Skip to content

fix(rerank): log optional_rerank_params at debug to stop leaking request content - #32533

Merged
ishaan-berri merged 2 commits into
litellm_internal_stagingfrom
litellm_fix_rerank_info_log_32525
Jul 9, 2026
Merged

fix(rerank): log optional_rerank_params at debug to stop leaking request content#32533
ishaan-berri merged 2 commits into
litellm_internal_stagingfrom
litellm_fix_rerank_info_log_32525

Conversation

@devin-ai-integration

Copy link
Copy Markdown
Contributor

Relevant issues

Fixes #32525

Linear ticket

Pre-Submission checklist

  • I have added meaningful tests
  • My PR passes all CI/CD checks (e.g., lint, format, unit tests)
  • My PR's scope is as isolated as possible; it only solves 1 specific problem
  • I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

Live proxy at LITELLM_LOG=INFO routing to real AWS Bedrock (bedrock/amazon.rerank-v1:0), same curl in both runs:

curl -s http://localhost:PORT/rerank -H "Content-Type: application/json" -H "Authorization: Bearer sk-1234" -d '{
  "model": "rerank-model",
  "query": "MARKER_QUERY_sensitive_user_search",
  "documents": ["MARKER_DOC_confidential_customer_text", "unrelated filler doc"],
  "top_n": 2
}'

Before (line at verbose_logger.info, the current main behavior); grep optional_rerank_params on the proxy log shows the raw request content at INFO:

19:13:02 - LiteLLM:INFO: main.py:161 - optional_rerank_params: {'query': 'MARKER_QUERY_sensitive_user_search', 'documents': ['MARKER_DOC_confidential_customer_text', 'unrelated filler doc'], 'top_n': 2, 'rank_fields': None, 'return_documents': None, 'max_chunks_per_doc': None}

After (this PR, commit 24df024); same curl, same INFO log level, grep optional_rerank_params and grep MARKER_ on the proxy log return nothing:

=== INFO log lines leaking content (after fix) ===
0
0

Both runs reached real AWS Bedrock (the account here lacks the bedrock:Rerank IAM action so the upstream call returns 403), which is fine because the leak happens at optional_rerank_params logging before the provider call; the point is whether that content lands in logs at the default INFO level

Type

🐛 Bug Fix

Changes

litellm/rerank_api/main.py logged the mapped optional_rerank_params at INFO. That dict always carries the caller's query and documents, so every rerank call wrote raw request content to stdout and any log sink at the default LITELLM_LOG=INFO. Because it is a plain verbose_logger call outside the logging object, it also bypasses turn_off_message_logging and the redact_messages guards. This was the only completion/embedding/rerank path emitting request content at INFO; sibling code (search/main.py, ocr/main.py, litellm_core_utils/litellm_logging.py) already logs optional_params at debug

- verbose_logger.info(f"optional_rerank_params: {optional_rerank_params}")
+ verbose_logger.debug(f"optional_rerank_params: {optional_rerank_params}")

Added a regression test at tests/test_litellm/rerank_api/test_main.py that drives litellm.arerank (cohere provider, mocked transport) with marker query/documents and asserts no INFO-or-above LiteLLM log record contains the request content, while the optional_rerank_params line is still emitted at DEBUG. It fails on the pre-fix verbose_logger.info and passes on the fix

Link to Devin session: https://app.devin.ai/sessions/67a91a96b957427895a7f3aff032c5da

@devin-ai-integration

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment, CI, and merge conflict monitoring

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@greptile-apps

greptile-apps Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR fixes a log-level issue in litellm/rerank_api/main.py where optional_rerank_params — which always contains the caller's query and documents — was emitted at INFO, making raw request content visible in default log output and any downstream log sink. The fix is a single-line change from verbose_logger.info to verbose_logger.debug, consistent with how sibling paths (search/main.py, ocr/main.py) already handle the same log call.

  • litellm/rerank_api/main.py: verbose_logger.infoverbose_logger.debug for the optional_rerank_params line; no logic change.
  • tests/test_litellm/rerank_api/test_main.py: New regression test that drives litellm.arerank with a mocked HTTP transport, asserts marker content does not appear in any INFO-or-above record, and confirms the log line is still emitted at DEBUG.

Confidence Score: 5/5

Safe to merge — the change is a single log-level demotion with no effect on request handling or response behavior.

The only modified production line changes a log call from INFO to DEBUG; all request-handling logic is untouched. The new test mocks the HTTP transport (no real network calls), directly exercises the changed line, and would fail against the pre-fix code. No backwards-incompatible changes or auth-path modifications.

No files require special attention.

Important Files Changed

Filename Overview
litellm/rerank_api/main.py Single-line change: verbose_logger.info → verbose_logger.debug for optional_rerank_params, matching the pattern already used by search/main.py and ocr/main.py
tests/test_litellm/rerank_api/test_main.py New regression test using mocked HTTP transport (no real network calls); asserts marker content absent from INFO+ records and present at DEBUG, correctly targeting the "LiteLLM" logger name
tests/test_litellm/rerank_api/init.py Empty init.py added to make the new test directory a Python package

Reviews (1): Last reviewed commit: "fix(rerank): log optional_rerank_params ..." | Re-trigger Greptile

@codecov

codecov Bot commented Jul 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@codspeed-hq

codspeed-hq Bot commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

Merging this PR will not alter performance

✅ 30 untouched benchmarks


Comparing litellm_fix_rerank_info_log_32525 (32a08f9) with litellm_internal_staging (b00877c)

Open in CodSpeed

@ishaan-berri
ishaan-berri merged commit 9d74548 into litellm_internal_staging Jul 9, 2026
124 checks passed
@ishaan-berri
ishaan-berri deleted the litellm_fix_rerank_info_log_32525 branch July 9, 2026 01:48
edelauna pushed a commit to edelauna/litellm that referenced this pull request Jul 22, 2026
…est content (BerriAI#32533)

* fix(rerank): log optional_rerank_params at debug not info to avoid leaking request content

* test(rerank): exercise sync rerank path so coverage counts the log line

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: rerank() logs query and documents at INFO, leaking request content into logs

2 participants