NVIDIA-NeMo / NVIDIA-NeMo/Guardrails
bug: mask sensitive data on output rail is unusable in 0.24.0: mask_sensitive_data() got an unexpected keyword argument 'context'
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 7.2k
- Forks
- 842
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 25
Description
Expected behavior
The mask sensitive data on output rail should run successfully and redact sensitive data without crashing.
Actual behavior
The mask sensitive data on output rail fails on every request in 0.24.0. The action dispatcher passes context= to every action, but mask_sensitive_data does not accept it (while its sibling detect_sensitive_data does).
Users who configure mask sensitive data on output get a hard failure on every request, and the natural workaround — switching to detect sensitive data on output — is a different policy entirely (it blocks rather than redacts).
Steps to reproduce
Configure an output rail with mask sensitive data on output and send any request.
Every request fails with:
mask_sensitive_data() got an unexpected keyword argument 'context'
Additional context (Use this for Root Cause & Suggested Fix)
Root Cause:
Verified with inspect.signature against the installed package rather than inferred from the error text:
mask_sensitive_data (source, text, config) -> RailOutcome # no **kwargs
detect_sensitive_data(source, text, config, **kwargs) -> RailOutcome
The two sibling actions disagree on whether to accept **kwargs. The dispatcher passes context= unconditionally, so the detect rail runs and the mask rail cannot.
Suggested Fix:
Add **kwargs to mask_sensitive_data, matching detect_sensitive_data.
(Note: I have gone ahead and submitted a PR with this fix here: https://github.com/NVIDIA-NeMo/Guardrails/pull/2374)
Environment
- Python version (python --version): Python 3.14.7
- Operating system/version: Windows
- NeMo-Guardrails version: 0.24.0
nemoguardrails 0.24.0, Presidio in-process.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the mask_sensitive_data and detect_sensitive_data action definitions and compare their signatures with the dispatcher’s unconditional context= call. Reproduce the configured output rail failure, then verify that sensitive output is redacted successfully without the unexpected-keyword error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100