Content Filtering in the Generative AI Hub

Two providers, applied where you choose

The content filtering module in config.modules.filtering is optional and works on input, output, or both independently — an unconfigured input passes straight to the model, and an unconfigured output returns without any check. It supports two services, Azure Content Safety and Llama Guard 3, and you can run both together: each filter type can appear only once per direction (you cannot stack two differently-tuned Azure Content Safety filters on the same input), but different types run concurrently, and the orchestration service waits for every configured filter to finish before it returns a result. SAP explicitly warns against pasting examples of restricted content into a prompt template as a workaround — doing so can itself skew the classifiers into false positives. C339 places this module inside the full pipeline; this card is the deep dive on the two providers themselves, and pairs with C365 on the masking module that runs just before input filtering in the same pipeline.

Why it matters

• A red-team exercise built only from system-role jailbreak prompts will pass cleanly since August 2026 — not because the defense is strong, but because Prompt Shield no longer evaluates that role at all.
• Client code that checks HTTP status alone will ship with silent blank answers whenever the output filter fires, since a filtered output is a 200, not an error.
• Stacking Azure Content Safety and Llama Guard 3 on both directions quietly quadruples the filtering bill per request — a detail that belongs in any cost estimate next to the model call itself.

Key points

• Two providers: Azure Content Safety (Hate/Violence/Sexual/SelfHarm at 0/2/4/6, Prompt Shield, protected-code detection) and Llama Guard 3 (14 boolean categories).
• Each filter type once per direction; different types run concurrently; orchestration waits for all to complete.
• Prompt Shield runs before harm classification when both are configured; a detected attack skips harm classification entirely.
• Since August 2026, Prompt Shield ignores system and developer role content.
• Input filter rejection = HTTP 400, no model tokens consumed. Output filter block = HTTP 200 with finish_reason: content_filter, not an error.
• Every Azure OpenAI model carries a non-configurable global filter blocking severity 4 and 6 regardless of your thresholds.
• Each configured filter type is billed as a separate request — stacking providers and directions multiplies cost.
• Azure Content Safety has automatic regional fallback on service unavailability; Protected Material Detection for Code only catches code published before its knowledge cutoff.

Terms used on this page

Harm classification

Azure Content Safety's severity scoring (0/2/4/6) of Hate, Violence, Sexual and SelfHarm content.

Prompt Shield

Azure Content Safety's prompt-attack detector; since August 2026 it ignores system and developer role content.

Protected Material Detection for Code

An output-only Azure Content Safety check for generated code matching public GitHub repositories up to a knowledge cutoff.

Llama Guard 3

A 14-category boolean hazard classifier (llama_guard_3_8b); only requested categories are enforced by orchestration.

finish_reason: content_filter

The field signalling an output-filter block; the HTTP status is still 200.

Global content filter (Azure OpenAI)

A platform-level filter on every Azure OpenAI model that blocks severity 4/6 content independent of your own thresholds.

Sources

1. SAP AI Core docs (SAP-docs GitHub, Sep 2026) — Content Filtering (Azure Content Safety, Prompt Shield, protected material, Llama Guard 3, billing note)
2. SAP AI Core docs — Enhancing Model Consumption with Input Filtering (request/response example, 400 on rejection)
3. SAP AI Core docs — Enhancing Model Consumption with Output Filtering (finish_reason content_filter)