forked from phoenix-oss/llama-stack-mirror
6bb57e72a7
This PR makes several core changes to the developer experience surrounding Llama Stack. Background: PR #92 introduced the notion of "routing" to the Llama Stack. It introduces three object types: (1) models, (2) shields and (3) memory banks. Each of these objects can be associated with a distinct provider. So you can get model A to be inferenced locally while model B, C can be inference remotely (e.g.) However, this had a few drawbacks: you could not address the provider instances -- i.e., if you configured "meta-reference" with a given model, you could not assign an identifier to this instance which you could re-use later. the above meant that you could not register a "routing_key" (e.g. model) dynamically and say "please use this existing provider I have already configured" for a new model. the terms "routing_table" and "routing_key" were exposed directly to the user. in my view, this is way too much overhead for a new user (which almost everyone is.) people come to the stack wanting to do ML and encounter a completely unexpected term. What this PR does: This PR structures the run config with only a single prominent key: - providers Providers are instances of configured provider types. Here's an example which shows two instances of the remote::tgi provider which are serving two different models. providers: inference: - provider_id: foo provider_type: remote::tgi config: { ... } - provider_id: bar provider_type: remote::tgi config: { ... } Secondly, the PR adds dynamic registration of { models | shields | memory_banks } to the API surface. The distribution still acts like a "routing table" (as previously) except that it asks the backing providers for a listing of these objects. For example it asks a TGI or Ollama inference adapter what models it is serving. Only the models that are being actually served can be requested by the user for inference. Otherwise, the Stack server will throw an error. When dynamically registering these objects, you can use the provider IDs shown above. Info about providers can be obtained using the Api.inspect set of endpoints (/providers, /routes, etc.) The above examples shows the correspondence between inference providers and models registry items. Things work similarly for the safety <=> shields and memory <=> memory_banks pairs. Registry: This PR also makes it so that Providers need to implement additional methods for registering and listing objects. For example, each Inference provider is now expected to implement the ModelsProtocolPrivate protocol (naming is not great!) which consists of two methods register_model list_models The goal is to inform the provider that a certain model needs to be supported so the provider can make any relevant backend changes if needed (or throw an error if the model cannot be supported.) There are many other cleanups included some of which are detailed in a follow-up comment.
112 lines
4.2 KiB
Python
112 lines
4.2 KiB
Python
# Copyright (c) Meta Platforms, Inc. and affiliates.
|
|
# All rights reserved.
|
|
#
|
|
# This source code is licensed under the terms described in the LICENSE file in
|
|
# the root directory of this source tree.
|
|
|
|
from typing import Any, Dict, List
|
|
|
|
from llama_stack.distribution.utils.model_utils import model_local_dir
|
|
from llama_stack.apis.inference import * # noqa: F403
|
|
from llama_stack.apis.safety import * # noqa: F403
|
|
from llama_models.llama3.api.datatypes import * # noqa: F403
|
|
from llama_stack.distribution.datatypes import Api
|
|
|
|
from llama_stack.providers.datatypes import ShieldsProtocolPrivate
|
|
|
|
from .base import OnViolationAction, ShieldBase
|
|
from .config import SafetyConfig
|
|
from .llama_guard import LlamaGuardShield
|
|
from .prompt_guard import InjectionShield, JailbreakShield, PromptGuardShield
|
|
|
|
|
|
PROMPT_GUARD_MODEL = "Prompt-Guard-86M"
|
|
|
|
|
|
class MetaReferenceSafetyImpl(Safety, ShieldsProtocolPrivate):
|
|
def __init__(self, config: SafetyConfig, deps) -> None:
|
|
self.config = config
|
|
self.inference_api = deps[Api.inference]
|
|
|
|
self.available_shields = []
|
|
if config.llama_guard_shield:
|
|
self.available_shields.append(ShieldType.llama_guard.value)
|
|
if config.enable_prompt_guard:
|
|
self.available_shields.append(ShieldType.prompt_guard.value)
|
|
|
|
async def initialize(self) -> None:
|
|
if self.config.enable_prompt_guard:
|
|
model_dir = model_local_dir(PROMPT_GUARD_MODEL)
|
|
_ = PromptGuardShield.instance(model_dir)
|
|
|
|
async def shutdown(self) -> None:
|
|
pass
|
|
|
|
async def register_shield(self, shield: ShieldDef) -> None:
|
|
raise ValueError("Registering dynamic shields is not supported")
|
|
|
|
async def list_shields(self) -> List[ShieldDef]:
|
|
return [
|
|
ShieldDef(
|
|
identifier=shield_type,
|
|
type=shield_type,
|
|
params={},
|
|
)
|
|
for shield_type in self.available_shields
|
|
]
|
|
|
|
async def run_shield(
|
|
self,
|
|
shield_type: str,
|
|
messages: List[Message],
|
|
params: Dict[str, Any] = None,
|
|
) -> RunShieldResponse:
|
|
shield_def = await self.shield_store.get_shield(shield_type)
|
|
if not shield_def:
|
|
raise ValueError(f"Unknown shield {shield_type}")
|
|
|
|
shield = self.get_shield_impl(shield_def)
|
|
|
|
messages = messages.copy()
|
|
# some shields like llama-guard require the first message to be a user message
|
|
# since this might be a tool call, first role might not be user
|
|
if len(messages) > 0 and messages[0].role != Role.user.value:
|
|
messages[0] = UserMessage(content=messages[0].content)
|
|
|
|
# TODO: we can refactor ShieldBase, etc. to be inline with the API types
|
|
res = await shield.run(messages)
|
|
violation = None
|
|
if res.is_violation and shield.on_violation_action != OnViolationAction.IGNORE:
|
|
violation = SafetyViolation(
|
|
violation_level=(
|
|
ViolationLevel.ERROR
|
|
if shield.on_violation_action == OnViolationAction.RAISE
|
|
else ViolationLevel.WARN
|
|
),
|
|
user_message=res.violation_return_message,
|
|
metadata={
|
|
"violation_type": res.violation_type,
|
|
},
|
|
)
|
|
|
|
return RunShieldResponse(violation=violation)
|
|
|
|
def get_shield_impl(self, shield: ShieldDef) -> ShieldBase:
|
|
if shield.type == ShieldType.llama_guard.value:
|
|
cfg = self.config.llama_guard_shield
|
|
return LlamaGuardShield(
|
|
model=cfg.model,
|
|
inference_api=self.inference_api,
|
|
excluded_categories=cfg.excluded_categories,
|
|
)
|
|
elif shield.type == ShieldType.prompt_guard.value:
|
|
model_dir = model_local_dir(PROMPT_GUARD_MODEL)
|
|
subtype = shield.params.get("prompt_guard_type", "injection")
|
|
if subtype == "injection":
|
|
return InjectionShield.instance(model_dir)
|
|
elif subtype == "jailbreak":
|
|
return JailbreakShield.instance(model_dir)
|
|
else:
|
|
raise ValueError(f"Unknown prompt guard type: {subtype}")
|
|
else:
|
|
raise ValueError(f"Unknown shield type: {shield.type}")
|