Guardrails in Large Language Models for Domain-Specific AI Assistants: A Systematic Literature Review

• Daniel S. A. Araújo UFRN
• Lhayana V. Macedo UFRN

DOI: https://doi.org/10.5753/eniac.2026.29547

Resumo

Guardrails are runtime input/output filters that enforce domain restrictions and safety policies at inference time. Since 2022, they have become critical infrastructure for Large Language Model (LLM) deployments, while recent surveys map LLM safeguards broadly [Dong et al. 2025], a synthesis focused on domain-restricted assistants and on the operational security–performance trade-off (latency, cost, over-defense) is still missing. Following Kitchenham’s protocol across five databases, this SLR examines guardrails along five dimensions—off-topic detection, harmful-content filtering, PII protection, adversarial mitigation, and security-performance trade-offs—retaining 22 of 756 studies (2022–2026) at a quality threshold ≥4.5/5.0. Findings show that off-topic detection has matured from keyword filters to Representation Offset Analysis (ROA) and Neural Barrier Functions (NBF); adversarial mitigation is most effective when defensive suffixes, lightweight classifiers, and semantic deviation analysis are combined; and lightweight classifiers add only tens of milliseconds of latency. Adaptive routing can, in principle, keep most interactions on compact models, since its theoretical upper bound delegates only ≈5% of inputs to a larger safety model, but trained routers only approximate this ideal. A critical emerging concern is that guardrails themselves are vulnerable to backdoor poisoning and denial-of-service exploitation. Cross-modal evaluation and multi-agent security frameworks represent the field’s most urgent open problems.

Referências

Borji, A. (2023). A categorical archive of chatgpt failures. arXiv preprint arXiv:2302.03494.

Cevallos-Moreno, J. F., Rizzardi, A., Sicari, S., and Coen-Porisini, A. (2026). Ethical treatment of language models against harmful inference-time interventions. Engineering Applications of Artificial Intelligence, 172:114317.

Chen, Z., Kang, M., and Li, B. (2025). Shieldagent: Shielding agents via verifiable safety policy reasoning. In Forty-second International Conference on Machine Learning.

Dong, Y., Mu, R., Zhang, Y., Sun, S., Zhang, T., Wu, C., Jin, G., Qi, Y., Hu, J., Meng, J., et al. (2025). Safeguarding large language models: A survey. Artificial intelligence review, 58(12):382.

Hu, H., Robey, A., and Liu, C. (2026). Steering dialogue dynamics for robustness against multi-turn jailbreaking attacks. Transactions on Machine Learning Research.

Hu, X., Chen, P.-Y., and Ho, T.-Y. (2024). Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes. In Advances in Neural Information Processing Systems (NeurIPS), volume 37.

Kitchenham, B. A. and Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering. Technical Report EBSE-2007-01, Keele University and Durham University Joint Report.

Krishnan, S. S. and Siddiquie, D. (2025). Policy over tokens: Enforcing declarative governance constraints in cost-aware llm deployments. In 2025 IEEE International Conference on Agentic AI (ICA), pages 202–209. IEEE.

Lee, A. W., Chan, J., Fu, M., Kim, N., Mehta, A., Raghavan, D., and Çetintemel, U. (2025a). Semantic integrity constraints: Declarative guardrails for AI-augmented data processing systems. Proc. VLDB Endow., 18(11):4073–4080.

Lee, S., Lee, D. B., Wagner, D., Kang, M., Seong, H., Bocklet, T., Lee, J., and Hwang, S. J. (2025b). SafeRoute: Adaptive model selection for efficient and accurate safety guardrails in large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 2053–2069, Vienna, Austria. Association for Computational Linguistics.

Li, H., Liu, X., Zhang, N., and Xiao, C. (2025). Piguard: Prompt injection guardrail via mitigating overdefense for free. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 30420–30437, Vienna, Austria. Association for Computational Linguistics.

Liu, S., Cheng, X., Zheng, Z., and Su, S. (2026). Defending llms against jailbreak attacks through representation offset detection. Information Processing & Management, 63(5):104662.

Nazir, A. and Wang, Z. (2023). A comprehensive survey of chatgpt: advancements, applications, prospects, and challenges. Meta-radiology, 1(2):100022.

Piet, J., Huang, X., Jacob, D., Chow, A., Alrashed, M., Zhao, G., Hu, Z., Sitawarin, C., Alomair, B., and Wagner, D. (2025). Jailbreaksovertime: Detecting jailbreak attacks under distribution shift. In Proceedings of the 2025 Workshop on Artificial Intelligence and Security (AISec ’25). ACM.

Rabieinejad, E., Zarrinkalam, F., and Dehghantanha, A. (2026). Beyond the prompt: Logbased threat detection and attribution for multi-agent llms. Information Processing & Management, 63:104768.

Sreedhar, M. N., Rebedea, T., and Parisien, C. (2025). Safety through reasoning: An empirical study of reasoning guardrail models. In Findings of the Association for Com putational Linguistics: EMNLP 2025, Suzhou, China. Association for Computational Linguistics.

Tong, T., Wang, F., Zhao, Z., and Chen, M. (2025). Badjudge: Backdoor vulnerabilities of LLM-as-a-judge. In The Thirteenth International Conference on Learning Representations.

Tyshchenko, V. and Drushchak, N. (2025). Towards safe and secure llm systems: Defense strategies and assessment against inference-time security risks. In 2025 3rd International Conference on Foundation and Large Language Models (FLLM), pages 172–179. IEEE.

Weidinger, L., Mellor, J., Rauh, M., Griffin, C., Uesato, J., Huang, P.-S., Cheng, M., Glaese, M., Balle, B., Kasirzadeh, A., et al. (2021). Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359.

Xiong, C., Qi, X., Chen, P.-Y., and Ho, T.-Y. (2025). Defensive prompt patch: A robust and generalizable defense of large language models against jailbreak attacks. In Findings of the Association for Computational Linguistics: ACL 2025, pages 409–437.

Yan, S. and Wan, C. (2026). Lmdmi: A lightweight multilevel defense against malicious inputs for generative language models. In Proceedings of the 2025 International Conference on Artificial Intelligence and Foundation Model (AIFM ’25), pages 66–71, New York, NY, USA. Association for Computing Machinery.

Yang, R., Fu, M., Tantithamthavorn, C., Arora, C., Gulmammadova, G., and Chua, J. (2025). Adaptiveguard: Towards adaptive runtime safety for llm-powered software. In 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 3381–3391. IEEE Press.

Yi, X., Wang, L., Wang, X., and He, L. (2025). Fine-grained detoxification framework via instance-level prefixes for large language models. Neurocomputing, 611:128684.

Yuan, Z., Xiong, Z., Zeng, Y., Yu, N., Jia, R., Song, D., and Li, B. (2024). Rigorllm: Resilient guardrails for large language models against undesired content. In Proceedings of the 41st International Conference on Machine Learning (ICML), volume 235. PMLR.

Zhang, Q., Xiong, Z., and Mao, M. (2025a). Llm safeguard is a double-edged sword: Exploiting false positives for denial-of-service attacks. In Proceedings of the 2025 Workshop on Large AI Systems and Models with Privacy and Security Analysis (LAMPS ’25). ACM.

Zhang, X., Zhang, C., Li, T., Huang, Y., Jia, X., Hu, M., Zhang, J., Liu, Y., Ma, S., and Shen, C. (2025b). Jailguard: A universal detection framework for prompt-based attacks on llm systems. ACM Transactions on Software Engineering and Methodology (TOSEM), 35(1):Article 8.

Zheng, A., Rana, M., and Stolcke, A. (2025). Lightweight safety guardrails using fine-tuned bert embeddings. In Proceedings of the 31st International Conference on Computational Linguistics (COLING): Industry Track, pages 689–696.