Mistral AI released Shieldstral on Monday, a 3-billion-parameter open-weights safety classifier that matches or outperforms guard models up to seven times its size. The model is available under Apache 2.0 and runs on a single 16 GB GPU.
What sets Shieldstral apart from typical guardrail models is its approach to content moderation. Rather than baking a fixed taxonomy of harm categories into the model weights — which forces developers to retrain whenever their safety requirements change — Shieldstral accepts a plain-language policy at inference time and returns a calibrated safety score from a single token.
Each request uses three inputs: an instruction defining the evaluation context and strictness, a yes-or-no query such as "Does this content promote physical violence," and the document to judge, which can be a text prompt, a model response, a prompt-response pair, or an image with optional text.
The model reads only the "yes" and "no" logits and softmax-normalizes them into a continuous score, so developers can threshold or rank by confidence rather than relying on a binary label. A single interface covers text, image, and text-plus-image inputs across prompts, responses, and prompt-response pairs.
How it was built
Mistral trained Shieldstral by unifying heterogeneous safety datasets into a common instruction-query-document format, varying the phrasing to prevent overfitting. To teach discrimination rather than memorization, the team built contrastive training pairs: sets of similar but distinct policies where an LLM rewrites safe text into examples that violate one policy but not another.
The model was fine-tuned with LoRA, and complementary checkpoints were merged via SLERP to combine public-data calibration, policy discrimination, and instruction-following. Mistral built it end-to-end on Forge, its custom model training platform, and is releasing it as an inaugural member of the Open Secure AI Alliance alongside NVIDIA.
Benchmarks
On benchmarks, Shieldstral matches or beats models up to 7x its size across text safety, refusal detection, policy adaptability, and multimodal safety evaluations. All evaluation samples were held out from training.
The model is available on Hugging Face as Shieldstral-1.0-3B, with a technical report hosted on arXiv.
