Unsafe and custom topic detection

AI Security for Apps can detect when an LLM prompt touches on unsafe or unwanted subjects. There are two layers of topic detection:

• Default unsafe topics: A built-in set of safety categories that detect harmful content such as violent crimes, hate speech, and sexual content.
• Custom topics: Topics you define to match your organization's specific policies, such as "competitors" or "financial-advice".

When AI Security for Apps is enabled, it automatically evaluates prompts against a set of default unsafe topic categories and populates two fields:

• LLM Unsafe topic detected (cf.llm.prompt.unsafe_topic_detected): true if any unsafe topic was found.
• LLM Unsafe topic categories (cf.llm.prompt.unsafe_topic_categories): An array of the specific categories detected.

Custom topic detection lets you define your own topics and AI Security for Apps will score each prompt against them. You can then use these scores in custom rules or rate limiting rules to block, challenge, or log requests based on a relevance score that you define.

This capability uses a zero-shot classification model that evaluates prompts at runtime. No model training is required.

1. You define a list of up to 20 custom topics. Each topic consists of:
   • Label: A short, hyphenated identifier used in rule expressions and analytics (for example, financial-advice).
   • Topic description: The descriptive text the model uses to classify prompts (for example, seeking financial advice).
2. When a request arrives at a cf-llm labeled endpoint, the model evaluates the prompt against all defined topic descriptions and returns a relevance score for each.
3. Scores are written to the cf.llm.prompt.custom_topic_categories map field, keyed by label. You use labels (not topic descriptions) in rule expressions and analytics.

You can manage custom topics from two places in the dashboard:

1. Security Settings page: Go to Security > Settings and search for the AI Security for Apps section. Under Custom Topics, select Manage topics to add, edit, or remove topics.
2. Expression builder sidebar: When creating or editing a custom rule, select the LLM Custom topic field. Then, select Manage custom topics to open a sidebar where you can manage topics without leaving the rule creation page.

Both methods will update the same underlying topic list. Changes made in one are immediately reflected in the other.

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall-for-ai/custom-topics" \
  --request PUT \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "topics": [
      {
        "label": "competitors",
        "topic": "seeking info on competitors"
      },
      {
        "label": "financial-advice",
        "topic": "seeking financial advice"
      },
      {
        "label": "hr-internal",
        "topic": "asking about internal HR policies"
      }
    ]
  }'

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/firewall-for-ai/custom-topics" \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

The quality of custom topic detection depends on how you write your topic descriptions. The underlying model is a zero-shot classifier that compares the semantic meaning of the prompt against your topic description.

The most important thing to do is to describe the user's intent, not just the subject.

The model performs semantic classification, not keyword matching. Topic descriptions that capture what the user is trying to do are significantly more accurate than descriptions that simply name a subject area. A short verb phrase (3–6 words) is usually the best trade-off between precision and coverage.

Compare how the same two topic descriptions perform against two prompts that both mention finance but with very different intent:

• Be specific. Overly broad topics cause false positives; overly narrow topics cause false negatives.
• Avoid semantic overlap. If two topics mean nearly the same thing (for example, seeking financial advice and asking for investment guidance), they will score similarly on the same prompts and waste your 20-topic budget.
• Test and iterate. Send test prompts and review scores in Security Analytics. You can tune by adjusting the topic description (more or less specific) or the score threshold in your rule (lt 20 is strict, lt 50 is permissive).
• Do not list multiple values in one topic description. The model only evaluates against the first item in a comma-separated list. For example, Toyota, Ford, Audi, BMW will only match prompts about Toyota — the remaining items are ignored. Removing the commas does not improve results. Use a single intent-driven phrase such as seeking info on competitors, or create separate topics for each value.