# WildGuardTest (Prompt) ![Category](https://img.shields.io/badge/Category-Safety-1f6feb) ![Metric](https://img.shields.io/badge/Metric-F1%20Score-2da44e) ![Saturation](https://img.shields.io/badge/Saturation-Medium-d29922) [![Paper](https://img.shields.io/badge/Paper-arXiv%202406.18495-b31b1b)](https://arxiv.org/abs/2406.18495) [![GitHub](https://img.shields.io/badge/GitHub-allenai%2Fwildguard-181717?logo=github&logoColor=white)](https://github.com/allenai/wildguard) > **Quick answer:** WildGuardTest (Prompt) measures whether a safety classifier correctly identifies harmful user prompts, using a 1,725-item, human-annotated held-out test set from AI2's WildGuardMix. It's one of three tasks scored on the same test set — this page covers prompt-harm classification specifically; response classification and refusal detection are scored separately. ## At a Glance **What it tests:** Binary classification of whether a user's prompt is harmful, across vanilla (direct) and adversarial (jailbreak-style) phrasing. **Why it matters:** WildGuardMix combines synthetic data, in-the-wild user–LLM interactions, and existing annotator-written data across 13 risk subcategories, making WildGuardTest one of the more broadly-sourced prompt-harm benchmarks used to evaluate guard models. **Known limitations:** English-only; labels are derived from GPT-4 annotation audited by human raters (moderate-to-substantial inter-annotator agreement, Fleiss κ ≈ 0.55 for prompt harm). ## What WildGuardTest (Prompt) Measures WildGuardTest is the held-out evaluation split of WildGuardMix, a safety moderation dataset built to train and evaluate WildGuard, AI2's open one-stop moderation model. The test set contains 1,725 items spanning both vanilla and adversarial prompts (55%/45% split), covering four top-level risk categories — privacy, misinformation, harmful language, and malicious uses — broken into 13 fine-grained subcategories. Each item is annotated for prompt harmfulness by three independent raters, with labels retained only where a resolvable majority exists. Prompt classification specifically asks: given a user's request (with no model response yet available), is the request itself harmful? This differs from response classification (does the model's answer contain harmful content) and refusal detection (did the model decline to answer) — WildGuardTest reports all three as separate metrics on the same underlying item set. ## Benchmark Specifications | Field | Value | |---|---| | Task category | Safety / content moderation | | Metric | F1 score (%) | | Test set size | 1,725 items | | Risk categories | 4 top-level, 13 subcategories | | Created by | Han, Rao, Ettinger, Jiang, Lin, Lambert, Choi, Dziri (Allen Institute for AI) | | Paper | [WildGuard (arXiv 2406.18495)](https://arxiv.org/abs/2406.18495) | | GitHub | [allenai/wildguard](https://github.com/allenai/wildguard) | | Dataset | [allenai/wildguardmix](https://huggingface.co/datasets/allenai/wildguardmix) | | License | ODC-BY (dataset), Apache 2.0 (model) | ## How WildGuardTest (Prompt) Is Scored Each of the 1,725 test items is labeled harmful/unharmful by human-audited annotation. A classifier's predictions are compared against ground truth and scored as F1 — the harmonic mean of precision and recall on the harmful class. ## State-of-the-Art Results Scores from the Shieldstral model card (Mistral AI, August 2026). F1 (%), 0.5 classification threshold except where noted. | Rank | Model | Score | Source | Date | |---|---|---|---|---| | 1 | [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) | **88.2%** | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 2 | [Shieldstral 1.0](/models/mistral-ai/shieldstral-1-0) | 88.1% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 3 | [GPT-OSS-Safeguard-20B](/models/openai/gpt-oss-safeguard-20b) | 87.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 4 | [Nemotron-3.5-Content-Safety-4B](/models/nvidia/nemotron-3-5-content-safety-4b) | 84.4% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 5 | [LlamaGuard-4-12B](/models/meta/llamaguard-4-12b) | 74.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 6 | [ShieldGemma-9B](/models/google/shieldgemma-9b) | 46% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | *Scores sourced from Mistral AI's published model card, shown for context. Not Benchgen measurements.* ## WildGuardTest (Prompt) on Benchgen > No Benchgen results yet — [be the first to run WildGuardTest (Prompt)](/benchmarks/allen-institute-for-ai/wildguardtest-prompt). ## WildGuardTest (Prompt) vs Other Benchmarks | Benchmark | What it tests | Test size | Saturation | |---|---|---|---| | **WildGuardTest (Prompt)** | Prompt-harm classification | 1,725 | Medium | | ToxicChat | Real-world toxicity in chatbot queries | 10,165 | Medium | | Aegis v2 (Prompt) | Prompt classification, 12-category taxonomy | 1,964 | Medium | | OpenAI Moderation | Multi-category content moderation | 1,680 | Medium | ## Run WildGuardTest (Prompt) on Your Model Benchgen tracks version-controlled, regression-tested guard-model performance — run your safety classifier against WildGuardTest to see how it holds up against Shieldstral and other guard models as policies and traffic evolve. ## Related Models & Benchmarks - Models: [Shieldstral 1.0](/models/mistral-ai/shieldstral-1-0) · [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) · [GPT-OSS-Safeguard-20B](/models/openai/gpt-oss-safeguard-20b) - Benchmarks: [WildGuardTest (Response)](/benchmarks/allen-institute-for-ai/wildguardtest-response) · [WildGuardTest (Refusal)](/benchmarks/allen-institute-for-ai/wildguardtest-refusal) · [ToxicChat](/benchmarks/lmsys/toxicchat) · [Aegis v2 (Prompt)](/benchmarks/nvidia/aegis-v2-prompt) ## Frequently Asked Questions

What is WildGuardTest?

WildGuardTest is the held-out evaluation split (1,725 items) of AI2's WildGuardMix dataset, used to score safety classifiers on prompt-harm classification, response-harm classification, and refusal detection.

What does a good score look like?

The strongest guard models score in the high-80s to low-90s F1 on prompt classification as of August 2026; scores in the 40–70s indicate a substantially weaker classifier.

Who created WildGuardTest?

The Allen Institute for AI (AI2), introduced in "WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs" (Han et al., NeurIPS 2024).

--- *Last updated 2026-08-12.*

Rank	Model	Score
1	qwen3guard-8b	88.2
2	shieldstral-1-0	88.1
3	gpt-oss-safeguard-20b	87.3
4	nemotron-3-5-content-safety-4b	84.4
5	llamaguard-4-12b	74.3
6	shieldgemma-9b	46

WildGuardTest (Prompt) — Results

WildGuardTest (Prompt) — Phases

WildGuardTest (Prompt)