feat(guardrails): Aliyun AI Guardrails kind (MultiModalGuard) with suggestion verdicts and mask write-back#799
feat(guardrails): Aliyun AI Guardrails kind (MultiModalGuard) with suggestion verdicts and mask write-back#799jarvis9443 wants to merge 4 commits into
Conversation
… MultiModalGuard) Adds a new guardrail kind for Aliyun's AI Guardrails product (AI 安全护栏) — a different Aliyun product from the existing aliyun_text_moderation (TextModerationPlus / Content Moderation): separately activated (commodity lvwang_guardrail_public_cn), separately billed, policy-configured in its own console, and — the point of the feature — its calls appear in that console's records, which TextModerationPlus calls never do (AISIX-Cloud#1070). - Action=MultiModalGuard on the same green-cip endpoint and RPC v1 signature (signing helpers shared with the TextModerationPlus dispatcher). - Input hook: query_security_check_pro (query_security_check at service_level: basic); output hook: response_security_check_pro / response_security_check. - Verdict follows the returned Data.Suggestion (computed by Aliyun from the console-configured policy): block blocks; pass/watch/mask release. No local risk threshold. Full per-dimension detail (Type/Level/Suggestion, both level vocabularies incl. sensitiveData S0–S3) lands in logs; only detected labels are logged, and matched content (Ext) has no deserialized path to a log (#153). - Streaming output: windowed like the TMP kind; each window carries the stream-stable sessionId AND chatId so Aliyun stitches one console record per response. done is not sent (optional per docs; the trait has no end-of-stream signal). - Code 408 (commodity not activated) logs a fix-naming error, the most common first-run failure. - Upstream RequestId diagnostics follow the #781 pattern (x-acs-request-id header first, body fallback). Ref AISIX-Cloud#1070
Completes the aliyun_ai_guardrail verdict semantics for Suggestion=mask (Aliyun-side desensitization policies), following the Bedrock pattern: - Segment path (non-streaming bodies, held-back tail of a streamed response): moderates_segments()=true; a mask suggestion rewrites the body with Aliyun's Ext.Desensitization text. A single segment (the common case) reuses the verdict call's rewrite directly; multiple segments are re-checked one call per segment because MultiModalGuard takes one content string per call — the re-calls keep masked[i] aligned with texts[i] by construction. mask with no usable Desensitization fails closed. A clipped (>2000 chars) segment gets its unscanned tail re-attached on write-back. - Blob path (check_input/check_output — the mid-stream windows): mask maps to Block, since there is no write-back channel and releasing un-masked content would defeat the operator's policy. - Ext is parsed tolerantly (object, or a JSON document nested in a string — Aliyun types it inconsistently); the desensitized text travels outside AigDiagnostics so the diagnostics type stays structurally content-free (#153). - The Desensitization accumulation assumption (last non-empty rewrite wins across Result[] entries) is doc-derived and flagged for live re-verification during #1070 QA. - Test-side: cross-module lock for log-capturing tests — a concurrently dropped capture subscriber recomputes tracing's GLOBAL max-level hint and can fast-path away another thread's events mid-capture. Ref AISIX-Cloud#1070
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 17 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
…uardrail # Conflicts: # crates/aisix-core/src/models/mod.rs
1 participant
Adds guardrail kind
aliyun_ai_guardrail, integrating Aliyun's AI Guardrails product (AI 安全护栏, actionMultiModalGuard). This is a different Aliyun product from the existingaliyun_text_moderation(TextModerationPlus / Content Moderation): separately activated (commoditylvwang_guardrail_public_cn), separately billed, policy-configured in its own console — and its calls appear in that console's records, which TextModerationPlus calls never do. That console visibility is the core ask of the issue.What it does
MultiModalGuardongreen-cip.<region>.aliyuncs.com(verified live: the endpoint routes both actions), RPC v1 signature shared with the TextModerationPlus dispatcher. Config carriesregion/endpoint/access_key_id/access_key_secret/timeout_msplusservice_level: pro|basic—pro(default) callsquery_security_check_pro/response_security_check_pro,basicthe non-Pro codes.Data.Suggestion, which Aliyun computes from the console-configured policies — no local risk threshold.block→ 422;pass/watch→ release; full per-dimension detail (Detail[].Type/Level/Suggestion, including sensitiveData'sS0–S3vocabulary) goes to logs/telemetry as opaque strings, so an Aliyun vocabulary or dimension extension can't break a request.maskhonored via segment write-back (Bedrock pattern): on the segment path (non-streaming bodies, held-back tail of a streamed response) amasksuggestion rewrites the body with Aliyun'sExt.Desensitizationtext — single segment reuses the verdict call's rewrite, multiple segments are re-checked per segment somasked[i]stays aligned withtexts[i](MultiModalGuard takes onecontentstring per call).maskwith no usable rewrite fails closed. On the blob path (mid-stream windows — no write-back channel)maskmaps to Block so un-masked content is never released.sessionIdandchatIdso Aliyun stitches one console record per response.doneis not sent (optional per Aliyun docs; the trait has no end-of-stream signal).RequestIdon every path (x-acs-request-idheader first, body fallback — the feat(guardrails): preserve Aliyun's upstream RequestId and correlate it to the gateway request #781 pattern); businessCode408 (commodity not activated) logs an error naming the activation fix; 4xx bodies are never echoed (only the symbolicCode), and matched content (Ext, risk words) has no deserialized path into a log.Testing
Ext+ missing-rewrite fail-closed), service-tier codes, session/chat ids, 408/4xx/5xx/timeout/malformed paths, no-content-leak log assertions, clipped-tail re-attach.tests/e2e, realaisix+ etcd + mock green-cip): input block before upstream, output block after upstream, watch release, mask write-back visible to the caller, streaming SSE error with stablesessionId/chatIdacross windows, basic-tier service codes.--ignoredlive smoke (live_smoke_real_endpoint) exercises the real endpoint including a sensitive-data mask probe; theExt.Desensitizationaccumulation assumption (doc-derived) is flagged there for live re-verification.LiteLLM has no Aliyun guardrail integration (only dashscope LLM providers), so there is no baseline to compare against.
CP exposure (kind enum, schema descriptor, dashboard) ships separately per the cross-plane workflow.
Fixes api7/AISIX-Cloud#1070