Can we create embedding-based guardrails?

[IqraSiddiqui]

I see we have flexiiblity of using custom embeddings in nemoguardrails, but it seems that these embeddings are used for the intent recognition or in dialog rails. Can we use these for embedding-based guardrails? My goal is to create custom embedding for the unsafe dataset and then block any input that is similar to my embedding

[onestardao]

I think what you are describing is possible in principle, but you might be framing it at the wrong layer.
Embedding-based guardrails usually fail when you assume cosine distance ≈ meaning. In practice, this leads to drift, false positives, and gaps in blocking unsafe inputs.

The deeper issue here is the same one we diagnose as Problem Map No.5 — Semantic ≠ Embedding.
If you rely on raw embedding similarity as the guardrail, you will eventually hit edge cases where the math diverges from the semantic intent.

There are structural fixes, but they’re not just about tuning thresholds — they require adding a reasoning firewall on top of embeddings. If you want details, let me know and I can point you toward the diagnostic map we use for these failures.

[IqraSiddiqui]

That make sense, thanks! Can you also guide on how can we implement it using nemoguardrails? Is it available off-the-shelf or we'll have to write custom action for this one?

[onestardao]

short answer: you’ll get farther by adding a reasoning-layer guard than by tuning similarity thresholds alone.

if you want the full diagnosis + fix pattern, this maps to Problem Map No.5 (Semantic ≠ Embedding). the playbook shows how to place a semantic firewall before the embedding check so you don’t rely on cosine alone.

Link: [WFGY Problem Map — README]

quick route with nemo-guardrails:

• keep your intents, but add a pre-gate that verifies intent → exemplar → constraint alignment.
• run the embedding similarity only after the pre-gate passes, and cap it with a reject path if ΔS to the unsafe exemplars is low but intent mismatch is high.
• log before/after to track false positives and the “unsafe-but-semantically-distant” edge cases.

^_____^

[IqraSiddiqui]

Thank for the suggestion. For the implementation of the "reject path" should I implement a Custom Action in nemoguardrail?

[onestardao]

Yes

in NeMo Guardrails you can implement the reject path as a simple Custom Action.
The trick is just to wire your “intent-mismatch or unsafe input” branch to that action.

Minimal pattern:

Define a pre-gate that checks your semantic + embedding guard.
If it fails, trigger your Custom Action (reject / fallback / log).
If it passes, let the normal flow continue.

That way you don’t have to hack thresholds into embeddings alone — the reject path becomes just another guardrail step.