# Shieldstral 1.0 ![Organization](https://img.shields.io/badge/Org-Mistral%20AI-555) ![Context](https://img.shields.io/badge/Context-32k%20tokens-1f6feb) ![Pricing](https://img.shields.io/badge/Price-Open%20Weights-2da44e) ![License](https://img.shields.io/badge/License-Apache%202.0-d29922) ![Modality](https://img.shields.io/badge/Modality-Multimodal-8957e5) ![Released](https://img.shields.io/badge/Released-Aug%202026-555) > **Quick answer:** Shieldstral 1.0 is Mistral AI's 3B-parameter, Apache 2.0 safety classifier that turns content moderation into a single yes/no question. It matches or beats open guard models up to 7x its size on text safety, refusal detection, and multimodal moderation, runs on a single 16GB GPU, and answers novel safety policies at inference time without retraining. ## At a Glance **Where Shieldstral 1.0 leads** - Best-in-class multimodal safety at 3B: 97.7% F1 on VLGuard and 81.8% on UnsafeBench, ahead of every other model in Mistral's comparison including much larger ones. - Strong text-safety scores relative to size: 99.4% on HarmBench prompt classification and 87.2% on Aegis v2 response classification, both the top score in their row. - Policy-adaptive by design — one checkpoint handles arbitrary natural-language moderation policies (prompt, response, or refusal checks) without any retraining or fine-tuning. **Where it lags** - On refusal detection, GPT-OSS-Safeguard-20B (a much larger reasoning model) leads on all three reported benchmarks (WildGuardTest, XSTest, PolyGuard refusal). - RTP-LX Prompt (multilingual toxicity) is a relative weak spot: Nemotron-3.5-Content-Safety-4B scores 86.1% vs. Shieldstral's 70.3%. - Undisclosed exact parameter/architecture breakdown beyond "3B on Ministral-3-3B-Base-2512 + Pixtral vision encoder" — no public technical spec sheet beyond the model card and technical report. **Best for:** teams that need a single, self-hostable, policy-flexible guardrail for text and image moderation across prompts, responses, and refusal detection — without maintaining separate models per policy or per modality. ## What Shieldstral 1.0 Is Shieldstral reframes content moderation as binary question-answering rather than fixed-category classification. Every request has three parts: an `` block setting the evaluation context and strictness, a `` phrased as a single yes/no question (e.g. "Does this content promote physical violence?"), and a `` — a prompt, a response, a prompt–response pair, or an image with optional text. At inference, the model reads only the `yes`/`no` logits and softmax-normalizes them into a continuous, thresholdable safety score. That formulation unifies prompt classification, response moderation, refusal detection, and toxicity detection into one problem, and lets policies live entirely in the prompt — so the same checkpoint adapts to a brand-new moderation policy at deployment time with no retraining. Built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder, Shieldstral was trained on a heterogeneous mix of real and synthetic safety data spanning multiple label taxonomies and formats. Mistral's team converted every source dataset into a shared instruction–query–document format, varied instruction/query/document phrasing so the model generalizes across styles instead of memorizing one, and calibrated strictness per source (strict for adversarial jailbreak data, lenient for response-quality data). To teach genuine policy discrimination rather than memorized categories, they constructed sets of deliberately similar, easily-confused policies and used an LLM to rewrite safe text into contrastive pairs — each violating one policy but not a near-identical sibling policy — so the model learns to reason about policy boundaries rather than pattern-match a fixed label set. Visual safety data, which is scarce since unsafe images can't be synthesized the way text can, was supplemented with general-purpose image datasets as high-quality negatives and filtered through a vision–language reranker to reduce label noise. The final checkpoint is a SLERP merge of three fine-tuned components: one calibrated on public safety data, one adding fine-grained policy discrimination from generated contrastive data, and the base Ministral-3-3B instruct model — recovering both policy calibration and general instruction-following in a single 3B model. As an inaugural member of the Open Secure AI Alliance (with NVIDIA and other organizations), Mistral released Shieldstral fully open under Apache 2.0, deployable via vLLM, llama.cpp, SGLang, or Transformers, and small enough to run entirely on a single consumer-class 16GB GPU. ## Specifications | Field | Value | |---|---| | Organization | Mistral AI | | Parameters | 3B (4B including vision encoder; base: Ministral-3-3B-Base-2512) | | Context window | 32,000 tokens (32k trained; 256k theoretical, not recommended) | | Max output | Single-token yes/no classification (not a generative chat model) | | Architecture | Ministral-3-3B-Base-2512 language backbone + native Pixtral vision encoder | | License | Apache 2.0 | | Release date | August 4, 2026 | | Knowledge cutoff | June 2026 (approximate, based on training data recency) | | Modality | Multimodal (text, image, text+image) | ## Pricing | | Input (per 1M tokens) | Output (per 1M tokens) | |---|---|---| | Self-hosted (open weights) | Free to download | Free to download | Shieldstral is released under Apache 2.0 — there is no per-token API price from Mistral. Cost is entirely infrastructure: the model fits in 16GB of VRAM in BF16, so it runs on a single consumer or workstation-class GPU via vLLM, llama.cpp, SGLang, or Transformers. ([Model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B)) ## Context Window Shieldstral has a **32,000-token context window** — roughly **45–50 pages** of text in a single request. That's enough headroom to moderate a full prompt–response pair, a multi-turn conversation transcript, or a long document passed as the `` field, while leaving room for the `` and `` fields. Mistral trained the model on sequences up to 32k tokens; while it theoretically supports up to 256k tokens, the model card recommends staying within the training range for reliable behavior. ## Public Benchmark Scores *Scores below are F1 (%) as reported in Mistral's [Shieldstral model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) and [technical report](https://arxiv.org/abs/2607.25857). They are not Benchgen measurements. Shieldstral uses a 0.5 classification threshold throughout.* | Benchmark | Score | Source | Date | |---|---|---|---| | [WildGuardTest (Prompt)](/benchmarks/allen-institute-for-ai/wildguardtest-prompt) | 88.1% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [WildGuardTest (Response)](/benchmarks/allen-institute-for-ai/wildguardtest-response) | 80.4% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [WildGuardTest (Refusal)](/benchmarks/allen-institute-for-ai/wildguardtest-refusal) | 90.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [ToxicChat](/benchmarks/lmsys/toxicchat) | 84.1% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [Aegis v2 (Prompt)](/benchmarks/nvidia/aegis-v2-prompt) | 86.2% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [Aegis v2 (Response)](/benchmarks/nvidia/aegis-v2-response) | 87.2% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [HarmBench (Prompt)](/benchmarks/center-for-ai-safety/harmbench-prompt) | 99.4% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [HarmBench (Response)](/benchmarks/center-for-ai-safety/harmbench-response) | 87.0% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [OpenAI Moderation](/benchmarks/openai/openai-moderation) | 81.4% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [BeaverTails](/benchmarks/pku-alignment/beavertails) | 85.0% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [XSTest Harm](/benchmarks/independent-research/xstest-harm) | 93.5% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [XSTest (Refusal)](/benchmarks/independent-research/xstest-refusal) | 94.6% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [Qwen3GuardTest](/benchmarks/alibaba/qwen3guardtest) | 82.9% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [PolyGuard Prompt](/benchmarks/toxicityprompts/polyguard-prompt) | 84.6% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [PolyGuard Response](/benchmarks/toxicityprompts/polyguard-response) | 78.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [PolyGuard (Refusal)](/benchmarks/toxicityprompts/polyguard-refusal) | 89.5% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [RTP-LX Prompt](/benchmarks/microsoft/rtp-lx-prompt) | 70.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [RTP-LX Completion](/benchmarks/microsoft/rtp-lx-completion) | 93.5% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [VLGuard](/benchmarks/independent-research/vlguard) | 97.7% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [UnsafeBench](/benchmarks/independent-research/unsafebench) | 81.8% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | [LlavaGuard](/benchmarks/tu-darmstadt-hessian-ai/llavaguard) | 72.0% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | *Scores above are reported by Mistral AI and shown for context. They are not Benchgen measurements. GPT-OSS-Safeguard-20B figures use `reasoning_effort=high`; Qwen3Guard-8B figures are averaged over strict/loose mappings — see the model card for full methodology notes.* ## Shieldstral 1.0 vs Alternatives | Model | Params | WildGuardTest (Prompt) | HarmBench (Prompt) | VLGuard | License | |---|---|---|---|---|---| | **Shieldstral 1.0** | 3B | 88.1% | 99.4% | 97.7% | Apache 2.0 | | [GPT-OSS-Safeguard-20B](/models/openai/gpt-oss-safeguard-20b) | 20B (3.6B active) | 87.3% | 94.5% | — | Apache 2.0 | | [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) | 8B | 88.2% | 99.3% | — | Apache 2.0 | | [LlamaGuard-4-12B](/models/meta/llamaguard-4-12b) | 12B | 74.3% | 97.9% | 59.9% | Llama 4 Community License | | [ShieldGemma-9B](/models/google/shieldgemma-9b) | 9B | 46.0% | 50.2% | — | Gemma Terms of Use | Shieldstral's core trade-off is size vs. flexibility: at 3B parameters it's the smallest model in this comparison by a wide margin, yet it matches or beats guard models 3–7x larger on text and multimodal safety classification. Its main gap is refusal detection, where the larger reasoning-based GPT-OSS-Safeguard-20B pulls ahead — a plausible trade-off of extra parameters spent on explicit chain-of-thought safety reasoning rather than single-token classification. ## How Shieldstral 1.0 Performs on Real Agent Tasks A guardrail model's leaderboard score answers "does it flag bad content correctly on a static test set" — what production teams actually need is a moderator that keeps working when the policy changes, the modality changes, or the traffic shifts to a new language, without a retraining cycle. Shieldstral's policy-adaptive design is built for exactly that: because the moderation policy is supplied as a natural-language query at inference time rather than baked into the weights, a single deployed checkpoint can be re-targeted to a new product surface, a stricter enterprise policy, or a previously-unseen harm category by editing the prompt, not the model. Its multilingual and multimodal coverage (12 languages, native image support) means the same deployment can front both a text chat product and an image-generation product without maintaining two separate guardrail stacks — a meaningful operational simplification for teams running agentic products where user input arrives in mixed modalities and the safety policy needs to evolve as fast as the product does. ## Use Shieldstral 1.0 via API Shieldstral is open weights — there is no hosted Mistral API for it. Serve it yourself with vLLM: ```bash pip install vllm --upgrade vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768 ``` ```python from openai import OpenAI client = OpenAI(base_url="http://localhost:8000/v1", api_key="not-needed") system_message = "Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be \"yes\" or \"no\"." user_message = """: You are a strict safety moderator reviewing potentially harmful content. Apply a low tolerance threshold. : Does this content promote physical violence? : [User] How can I hurt someone without being caught? [Assistant] Sure, I can help with that...""" response = client.chat.completions.create( model="mistralai/Shieldstral-1.0-3B", messages=[ {"role": "system", "content": system_message}, {"role": "user", "content": user_message}, ], ) print(response.choices[0].message.content) ``` ## Related Models & Benchmarks - Compare: [GPT-OSS-Safeguard-20B](/models/openai/gpt-oss-safeguard-20b) · [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) · [LlamaGuard-4-12B](/models/meta/llamaguard-4-12b) · [ShieldGemma-9B](/models/google/shieldgemma-9b) · [WildGuard-7B](/models/allen-institute-for-ai/wildguard-7b) - Benchmarks: [WildGuardTest (Prompt)](/benchmarks/allen-institute-for-ai/wildguardtest-prompt) · [HarmBench (Prompt)](/benchmarks/center-for-ai-safety/harmbench-prompt) · [VLGuard](/benchmarks/independent-research/vlguard) · [PolyGuard Prompt](/benchmarks/toxicityprompts/polyguard-prompt) ## Frequently Asked Questions

What is Shieldstral 1.0?

Shieldstral 1.0 is Mistral AI's open-weights, 3B-parameter multimodal safety classifier. It answers a single yes/no moderation question per call, so it can classify harmful prompts, harmful responses, and refusals for both text and image content using one model.

What is Shieldstral 1.0's context window?

Shieldstral was trained on sequences up to 32,000 tokens (roughly 45–50 pages of text). It theoretically supports up to 256k tokens, but Mistral recommends staying within the 32k training range.

How much does Shieldstral 1.0 cost?

Shieldstral is open weights under Apache 2.0 — free to download. There's no Mistral API fee; cost is limited to hosting infrastructure. It fits in 16GB of VRAM and can be served with vLLM, llama.cpp, SGLang, or Transformers.

Is Shieldstral 1.0 open source?

Yes. Shieldstral 1.0 is released under the Apache 2.0 license, with weights available on Hugging Face.

What is Shieldstral 1.0's knowledge cutoff?

Mistral has not published an exact knowledge cutoff date for Shieldstral's training data; based on the release timing and referenced comparison models, the training data appears to extend into mid-2026.

--- *Specs and scores sourced from Mistral AI's [official blog post](https://mistral.ai/news/shieldstral/), [technical report](https://arxiv.org/abs/2607.25857), and [Hugging Face model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B). Third-party benchmark scores attributed inline. Last updated 2026-08-12.*

Shieldstral 1.0 — Evaluations

Evaluations