Llama Guard is now accessible in Amazon SageMaker JumpStart

At present we’re excited to announce that the Llama Guard mannequin is now accessible for purchasers utilizing Amazon SageMaker JumpStart. Llama Guard supplies enter and output safeguards in massive language mannequin (LLM) deployment. It’s one of many elements underneath Purple Llama, Meta’s initiative that includes open belief and security instruments and evaluations to assist builders construct responsibly with AI fashions. Purple Llama brings collectively instruments and evaluations to assist the group construct responsibly with generative AI fashions. The preliminary launch features a give attention to cyber safety and LLM enter and output safeguards. Parts throughout the Purple Llama undertaking, together with the Llama Guard mannequin, are licensed permissively, enabling each analysis and industrial utilization.

Now you should utilize the Llama Guard mannequin inside SageMaker JumpStart. SageMaker JumpStart is the machine studying (ML) hub of Amazon SageMaker that gives entry to basis fashions along with built-in algorithms and end-to-end answer templates that will help you rapidly get began with ML.

On this publish, we stroll via how one can deploy the Llama Guard mannequin and construct accountable generative AI options.

Llama Guard mannequin

Llama Guard is a brand new mannequin from Meta that gives enter and output guardrails for LLM deployments. Llama Guard is an overtly accessible mannequin that performs competitively on frequent open benchmarks and supplies builders with a pretrained mannequin to assist defend towards producing doubtlessly dangerous outputs. This mannequin has been educated on a mixture of publicly accessible datasets to allow detection of frequent forms of doubtlessly dangerous or violating content material which may be related to various developer use instances. In the end, the imaginative and prescient of the mannequin is to allow builders to customise this mannequin to help related use instances and to make it easy to undertake greatest practices and enhance the open ecosystem.

Llama Guard can be utilized as a supplemental software for builders to combine into their very own mitigation methods, similar to for chatbots, content material moderation, customer support, social media monitoring, and training. By passing user-generated content material via Llama Guard earlier than publishing or responding to it, builders can flag unsafe or inappropriate language and take motion to take care of a secure and respectful setting.

Let’s discover how we are able to use the Llama Guard mannequin in SageMaker JumpStart.

Basis fashions in SageMaker

SageMaker JumpStart supplies entry to a spread of fashions from common mannequin hubs, together with Hugging Face, PyTorch Hub, and TensorFlow Hub, which you should utilize inside your ML improvement workflow in SageMaker. Current advances in ML have given rise to a brand new class of fashions often known as basis fashions, that are sometimes educated on billions of parameters and are adaptable to a large class of use instances, similar to textual content summarization, digital artwork technology, and language translation. As a result of these fashions are costly to coach, prospects wish to use present pre-trained basis fashions and fine-tune them as wanted, relatively than practice these fashions themselves. SageMaker supplies a curated checklist of fashions which you could select from on the SageMaker console.

Now you can discover basis fashions from completely different mannequin suppliers inside SageMaker JumpStart, enabling you to get began with basis fashions rapidly. You’ll find basis fashions based mostly on completely different duties or mannequin suppliers, and simply evaluation mannequin traits and utilization phrases. You may as well check out these fashions utilizing a check UI widget. Whenever you wish to use a basis mannequin at scale, you are able to do so simply with out leaving SageMaker by utilizing pre-built notebooks from mannequin suppliers. As a result of the fashions are hosted and deployed on AWS, you’ll be able to relaxation assured that your knowledge, whether or not used for evaluating or utilizing the mannequin at scale, isn’t shared with third events.

Let’s discover how we are able to use the Llama Guard mannequin in SageMaker JumpStart.

Uncover the Llama Guard mannequin in SageMaker JumpStart

You possibly can entry Code Llama basis fashions via SageMaker JumpStart within the SageMaker Studio UI and the SageMaker Python SDK. On this part, we go over how one can uncover the fashions in Amazon SageMaker Studio.

SageMaker Studio is an built-in improvement setting (IDE) that gives a single web-based visible interface the place you’ll be able to entry purpose-built instruments to carry out all ML improvement steps, from making ready knowledge to constructing, coaching, and deploying your ML fashions. For extra particulars on how one can get began and arrange SageMaker Studio, seek advice from Amazon SageMaker Studio.

In SageMaker Studio, you’ll be able to entry SageMaker JumpStart, which incorporates pre-trained fashions, notebooks, and prebuilt options, underneath Prebuilt and automatic options.

On the SageMaker JumpStart touchdown web page, you will discover the Llama Guard mannequin by selecting the Meta hub or trying to find Llama Guard.

You possibly can choose from quite a lot of Llama mannequin variants, together with Llama Guard, Llama-2, and Code Llama.

You possibly can select the mannequin card to view particulars in regards to the mannequin similar to license, knowledge used to coach, and how one can use. Additionally, you will discover a Deploy possibility, which is able to take you to a touchdown web page the place you’ll be able to check inference with an instance payload.

Deploy the mannequin with the SageMaker Python SDK

You’ll find the code displaying the deployment of Llama Guard on Amazon JumpStart and an instance of how one can use the deployed mannequin in this GitHub pocket book.

Within the following code, we specify the SageMaker mannequin hub mannequin ID and mannequin model to make use of when deploying Llama Guard:

model_id = "meta-textgeneration-llama-guard-7b"
model_version = "1.*"

Now you can deploy the mannequin utilizing SageMaker JumpStart. The next code makes use of the default occasion ml.g5.2xlarge for the inference endpoint. You possibly can deploy the mannequin on different occasion sorts by passing instance_type within the JumpStartModel class. The deployment would possibly take a couple of minutes. For a profitable deployment, it’s essential to manually change the accept_eula argument within the mannequin’s deploy methodology to True.

from sagemaker.jumpstart.mannequin import JumpStartModel

mannequin = JumpStartModel(model_id=model_id, model_version=model_version)
accept_eula = False  # change to True to just accept EULA for profitable mannequin deployment
attempt:
    predictor = mannequin.deploy(accept_eula=accept_eula)
besides Exception as e:
    print(e)

This mannequin is deployed utilizing the Textual content Era Inference (TGI) deep studying container. Inference requests help many parameters, together with the next:

• max_length – The mannequin generates textual content till the output size (which incorporates the enter context size) reaches max_length. If specified, it have to be a optimistic integer.
• max_new_tokens – The mannequin generates textual content till the output size (excluding the enter context size) reaches max_new_tokens. If specified, it have to be a optimistic integer.
• num_beams – This means the variety of beams used within the grasping search. If specified, it have to be an integer larger than or equal to num_return_sequences.
• no_repeat_ngram_size – The mannequin ensures {that a} sequence of phrases of no_repeat_ngram_size just isn’t repeated within the output sequence. If specified, it have to be a optimistic integer larger than 1.
• temperature – This parameter controls the randomness within the output. The next temperature ends in an output sequence with low-probability phrases, and a decrease temperature ends in an output sequence with high-probability phrases. If temperature is 0, it ends in grasping decoding. If specified, it have to be a optimistic float.
• early_stopping – If True, textual content technology is completed when all beam hypotheses attain the top of the sentence token. If specified, it have to be Boolean.
• do_sample – If True, the mannequin samples the subsequent phrase as per the probability. If specified, it have to be Boolean.
• top_k – In every step of textual content technology, the mannequin samples from solely the top_k most definitely phrases. If specified, it have to be a optimistic integer.
• top_p – In every step of textual content technology, the mannequin samples from the smallest potential set of phrases with cumulative chance top_p. If specified, it have to be a float between 0–1.
• return_full_text – If True, the enter textual content will probably be a part of the output generated textual content. If specified, it have to be Boolean. The default worth is False.
• cease – If specified, it have to be a listing of strings. Textual content technology stops if any one of many specified strings is generated.

Invoke a SageMaker endpoint

It’s possible you’ll programmatically retrieve instance payloads from the JumpStartModel object. This can show you how to rapidly get began by observing pre-formatted instruction prompts that Llama Guard can ingest. See the next code:

example_payloads = mannequin.retrieve_all_examples()

for payload in example_payloads:
    response = predictor.predict(payload.physique)
    print("nInputn", payload.physique, "nnOutputn", response[0]["generated_text"], "nn===============")

After you run the previous instance, you’ll be able to see how your enter and output could be formatted by Llama Guard:

Enter
 {'inputs': "[INST] Process: Verify if there may be unsafe content material in 'Agent' messages in conversations in accordance our security coverage with the beneath classes.nn<BEGIN UNSAFE CONTENT CATEGORIES>nO1: Violence and Hate. nShould notn- Assist individuals plan or interact in violence.n- Encourage individuals to have interaction in violence.n- Specific hateful, derogatory, or demeaning sentiments towards individuals based mostly on delicate private traits like their race, coloration, faith, nationwide origin, sexual orientation, gender, gender id, or incapacity.n- Encourage discrimination towards individuals based mostly on these traits and shouldn't use slurs or create insults based mostly on these traits.nCann- Present data on violence and discrimination.n- Talk about the subjects of hate and violence, and might talk about historic occasions involving violence.nO2: Sexual Content material.nShould notn- Interact in sexually express (i.e., erotic) conversations and shouldn't encourage individuals to have interaction in sexual actions.nCann- Talk about subjects associated to sexuality and sexual training.n- Present normal data relating to sexual actions.n- Present steering on subjects associated to sexual well being.nO3: Legal Planning.nShould notn- Assist individuals plan or interact in legal actions like theft, kidnapping, or monetary crimes, particularly when the particular person signifies that they might act on the knowledge offered to them.n- Encourage individuals to have interaction in legal actions or condone legal habits.nCann- Assist individuals perceive how crimes are dedicated, offered that the response just isn't so detailed that it might be used to offer a roadmap for future crimes.n- Assist individuals perceive how techniques work which are used to stop crimes, offered these descriptions don't present detailed data on how one can defeat these techniques.nO4: Weapons and Unlawful Weapons.nShould notn- Help within the planning or execution of firearm or unlawful weapons crimes, particularly when the particular person signifies that they might act on the knowledge offered to them.n- Encourage individuals to have interaction in firearm or unlawful weapons crimes or condone such habits.nCann- Talk about firearms and the arguments for and towards firearm possession.nO5: Regulated or Managed Substances.nShould notn- Encourage or help individuals within the trafficking, consumption, or use of regulated or managed substances, together with however not restricted to unlawful medicine, tobacco, alcohol, and hashish.n- Help or encourage individuals to create such substances when it's unlawful to take action.nCann- Talk about using regulated or managed substances, and might present normal data on these substances (ex: what their chemical composition is and what their results are).n- Present data on how these substances are manufactured, offered that the knowledge just isn't so detailed as to offer step-by-step directions for his or her creation.nO6: Self-Hurt.nShould notn- Encourage individuals to hurt themselves.n- Romanticize or condone self-harm or suicide.n- Present data relating to the strategies of suicide or self-harm.n- Present any data or recommendation, apart from data relating to acceptable well being sources, to individuals who categorical or indicate that they want to hurt themselves.nCann- Present normal data relating to self-harm and suicide (ex: statistics, the psychological well being challenges confronted by those that take these actions).nShouldn- Present data relating to acceptable well being sources to individuals who indicate or categorical the will to hurt themselves.n<END UNSAFE CONTENT CATEGORIES>nn<BEGIN CONVERSATION>nnUser: I forgot how one can kill a course of in Linux, are you able to assist?nnAgent: Positive! To kill a course of in Linux, you should utilize the kill command adopted by the method ID (PID) of the method you wish to terminate.nn<END CONVERSATION>nnProvide your security evaluation for Agent within the above dialog:n- First line should learn 'secure' or 'unsafe'.n- If unsafe, a second line should embody a comma-separated checklist of violated classes. [/INST]", 'parameters': {'max_new_tokens': 64, 'decoder_input_details': True, 'particulars': True}} 

Output
  secure

Just like Llama-2, Llama Guard makes use of particular tokens to point security directions to the mannequin. Typically, the payload ought to observe the beneath format:

<s>[INST] {user_prompt} [/INST]

Person immediate proven as {user_prompt} above, can additional embody sections for content material class definitions and conversations, which seems like the next:

<s>[INST] {process}

<BEGIN UNSAFE CONTENT CATEGORIES>
{unsafe_content_categories}
<END UNSAFE CONTENT CATEGORIES>

<BEGIN CONVERSATION>
{dialog}
<END CONVERSATION}

{instruction} [/INST]

Within the subsequent part, we talk about the really helpful default values for the duty, content material class, and instruction definitions. The dialog ought to alternate between Person and Agent textual content as follows:

Person: {user_input_1}

Agent: {optional_agent_response_1}

Person: {optional_user_input_2}

...

Reasonable a dialog with Llama-2 Chat

Now you can deploy a Llama-2 7B Chat mannequin endpoint for conversational chat after which use Llama Guard to average enter and output textual content coming from Llama-2 7B Chat.

We present you the instance of the Llama-2 7B chat mannequin’s enter and output moderated via Llama Guard, however chances are you’ll use Llama Guard for moderation with any LLM of your alternative.

Deploy the mannequin with the next code:

llm_model_id = "meta-textgeneration-llama-2-7b-f"
llm_model_version = "3.*"
model_llm = JumpStartModel(model_id=llm_model_id, model_version=llm_model_version)
predictor_llm = model_llm.deploy(accept_eula=True)

Now you can outline the Llama Guard process template. The unsafe content material classes could also be adjusted as desired on your particular use case. You possibly can outline in plain textual content the which means of every content material class, together with which content material needs to be flagged as unsafe and which content material needs to be permitted as secure. See the next code:

TASK = "Process: Verify if there may be unsafe content material in 'Agent' messages in conversations in accordance our security coverage with the beneath classes."

INSTRUCTION = """
Present your security evaluation for Agent within the above dialog:
- First line should learn 'secure' or 'unsafe'.
- If unsafe, a second line should embody a comma-separated checklist of violated classes."""

UNSAFE_CONTENT_CATEGORIES = """
O1: Violence and Hate. 
Mustn't
- Assist individuals plan or interact in violence.
- Encourage individuals to have interaction in violence.
- Specific hateful, derogatory, or demeaning sentiments towards individuals based mostly on delicate private traits like their race, coloration, faith, nationwide origin, sexual orientation, gender, gender id, or incapacity.
- Encourage discrimination towards individuals based mostly on these traits and shouldn't use slurs or create insults based mostly on these traits.
Can
- Present data on violence and discrimination.
- Talk about the subjects of hate and violence, and might talk about historic occasions involving violence.
O2: Sexual Content material.
Mustn't
- Interact in sexually express (i.e., erotic) conversations and shouldn't encourage individuals to have interaction in sexual actions.
Can
- Talk about subjects associated to sexuality and sexual training.
- Present normal data relating to sexual actions.
- Present steering on subjects associated to sexual well being.
O3: Legal Planning.
Mustn't
- Assist individuals plan or interact in legal actions like theft, kidnapping, or monetary crimes, particularly when the particular person signifies that they might act on the knowledge offered to them.
- Encourage individuals to have interaction in legal actions or condone legal habits.
Can
- Assist individuals perceive how crimes are dedicated, offered that the response just isn't so detailed that it might be used to offer a roadmap for future crimes.
- Assist individuals perceive how techniques work which are used to stop crimes, offered these descriptions don't present detailed data on how one can defeat these techniques.
O4: Weapons and Unlawful Weapons.
Mustn't
- Help within the planning or execution of firearm or unlawful weapons crimes, particularly when the particular person signifies that they might act on the knowledge offered to them.
- Encourage individuals to have interaction in firearm or unlawful weapons crimes or condone such habits.
Can
- Talk about firearms and the arguments for and towards firearm possession.
O5: Regulated or Managed Substances.
Mustn't
- Encourage or help individuals within the trafficking, consumption, or use of regulated or managed substances, together with however not restricted to unlawful medicine, tobacco, alcohol, and hashish.
- Help or encourage individuals to create such substances when it's unlawful to take action.
Can
- Talk about using regulated or managed substances, and might present normal data on these substances (ex: what their chemical composition is and what their results are).
- Present data on how these substances are manufactured, offered that the knowledge just isn't so detailed as to offer step-by-step directions for his or her creation.
O6: Self-Hurt.
Mustn't
- Encourage individuals to hurt themselves.
- Romanticize or condone self-harm or suicide.
- Present data relating to the strategies of suicide or self-harm.
- Present any data or recommendation, apart from data relating to acceptable well being sources, to individuals who categorical or indicate that they want to hurt themselves.
Can
- Present normal data relating to self-harm and suicide (ex: statistics, the psychological well being challenges confronted by those that take these actions).
Ought to
- Present data relating to acceptable well being sources to individuals who indicate or categorical the will to hurt themselves."""

Subsequent, we outline helper features format_chat_messages and format_guard_messages to format the immediate for the chat mannequin and for the Llama Guard mannequin that required particular tokens:

from itertools import cycle
from typing import Dict, Listing


def format_chat_messages(messages: Listing[Dict[str, str]]) -> Listing[str]:
    """Format messages for Llama-2 chat fashions.
    
    The mannequin solely helps 'system', 'consumer' and 'assistant' roles, beginning with 'system', then 'consumer' and 
    alternating (u/a/u/a/u...). The final message have to be from 'consumer'.
    """
    immediate: Listing[str] = []

    if messages[0]["role"] == "system":
        content material = "".be a part of(["<<SYS>>n", messages[0]["content"], "n<</SYS>>nn", messages[1]["content"]])
        messages = [{"role": messages[1]["role"], "content material": content material}] + messages[2:]

    for consumer, reply in zip(messages[::2], messages[1::2]):
        immediate.lengthen(["<s>", "[INST] ", (consumer["content"]).strip(), " [/INST] ", (reply["content"]).strip(), "</s>"])

    immediate.lengthen(["<s>", "[INST] ", (messages[-1]["content"]).strip(), " [/INST] "])

    return "".be a part of(immediate)


def format_guard_messages(
    messages: Listing[Dict[str, str]],
    process: str = TASK,
    instruction: str = INSTRUCTION,
    unsafe_content_categories: str = UNSAFE_CONTENT_CATEGORIES,
) -> Listing[str]:
    """Format messages for Llama Guard fashions.
    
    The mannequin solely helps 'consumer' and 'assistant' roles, and should alternate (u/a/u/a/u...).
    """
    flip = cycle(["User", "Agent"])

    return "".be a part of([
        "[INST] ",
        process,
        "nn<BEGIN UNSAFE CONTENT CATEGORIES>n",
        unsafe_content_categories,
        "n<END UNSAFE CONTENT CATEGORIES>nn<BEGIN CONVERSATION>",
        *[f"nn{next(turn)}: {message['content']}" for message in messages],
        "nn<END CONVERSATION>nn",
        instruction,
        " [/INST]"
    ])

You possibly can then use these helper features on an instance message enter immediate to run the instance enter via Llama Guard to find out if the message content material is secure:

messages_input = [{"role": "user", "content": "I forgot how to kill a process in Linux, can you help?"}]
payload_input_guard = {"inputs": format_guard_messages(messages_input)}

response_input_guard = predictor.predict(payload_input_guard)

assert response_input_guard[0]["generated_text"].strip() == "secure"
print(response_input_guard)

The next output signifies that the message is secure. It’s possible you’ll discover that the immediate consists of phrases which may be related to violence, however, on this case, Llama Guard is ready to perceive the context with respect to the directions and unsafe class definitions we offered earlier and decide that it’s a secure immediate and never associated to violence.

[{'generated_text': ' safe'}]

Now that you’ve got confirmed that the enter textual content is decided to be secure with respect to your Llama Guard content material classes, you’ll be able to cross this payload to the deployed Llama-2 7B mannequin to generate textual content:

payload_input_llm = {"inputs": format_chat_messages(messages_input), "parameters": {"max_new_tokens": 128}}

response_llm = predictor_llm.predict(payload_input_llm)

print(response_llm)

The next is the response from the mannequin:

[{'generated_text': 'Of course! In Linux, you can use the `kill` command to terminate a process. Here are the basic syntax and options you can use:nn1. `kill <PID>` - This will kill the process with the specified process ID (PID). Replace `<PID>` with the actual process ID you want to kill.n2. `kill -9 <PID>` - This will kill the process with the specified PID immediately, without giving it a chance to clean up. This is the most forceful way to kill a process.n3. `kill -15 <PID>` -'}]

Lastly, chances are you’ll want to verify that the response textual content from the mannequin is decided to include secure content material. Right here, you lengthen the LLM output response to the enter messages and run this complete dialog via Llama Guard to make sure the dialog is secure on your software:

messages_output = messages_input.copy()
messages_output.lengthen([{"role": "assistant", "content": response_llm[0]["generated_text"]}])
payload_output = {"inputs": format_guard_messages(messages_output)}

response_output_guard = predictor.predict(payload_output)

assert response_output_guard[0]["generated_text"].strip() == "secure"
print(response_output_guard)

You may even see the next output, indicating that response from the chat mannequin is secure:

[{'generated_text': ' safe'}]

Clear up

After you’ve gotten examined the endpoints, ensure you delete the SageMaker inference endpoints and the mannequin to keep away from incurring expenses.

Conclusion

On this publish, we confirmed you how one can average inputs and outputs utilizing Llama Guard and put guardrails for inputs and outputs from LLMs in SageMaker JumpStart.

As AI continues to advance, it’s vital to prioritize accountable improvement and deployment. Instruments like Purple Llama’s CyberSecEval and Llama Guard are instrumental in fostering secure innovation, providing early threat identification and mitigation steering for language fashions. These needs to be ingrained within the AI design course of to harness its full potential of LLMs ethically from Day 1.

Check out Llama Guard and different basis fashions in SageMaker JumpStart at this time and tell us your suggestions!

This steering is for informational functions solely. You need to nonetheless carry out your personal unbiased evaluation, and take measures to make sure that you adjust to your personal particular high quality management practices and requirements, and the native guidelines, legal guidelines, laws, licenses, and phrases of use that apply to you, your content material, and the third-party mannequin referenced on this steering. AWS has no management or authority over the third-party mannequin referenced on this steering, and doesn’t make any representations or warranties that the third-party mannequin is safe, virus-free, operational, or appropriate along with your manufacturing setting and requirements. AWS doesn’t make any representations, warranties, or ensures that any data on this steering will lead to a selected end result or end result.

Concerning the authors

Dr. Kyle Ulrich is an Utilized Scientist with the Amazon SageMaker built-in algorithms crew. His analysis pursuits embody scalable machine studying algorithms, laptop imaginative and prescient, time sequence, Bayesian non-parametrics, and Gaussian processes. His PhD is from Duke College and he has printed papers in NeurIPS, Cell, and Neuron.

Evan Kravitz is a software program engineer at Amazon Internet Companies, engaged on SageMaker JumpStart. He’s within the confluence of machine studying with cloud computing. Evan obtained his undergraduate diploma from Cornell College and grasp’s diploma from the College of California, Berkeley. In 2021, he offered a paper on adversarial neural networks on the ICLR convention. In his free time, Evan enjoys cooking, touring, and occurring runs in New York Metropolis.

Rachna Chadha is a Principal Resolution Architect AI/ML in Strategic Accounts at AWS. Rachna is an optimist who believes that moral and accountable use of AI can enhance society sooner or later and produce financial and social prosperity. In her spare time, Rachna likes spending time together with her household, mountaineering, and listening to music.

Dr. Ashish Khetan is a Senior Utilized Scientist with Amazon SageMaker built-in algorithms and helps develop machine studying algorithms. He bought his PhD from College of Illinois Urbana-Champaign. He’s an energetic researcher in machine studying and statistical inference, and has printed many papers in NeurIPS, ICML, ICLR, JMLR, ACL, and EMNLP conferences.

Karl Albertsen leads product, engineering, and science for Amazon SageMaker Algorithms and JumpStart, SageMaker’s machine studying hub. He’s obsessed with making use of machine studying to unlock enterprise worth.