Add the guardrail to the guardrailConfig parameter of every Converse call so that it evaluates the whole conversation. Enable the guardrail trace to record which filter intervened for each request.A guardrail in guardrailConfig does not evaluate toolResult content, so the fetched page text is never screened.

   Show the full explanation and doc quotes

   And "You can integrate the ApplyGuardrail API anywhere in your application flow to validate data before processing or serving results to the user." Screening each fetched page with source INPUT, before it is returned as a tool result, applies the existing prompt attack filter to exactly the text that carries the attack.

   Written from docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use-converse-api.html

2. A company's HR assistant calls the RetrieveAndGenerate API on an Amazon Bedrock knowledge base of HR case files. Each request includes a guardrail whose sensitive information filter anonymizes national ID numbers in model responses. The web application shows each answer and, below it, the source passages from the citations in the response so that employees can check the answer. An audit finds national ID numbers in the displayed source passages, although the answers are masked. No national ID number may appear anywhere in the web application. The case files in the knowledge base must not be changed. Which solution will meet these requirements?

   Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

   Not that one: A is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

   The answerA.Send the text of each retrieved reference in the response to the ApplyGuardrail API with the same guardrail and the source set to OUTPUT. Display the masked text when the guardrail intervenes.The retrieve and generate page (https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-retrieve-generate.html) states the gap: "Guardrails are applied only to the input and the generated response from the LLM. They are not applied to the references retrieved from Knowledge Bases at runtime." The passages come from "retrievedReferences", which the page describes as "An array of RetrievedReference objects, each of which contains the content of a source chunk". The ApplyGuardrail page (https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-use-independent-api.html) says "You can use the ApplyGuardrail API to assess any text using your pre-configured Amazon Bedrock Guardrails, without invoking the foundation models." Running each passage through it masks the IDs before display.Your answerB.Set the sensitive information filter to anonymize national ID numbers in prompts as well as in responses. Create a new guardrail version, and use it in the RetrieveAndGenerate requests.The input side of the guardrail covers the user's input, not the references that the knowledge base retrieves, so the passages stay unmasked.Your answerC.Add a regular expression for the national ID format to the sensitive information filter of the guardrail. Create a new guardrail version, and use it in the RetrieveAndGenerate requests.Detection already works, because the answers are masked; the passages are shown unmasked because the guardrail never evaluates the references.Your answerD.Add an instruction to the generation prompt template of the knowledge base that tells the model never to repeat national ID numbers. Keep the guardrail in each request.The instruction affects only the generated answer; the source passages come from the retrieved references, which the model does not write.

   Written from docs.aws.amazon.com/bedrock/latest/userguide/kb-test-retrieve-generate.html

3. A bank's customer assistant calls the Amazon Bedrock InvokeModel API with a guardrail. Each request body contains one text prompt that combines the system instructions, the customer's account summary, and the customer's question. The guardrail has content filters and a prompt attack filter with HIGH input strength. Red team tests show that jailbreak attempts in customer questions reach the model without any guardrail intervention. The guardrail must check customer questions for prompt attacks but must not check the system instructions or the account summary. A customer must not be able to make the guardrail skip part of the question. Which combination of steps will meet these requirements? (Select TWO)

   Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

   Not that one: B,E is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

   Your answerA.Change the guardrail's safeguard tier from Classic to Standard so that the prompt attack filter detects a wider range of jailbreak and prompt injection techniques in the text that it evaluates.A stronger classifier does not stop a customer from closing a fixed tag and placing text outside it, where the guardrail does not evaluate it.Your answerB.Enclose only the customer's question in amazon-bedrock-guardrails-guardContent tags, and pass the same tag suffix in the tagSuffix field of the amazon-bedrock-guardrailConfig object.Your answerC.Add the jailbreak phrases from the red team tests to a word filter in the guardrail, and set the word filter's input action to BLOCK.Word filters match exact words and phrases, so a reworded jailbreak passes, and the untagged prompt is still not checked for prompt attacks.Your answerD.Enclose only the system instructions in guardContent tags with one fixed tag suffix, and leave the customer's question outside the tags.This checks the system instructions and leaves the customer's question unevaluated, the reverse of the requirement.Your answerE.Generate a new random alphanumeric tag suffix for every request instead of reusing one fixed tag suffix for all of the application's requests.

   Show the full explanation and doc quotes

   The input tagging page says prompt attack filters "require input tags to be present", which is why the untagged prompt was never checked. It then warns: "A static tag can result in a malicious user closing the XML tag and appending malicious content after the tag closure, resulting in an injection attack", and "It is recommended to use a new, random string as the tagSuffix for every request."

   Written from docs.aws.amazon.com/bedrock/latest/userguide/guardrails-tagging.html