Model Armor
A model-agnostic security layer that screens prompts and responses for prompt injection, jailbreak attempts, sensitive data exposure, and malicious URLs, regardless of which LLM backend is serving the request.
Google Cloud AI Security
Google Model Armor vs Vertex AI Safety Filters
Google Model Armor is a model-agnostic security layer that screens prompts and responses for prompt injection, jailbreak attempts, sensitive data exposure, and malicious URLs across any LLM backend. Vertex AI Safety Filters are a native Vertex AI feature that screens content generated by Gemini models for responsible-AI harm categories such as hate speech, harassment, and dangerous content. They address different risk types at different points in the pipeline and are not interchangeable.
What Each Control Actually Does
Both controls sit near the model, but they are built to catch different categories of risk. Understanding what each one screens for is the starting point for deciding how, and whether, to run them together.
Vertex AI Safety Filters
A native Vertex AI feature embedded in the Gemini serving stack that screens generated content for responsible-AI harm categories such as hate speech, harassment, and dangerous content.
Model Armor vs Vertex AI Safety Filters at a Glance
The two controls differ in scope, in the models they cover, and in the type of harm they are designed to catch.
| Dimension | Model Armor | Vertex AI Safety Filters |
|---|---|---|
| Model scope | Any LLM backend; model-agnostic | Gemini models served through Vertex AI |
| Risk types covered | Prompt injection, jailbreak attempts, sensitive data exposure, malicious URLs | Responsible-AI harm categories: hate speech, harassment, dangerous content |
| Enforcement point | Pre-inference and post-inference, outside the model's own serving stack | Inline, inside Vertex AI's serving stack as content is generated |
Enforcement Point in the Request/Response Lifecycle
Where each control sits relative to a model call determines what it can and cannot catch.
- 1
Pre-inference
Model Armor can screen incoming prompts for injection or jailbreak patterns before they reach any model.
- 2
Model inference
Vertex AI Safety Filters operate inside Vertex AI's own serving stack as content is generated by Gemini models.
- 3
Post-inference
Model Armor can also screen outbound responses for sensitive data or malicious links, independent of which model produced them.
- 4
Outside the model call
Neither control extends to what happens after a response is returned, such as tool execution or downstream agent actions.
Where Coverage Overlaps and Where Gaps Remain
When Model Armor sits in front of a Vertex AI model, both controls may independently evaluate the same harmful content, one at the prompt/response layer and one inside the Gemini serving stack. That overlap is not a conflict by itself, but it means teams should know which control is expected to catch a given risk category rather than assuming coverage by default.
The clearer gap is model coverage. Vertex AI Safety Filters only apply to content generated by Gemini models served through Vertex AI. Any non-Vertex or self-hosted model in the stack falls outside that protection entirely, leaving Model Armor, where deployed, as the only control screening those requests and responses.
What Neither Control Governs
Both controls stop at the boundary of the model call itself. Neither Model Armor nor Vertex AI Safety Filters extends to what happens after a response is returned, including tool execution or multi-step agent actions. Neither control governs agent tool-use or multi-step action authorization; that is a distinct governance problem that requires a separate runtime layer.
Evaluation Criteria When Layering Both Controls
Teams running both controls together should confirm the following before treating coverage as complete.
- Map which control owns which risk category before deployment to avoid duplicate or conflicting enforcement.
- Confirm whether any models in your stack are non-Vertex or self-hosted, since Safety Filters do not extend to them.
- Coordinate Model Armor templates and Vertex AI threshold settings so harmful-content policy is consistent across layers.
- Route Model Armor findings into Security Command Center and confirm how Vertex AI Safety Filter events are tracked for audit purposes.
- Treat neither control as covering agent tool-use or multi-step action authorization; plan a separate governance layer for that.
Shared blind spot
Both controls address prompt and content risk at the model boundary. Agent tool-use and multi-step action authorization sit outside both, and need their own runtime governance layer.