Open-Source Safety and Moderation Classifiers in Production: Comparing Llama Guard 3, ShieldGemma, WildGuard, and Prompt-Guard

Production large language model (LLM) applications require structured defenses against adversarial jailbreaks, prompt injections, and policy-violating content. While guardrail orchestration frameworks handle workflow logic, the actual enforcement decisions rely on specialized safety classifier models.

Open-source safety classifiers have diverged into distinct architectural paradigms, ranging from lightweight bidirectional encoders to full autoregressive decoders and multi-task refusal evaluators. Four primary open-weight models dominate production deployments: Meta Llama Guard 3, Google ShieldGemma, the Allen Institute for AI (AI2) WildGuard, and Meta Prompt-Guard.

Architecture and Classification Mechanisms

The four models employ fundamentally different model backbones and inference mechanics:

• Meta Llama Guard 3 (1B and 8B): Built on fine-tuned Llama-3.2-1B and Llama-3.1-8B instruction-tuned architectures. Llama Guard operates as a generative decoder that receives a conversation history formatted alongside an explicit policy prompt. It outputs plain text indicating safe or unsafe, followed by the violated policy category code (such as S1 through S14).
• Google ShieldGemma (2B, 9B, and 27B): Derived from Gemma 2 checkpoints (with ShieldGemma 2 extending to a 4B Gemma 3 multimodal model). ShieldGemma frames safety as an instruction-tuned scoring task. Rather than generating arbitrary text strings, inference extracts the next-token logit distribution for the tokens Yes and No corresponding to whether a specified hazard policy was violated.
• Allen Institute for AI WildGuard (7B): Developed by AI2 and the University of Washington on a Mistral-7B and Llama foundation. WildGuard is trained on WildGuardMix (a 92,000-example dataset) to execute a tripartite evaluation in a single forward pass: detecting prompt harmfulness, detecting response harmfulness, and classifying whether the target model appropriately refused an unsafe request.
• Meta Prompt-Guard / Prompt Guard 2 (86M): An encoder-only sequence classification model built on Microsoft mDeBERTa-v3-base. Prompt-Guard bypasses conversational generation entirely, running a bidirectional token encoder with a classification head that maps inputs into three discrete logits: Benign, Injection, and Jailbreak.

Hazard Taxonomies and Detection Scope

Each classifier reflects a specific safety taxonomy and threat model:

Llama Guard 3: MLCommons Hazard Taxonomy

Llama Guard 3 aligns with the 14 hazard categories defined by the MLCommons standard taxonomy:

• S1: Violent Crimes
• S2: Non-Violent Crimes
• S3: Sexually Explicit Content
• S4: Child Sexual Exploitation and Abuse (CSAE)
• S5: Suicide and Self-Harm
• S6: Cyberattacks and Malware
• S7: Chemical, Biological, Radiological, or Nuclear (CBRN) Weapons
• S8: Hate Speech
• S9: Harassment
• S10: Defamation
• S11: Privacy Violations
• S12: Specialized Advice (Financial / Medical / Legal)
• S13: Intellectual Property Infringement
• S14: Indiscriminate Weapons

Llama Guard 3 also incorporates specialized evaluation for tool-use integrity, specifically detecting prompt attacks that manipulate code interpreter executions or web search tool calls across eight supported languages.

ShieldGemma: Focused Core Harm Policies

ShieldGemma targets four primary content harm categories:

• Hate Speech
• Harassment
• Sexually Explicit Content
• Dangerous Content

Because ShieldGemma evaluates one policy at a time via logit probabilities, teams can independently enable or disable specific policies and set distinct decision thresholds per category without modifying model weights.

WildGuard: Adversarial Refusal Tracking

WildGuard evaluates 13 safety risk categories while explicitly decoupling prompt intent from model response behavior. Standard safety models frequently misclassify benign prompts that resemble adversarial syntax (the over-refusal problem) or fail to detect subtle compliance with malicious requests. WildGuard addresses this by simultaneously outputting prompt safety, response safety, and refusal status flags.

Prompt-Guard: Structural Attack Detection

Prompt-Guard is purpose-built to intercept attack vectors rather than broad content moderation categories. It separates attacks into:

• Jailbreaks: Direct inputs crafted to bypass system safety instructions.
• Prompt Injections: Injected commands placed within untrusted third-party context data (such as web extracts or user documents) designed to hijack agent execution.

Latency Overhead and Serving Economics

Safety classifiers sit directly on the critical path of user requests. Deploying a classifier introduces latency overhead on incoming prompts and outgoing model completions:

• Prompt-Guard (86M): Requires approximately 350 MB of memory. A single forward pass on an NVIDIA A10G or T4 GPU executes in 1 to 3 milliseconds (and under 10 milliseconds on standard CPU instances). It functions as an ultra-low-cost preliminary filter.
• Llama Guard 3-1B: Requires approximately 2.5 GB of VRAM in FP16 (or under 1 GB in INT4). It completes prompt classification in 15 to 40 milliseconds on modern accelerator hardware, making it practical for real-time conversational agents.
• ShieldGemma 2B: Requires approximately 5 GB of VRAM. Scoring a single policy via logit extraction requires 20 to 50 milliseconds. Evaluating all four core policies sequentially increases latency unless batched across parallel heads.
• WildGuard 7B and Llama Guard 3-8B: Require 14 to 16 GB of VRAM. A full generation pass requires 80 to 250 milliseconds depending on batching and prefix caching. These models are typically reserved for asynchronous batch auditing or high-assurance enterprise gateways where safety precision outweighs sub-100ms time-to-first-token requirements.

False Positives, Calibration, and Threshold Tuning

A primary challenge in production safety filtering is the false positive rate (FPR), where benign user prompts containing sensitive vocabulary (such as medical queries, historical research, or creative writing) trigger unwarranted blocks.

Generative classifiers like Llama Guard 3 produce discrete token outputs (safe or unsafe). Calibrating their sensitivity requires extracting sequence logit probabilities or altering the in-context policy definitions in the system prompt. On benchmark suites like XSTest, discrete generative guards can exhibit elevated refusal rates on benign boundary cases unless carefully tuned.

ShieldGemma addresses this by yielding continuous probability scores for policy violation ($P(\text{Yes}) / [P(\text{Yes}) + P(\text{No})]$). Engineering teams can set operational operating points along the precision-recall curve: setting a conservative threshold (such as 0.85) for open customer-facing chatbots to minimize false refusals, or an aggressive threshold (such as 0.30) for enterprise compliance pipelines.

WildGuard achieves higher F1 scores on adversarial prompt benchmarks (like WildGuardTest) by training on balanced distributions of adversarial jailbreaks, borderline benign queries, and successful model refusals, reducing the penalty on benign prompt variations.

Multi-Tiered Inspection Pipeline in Production

Leading production architectures rarely rely on a single monolithic safety model. Instead, engineering teams combine these tools into a tiered pipeline:

1. Tier 1 (L1 Ingress Filter): Incoming user text passes through Meta Prompt-Guard (86M). Sub-5ms screening detects prompt injection and jailbreak payloads before any LLM inference occurs.
2. Tier 2 (L2 Policy Moderation): If clean, the prompt is evaluated against organizational content policies using ShieldGemma 2B or Llama Guard 3-1B.
3. Core Generation: The sanitized prompt is dispatched to the primary generation model.
4. Tier 3 (L3 Egress Moderation): The generated completion is evaluated by Llama Guard 3 or WildGuard to ensure the model did not hallucinate dangerous instructions or fail to uphold refusal boundaries.

Model Comparison Summary

• Prompt-Guard 2 (86M): Encoder classifier (mDeBERTa-v3-base). Detects injections and jailbreaks. Latency: 1-3 ms. Best for L1 edge ingress firewalls.
• Llama Guard 3-1B (1B): Generative decoder (Llama-3.2). Covers 14 MLCommons hazard categories and tool use. Latency: 15-40 ms. Best for low-latency conversational input/output guardrails.
• ShieldGemma 2B (2B): Logit scoring decoder (Gemma 2). Covers Hate, Harassment, Sexual, and Dangerous Content with tunable thresholds. Latency: 20-50 ms. Best for threshold-calibrated content moderation.
• Llama Guard 3-8B (8B): Generative decoder (Llama-3.1). Multilingual 14-category MLCommons moderation. Latency: 80-200 ms. Best for enterprise gateway compliance and complex tool validation.
• WildGuard (7B): Multi-task generative decoder (Mistral-7B). Jointly assesses prompt harm, response harm, and model refusal. Latency: 80-200 ms. Best for alignment evaluation, red-teaming, and joint refusal auditing.

Sources

• Meta Llama Guard 3 Model Card and Taxonomy
• Hugging Face: meta-llama/Llama-Guard-3-8B
• Google AI for Developers: ShieldGemma Documentation
• Hugging Face: google/shieldgemma-2-4b-it
• Allen Institute for AI: WildGuard Repository
• arXiv: WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs (2406.18495)
• Meta Purple Llama: Prompt Guard 86M
• Hugging Face: meta-llama/Llama-Guard-3-1B