Mistral AI releases Shieldstral 1.0, a 3B multimodal safety classifier under Apache 2.0
Shieldstral judges text or images against a policy you write and returns an unsafe score. Reported best F1 on several benchmarks; Apache-2.0.
Mistral AI released Shieldstral 1.0 3B. The Hugging Face repository was created on 16 July 2026 and the card lists an accompanying paper published on 28 July. The card carries no release date, so the repository date is used. It is a safety classifier that judges text, images or both against a natural-language policy and returns a continuous unsafe score.
The card says 3B parameters; the Hub lists 4B in BF16. It is built on Ministral-3-3B-Base-2512 with a Pixtral vision encoder, trained on sequences up to 32k tokens, covers 12 languages, and is licensed Apache-2.0. There is no fixed category set: policies are written as yes/no queries at inference time. The recommended way to run it is vLLM, and it fits in about 16 GB of VRAM. It outputs a single yes/no token and you read its logprobs.
The card's F1 table shows 88.1 on WildGuardTest prompts, 84.1 on ToxicChat, 99.4 on HarmBench, 97.7 on VLGuard and 81.8 on UnsafeBench, many marked as best in row. It trails GPT-OSS-Safeguard-20B on refusal detection and RTP-LX, and LlavaGuard-7B on LlavaGuard.
Limits listed: uneven reliability across languages and domains, label noise, and lower accuracy on obfuscated text and very long documents.
A small guard model with a candid card, and the Apache licence helps.
Sources
Editor's first pass (AI-assisted)
- Real 4.5: Open Apache-2.0 weights, vLLM recipe, GGUF and other builds on the Hub.
- Useful 4: Policy-as-prompt moderation across text and images in 12 languages, in about 16 GB.
- Notable 3.5: The card marks best-in-row F1 on several benchmarks against the models it lists.
- Novel 3.5: The policy-as-query framing follows earlier guard models; multimodal at this size is the draw.
Comments