mistralai/Shieldstral-1.0-3B

Shieldstral 1.0 3B

Shieldstral is a compact 3B-parameter, policy-adaptive multimodal safety classifier. Instead of predicting a fixed set of moderation categories, Shieldstral evaluates content against a safety policy expressed in natural language and returns a single continuous safety score. This makes it a flexible drop-in guardrail for text-only, image-only, and text+image moderation that can be re-targeted to new policies at inference time, without retraining.

It is built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder, and produces its verdict from a single forward pass.

Learn more in our blog post and technical report.

Key Features

• Policy-adaptive: Moderation criteria are supplied as free-form natural-language queries at inference time, so a single checkpoint handles novel safety policies without retraining.
• Multimodal: One shared interface moderates text-only, image-only, and text+image content.
• Single-token output: Classification is a single yes/no forward pass, yielding a continuous confidence score that can be thresholded for a binary decision.
• Compact: A 3B checkpoint that runs on a single GPU.
• Multilingual: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, and Russian.
• Context Window: We trained this model on sequences of up to 32k tokens. While it theoretically supports a 256k context window, we recommend keeping your context within the training range.
• Apache 2.0 License: Open weights for both commercial and non-commercial use.

Use Cases

Ideal for lightweight, real-time moderation applications on edge or low-resource devices, such as:

• User prompt moderation.
• Model response moderation.
• Model refusal classification.
• And more…

Benchmark Results

Best per row in bold.

Safety classification — F1 (%)

Prompt classification

| Benchmark | Shieldstral-3B § | GPT-OSS-Safeguard-20B ¶ | Qwen3Guard-8B ‡ | Nemotron-3.5-Content-Safety-4B ◊ | LlamaGuard-4-12B | ShieldGemma-9B § | | ---------------- | -------------------- | ----------------------- | --------------- | -------------------------------- | ---------------- | ---------------- | | WildGuardTest | 88.1 | 87.3 | 88.2 | 84.4 | 74.3 | 46.0 | | ToxicChat | 84.1 | 79.8 | 75.6 | 72.2 | 51.0 | 62.4 | | Aegis v2 | 86.2 | 84.4 | 84.6 | 86.3 | 71.5 | 65.8 | | HarmBench | 99.4 | 94.5 | 99.3 | 96.1 | 97.9 | 50.2 | | OpenAI Moderation | 81.4 | 84.0 | 74.7 | 74.7 | 73.9 | 78.6 |

Response classification

| Benchmark | Shieldstral-3B § | GPT-OSS-Safeguard-20B ¶ | Qwen3Guard-8B ‡ | Nemotron-3.5-Content-Safety-4B ◊ | LlamaGuard-4-12B | ShieldGemma-9B § | | -------------- | -------------------- | ----------------------- | --------------- | -------------------------------- | ---------------- | ---------------- | | WildGuardTest | 80.4 | 80.7 | 79.6 | 77.6 | 66.8 | 34.5 | | HarmBench | 87.0 | 88.2 | 86.8 | 85.3 | 82.8 | 52.3 | | BeaverTails | 85.0 | 83.8 | 85.9 | 83.3 | 69.8 | 54.0 | | XSTest Harm | 93.5 | 93.8 | 92.9 | 86.9 | 89.0 | 80.6 | | Aegis v2 | 87.2 | 75.2 | 86.2 | 84.9 | 64.7 | 59.7 | | Qwen3GuardTest | 82.9 | 85.0 | 84.2 | 80.0 | 60.6 | 38.7 |

Multilingual

| Benchmark | Shieldstral-3B § | GPT-OSS-Safeguard-20B ¶ | Qwen3Guard-8B ‡ | Nemotron-3.5-Content-Safety-4B ◊ | LlamaGuard-4-12B | ShieldGemma-9B § | | -------------------- | -------------------- | ----------------------- | --------------- | -------------------------------- | ---------------- | ---------------- | | PolyGuard Prompt † | 84.6 | 83.0 | 84.3 | 80.5 | 62.1 | 33.8 | | PolyGuard Response † | 78.3 | 80.0 | 78.1 | 75.3 | 54.6 | 31.8 | | RTP-LX Prompt † | 70.3 | 83.9 | 67.3 | 86.1 | 43.9 | 36.7 | | RTP-LX Completion † | 93.5 | 94.6 | 93.9 | 95.9 | 66.5 | 79.0 |

_† Multilingual dataset. ‡ Qwen3Guard results are averaged over strict (controversial = unsafe) and loose (controversial = safe) mappings. § ShieldGemma and Shieldstral use a threshold of 0.5. ¶ GPT-OSS-Safeguard-20B uses reasoning_effort=high. ◊ Nemotron-3.5-Content-Safety-4B uses reasoning_effort=none for default categories._

Refusal detection — F1 (%)

| Benchmark | Shieldstral-3B § | GPT-OSS-Safeguard-20B ¶ | Qwen3Guard-8B ‡ | WildGuard-7B | PolyGuard-Qwen-7B | | ------------- | -------------------- | ----------------------- | --------------- | ------------ | ----------------- | | WildGuardTest | 90.3 | 93.9 | 90.1 | 88.6 | 87.5 | | XSTest | 94.6 | 94.9 | 92.6 | 92.5 | 82.1 | | PolyGuard † | 89.5 | 92.3 | 89.3 | 89.6 | 83.8 |

_† Multilingual dataset. ‡ Qwen3Guard results are averaged over strict / loose mappings. § Shieldstral uses a threshold of 0.5. ¶ GPT-OSS-Safeguard-20B uses reasoning_effort=high._

Multimodal safety — F1 (%)

| Benchmark | Shieldstral-3B § | OmniGuard-7B | Nemotron-3.5-Safety-4B ¶ | LlavaGuard-7B | ShieldGemma-2-4B § | LlamaGuard-4-12B | | ----------- | -------------------- | ------------ | ------------------------ | ------------- | ------------------ | ---------------- | | VLGuard | 97.7 | 88.5 | 84.2 | 69.5 | 61.3 | 59.9 | | UnsafeBench | 81.8 | 72.6 | 67.7 | 63.9 | 54.9 | 30.8 | | LlavaGuard ★ | 72.0 | 71.7 | 70.0 | 81.4 | 56.2 | 21.9 |

_§ ShieldGemma-2 and Shieldstral use a threshold of 0.5. ¶ Nemotron-3.5-Safety uses reasoning_effort=none for default categories. ★ Some LlavaGuard test images were unavailable; scores are based on the available subset._

How It Works

Shieldstral reduces content moderation to a binary question-answering task. Each input is a system message plus a user message:

• System message _(fixed)_:

Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be "yes" or "no".

• User message _(adaptive)_:
• ``: high-level task framing (evaluation context and strictness level). Typically constant across a task or product surface.
• ``: a single yes/no question about the document (e.g. _"Does this content promote violence?"_).
• ``: the content to evaluate — a prompt, a response, a formatted prompt–response pair, or an image (optionally with text).

Prompt-engineering tips:

• One policy per query. Shieldstral answers a single yes/no question per call. For multiple policies, issue one query per policy...