Mistral AI · 2026-08-04 · major
Shieldstral 1.0 — Mistral ships a 3B open safety classifier for text and images
Shieldstral 1.0 is Mistral's 3B open-weights safety classifier that reads a plain-language policy at inference and rates text or images as safe or unsafe. Fits in a 16GB GPU, Apache 2.0, matches models 7x its size on benchmarks.
A 3B open-weights safety classifier that reads a plain-language policy at inference, rates text or images, and fits in a 16GB GPU.
Key specs
| Parameters | 3B |
|---|---|
| Vlguard f1 | 97.7% |
| Wild guard test f1 | 88.1% |
Quick facts
| Maker | Mistral AI |
|---|---|
| Parameters | 3B (based on Ministral-3-3B-Base) |
| License | Apache 2.0 |
| Modalities | Text, image, and text+image |
| Runs on | One 16GB NVIDIA GPU (BF16, vLLM 0.26+) |
| Context window | 32K tokens |
| Availability | Weights on Hugging Face, docs public preview |
Benchmarks
What is it?
Shieldstral 1.0 is a compact safety classifier from Mistral for content moderation across text and images. Instead of learning one fixed rule set at training time, the model reads a plain-language policy at inference and answers a yes/no question about whether a piece of content violates it. Weights are open on Hugging Face under Apache 2.0.
How does it work?
The team frames moderation as a binary question-answering task, unifying dozens of safety datasets into one 54 million-sample training set. The 3B parameter model, built on Ministral-3-3B-Base, takes the policy plus the content and returns a calibrated yes/no probability in one forward pass. A shared interface handles text-only, image-only, and text+image inputs; a 32K context window covers long chats.
Why does it matter?
Teams that deploy LLMs usually stitch together bigger, black-box moderation models and pay per call to change one rule. Shieldstral lets a trust and safety team rewrite a policy in a text file and re-run the classifier locally on one GPU, with Apache 2.0 rights to modify it. Mistral reports Shieldstral matches or beats models up to 7x its size on standard safety benchmarks.
Who is it for?
trust and safety teams, LLM app builders
Frequently asked questions
- How is Shieldstral different from a fixed content filter?
- Shieldstral takes the safety policy as a plain-language prompt at inference time rather than hard-coding it during training. Teams can rewrite a policy in a text file and re-run the classifier without collecting new data or fine-tuning, which fixed filters cannot do.
- Is Shieldstral free to use commercially?
- Yes. Shieldstral 1.0 is released under Apache 2.0 on Hugging Face, so it can be downloaded, self-hosted, and used commercially at no cost. Mistral does not require an API key or paid tier for the open weights.
- What hardware does Shieldstral need to run?
- Shieldstral 1.0 fits in one 16GB NVIDIA GPU in BF16 precision, and Mistral recommends vLLM 0.26 or newer for deployment. That footprint puts it inside a single consumer or entry-cloud card rather than requiring a multi-GPU node.
- What does Shieldstral classify?
- Shieldstral handles prompt classification, response moderation, refusal detection, toxicity detection, and image safety across text-only, image-only, and text+image inputs. It supports 12 languages and outputs a calibrated safety score from a single forward pass.
- How does Shieldstral compare to bigger safety models?
- Mistral reports Shieldstral 1.0 matches or beats safety classifiers up to 7x its size, including 97.7% F1 on the VLGuard multimodal benchmark and 88.1% F1 on the WildGuardTest prompt-safety benchmark. Full comparisons are on the model card and in the arXiv report.
Try it
huggingface.co/mistralai/Shieldstral-1.0-3B