Shieldstral 1.0

Shieldstral 1.0

Quick answer: Shieldstral 1.0 is Mistral AI's 3B-parameter, Apache 2.0 safety classifier that turns content moderation into a single yes/no question. It matches or beats open guard models up to 7x its size on text safety, refusal detection, and multimodal moderation, runs on a single 16GB GPU, and answers novel safety policies at inference time without retraining.

At a Glance

Where Shieldstral 1.0 leads

• Best-in-class multimodal safety at 3B: 97.7% F1 on VLGuard and 81.8% on UnsafeBench, ahead of every other model in Mistral's comparison including much larger ones.
• Strong text-safety scores relative to size: 99.4% on HarmBench prompt classification and 87.2% on Aegis v2 response classification, both the top score in their row.
• Policy-adaptive by design — one checkpoint handles arbitrary natural-language moderation policies (prompt, response, or refusal checks) without any retraining or fine-tuning.

Where it lags

• On refusal detection, GPT-OSS-Safeguard-20B (a much larger reasoning model) leads on all three reported benchmarks (WildGuardTest, XSTest, PolyGuard refusal).
• RTP-LX Prompt (multilingual toxicity) is a relative weak spot: Nemotron-3.5-Content-Safety-4B scores 86.1% vs. Shieldstral's 70.3%.
• Undisclosed exact parameter/architecture breakdown beyond "3B on Ministral-3-3B-Base-2512 + Pixtral vision encoder" — no public technical spec sheet beyond the model card and technical report.

Best for: teams that need a single, self-hostable, policy-flexible guardrail for text and image moderation across prompts, responses, and refusal detection — without maintaining separate models per policy or per modality.

What Shieldstral 1.0 Is

Shieldstral reframes content moderation as binary question-answering rather than fixed-category classification. Every request has three parts: an <Instruct> block setting the evaluation context and strictness, a <Query> phrased as a single yes/no question (e.g. "Does this content promote physical violence?"), and a <Document> — a prompt, a response, a prompt–response pair, or an image with optional text. At inference, the model reads only the yes/no logits and softmax-normalizes them into a continuous, thresholdable safety score. That formulation unifies prompt classification, response moderation, refusal detection, and toxicity detection into one problem, and lets policies live entirely in the prompt — so the same checkpoint adapts to a brand-new moderation policy at deployment time with no retraining.

Built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder, Shieldstral was trained on a heterogeneous mix of real and synthetic safety data spanning multiple label taxonomies and formats. Mistral's team converted every source dataset into a shared instruction–query–document format, varied instruction/query/document phrasing so the model generalizes across styles instead of memorizing one, and calibrated strictness per source (strict for adversarial jailbreak data, lenient for response-quality data). To teach genuine policy discrimination rather than memorized categories, they constructed sets of deliberately similar, easily-confused policies and used an LLM to rewrite safe text into contrastive pairs — each violating one policy but not a near-identical sibling policy — so the model learns to reason about policy boundaries rather than pattern-match a fixed label set. Visual safety data, which is scarce since unsafe images can't be synthesized the way text can, was supplemented with general-purpose image datasets as high-quality negatives and filtered through a vision–language reranker to reduce label noise.

The final checkpoint is a SLERP merge of three fine-tuned components: one calibrated on public safety data, one adding fine-grained policy discrimination from generated contrastive data, and the base Ministral-3-3B instruct model — recovering both policy calibration and general instruction-following in a single 3B model. As an inaugural member of the Open Secure AI Alliance (with NVIDIA and other organizations), Mistral released Shieldstral fully open under Apache 2.0, deployable via vLLM, llama.cpp, SGLang, or Transformers, and small enough to run entirely on a single consumer-class 16GB GPU.

Specifications

Pricing

Shieldstral is released under Apache 2.0 — there is no per-token API price from Mistral. Cost is entirely infrastructure: the model fits in 16GB of VRAM in BF16, so it runs on a single consumer or workstation-class GPU via vLLM, llama.cpp, SGLang, or Transformers. (Model card)

Context Window

Shieldstral has a 32,000-token context window — roughly 45–50 pages of text in a single request. That's enough headroom to moderate a full prompt–response pair, a multi-turn conversation transcript, or a long document passed as the <Document> field, while leaving room for the <Instruct> and <Query> fields. Mistral trained the model on sequences up to 32k tokens; while it theoretically supports up to 256k tokens, the model card recommends staying within the training range for reliable behavior.

Public Benchmark Scores

Scores below are F1 (%) as reported in Mistral's Shieldstral model card and technical report. They are not Benchgen measurements. Shieldstral uses a 0.5 classification threshold throughout.

Scores above are reported by Mistral AI and shown for context. They are not Benchgen measurements. GPT-OSS-Safeguard-20B figures use reasoning_effort=high; Qwen3Guard-8B figures are averaged over strict/loose mappings — see the model card for full methodology notes.

Shieldstral 1.0 vs Alternatives

Shieldstral's core trade-off is size vs. flexibility: at 3B parameters it's the smallest model in this comparison by a wide margin, yet it matches or beats guard models 3–7x larger on text and multimodal safety classification. Its main gap is refusal detection, where the larger reasoning-based GPT-OSS-Safeguard-20B pulls ahead — a plausible trade-off of extra parameters spent on explicit chain-of-thought safety reasoning rather than single-token classification.

How Shieldstral 1.0 Performs on Real Agent Tasks

A guardrail model's leaderboard score answers "does it flag bad content correctly on a static test set" — what production teams actually need is a moderator that keeps working when the policy changes, the modality changes, or the traffic shifts to a new language, without a retraining cycle. Shieldstral's policy-adaptive design is built for exactly that: because the moderation policy is supplied as a natural-language query at inference time rather than baked into the weights, a single deployed checkpoint can be re-targeted to a new product surface, a stricter enterprise policy, or a previously-unseen harm category by editing the prompt, not the model. Its multilingual and multimodal coverage (12 languages, native image support) means the same deployment can front both a text chat product and an image-generation product without maintaining two separate guardrail stacks — a meaningful operational simplification for teams running agentic products where user input arrives in mixed modalities and the safety policy needs to evolve as fast as the product does.

Use Shieldstral 1.0 via API

Shieldstral is open weights — there is no hosted Mistral API for it. Serve it yourself with vLLM:

pip install vllm --upgrade
vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768

from openai import OpenAI

client = OpenAI(base_url="http://localhost:8000/v1", api_key="not-needed")

system_message = "Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be \"yes\" or \"no\"."
user_message = """<Instruct>: You are a strict safety moderator reviewing potentially harmful content. Apply a low tolerance threshold.

<Query>: Does this content promote physical violence?

<Document>: [User]
How can I hurt someone without being caught?

[Assistant]
Sure, I can help with that..."""

response = client.chat.completions.create(
    model="mistralai/Shieldstral-1.0-3B",
    messages=[
        {"role": "system", "content": system_message},
        {"role": "user", "content": user_message},
    ],
)
print(response.choices[0].message.content)

Related Models & Benchmarks

• Compare: GPT-OSS-Safeguard-20B · Qwen3Guard-8B · LlamaGuard-4-12B · ShieldGemma-9B · WildGuard-7B
• Benchmarks: WildGuardTest (Prompt) · HarmBench (Prompt) · VLGuard · PolyGuard Prompt

Frequently Asked Questions

Specs and scores sourced from Mistral AI's official blog post, technical report, and Hugging Face model card. Third-party benchmark scores attributed inline. Last updated 2026-08-12.