Shieldstral 1.0 3B: AI Safety 🤯🚀 Redefined!

SHIELDSTRAL 1.0 3B: A REVOLUTION IN POLICY-ADAPTIVE SAFETY
The Mistral AI team has introduced Shieldstral 1.0 3B, a novel open-weights multimodal safety classifier designed to fundamentally change how content moderation is approached. This system moves away from traditional, category-based guardrails, offering a more flexible and efficient solution for assessing content risk.

POLICY-DRIVEN MODAL SAFETY CLASSIFICATION
Shieldstral 1.0 3B utilizes a unique approach to content moderation, treating it as a single yes/no question rather than a complex taxonomy of harmful categories. This shift allows operators to define policies using clear, natural language questions at inference time, enabling the model to adapt to diverse deployment contexts without requiring retraining. This contrasts sharply with existing guardrail models that embed category lists into their weights, necessitating retraining whenever a new deployment context is needed.

TECHNICAL SPECIFICATIONS AND PERFORMANCE
Built upon the Mistral-3-3B-Base-2512 foundation model and incorporating a native Pixtralvision encoder, Shieldstral 1.0 3B achieves impressive performance metrics. It reports an average F1 score of 84.9% for text safety, matching GPT-OSS-Safeguard-20B, and 83.8% for multimodal safety, surpassing all baseline Mistral models evaluated. Notably, the model can run locally on 16GB of VRAM in BF16, utilizing optimized serving paths via VLLM, llama.cpp (with GGUF conversion), SGLang, and Transformers, all with support for fine-tuning through Axolotl. The single-token output dramatically reduces latency and cost compared to reasoning-based guardrails like GPT-OSS-Safeguard-20B.

A FRAMEWORK FOR FLEXIBLE POLICY DEFINITION
The core of Shieldstral’s design lies in its flexible framework for defining policies. The system employs a three-part structure: an established system message to define the task, a user message containing an (evaluation context and strictness), a (the policy phrased as a single yes/no question), and a (a prompt, response, prompt-response pair, or image). At inference, the model unembeds toward the yesandnotoken IDs and softmax-normalizes them into a continuous score, thresholded at τ=0.5. This collapses prompt classification, response moderation, refusal detection, and toxicity detection into a single problem, streamlining the moderation process.

CONTRASTIVE GENERATION FOR POLICY TEACHING
Shieldstral’s innovative approach extends to training methodology. The system utilizes contrastive generation, where an LLM rewrites safe text into an unsafe variant that violates a target category, but deliberately avoids altering its sibling. This process teaches the model to identify the specific policy being violated, rather than relying on a broad safe/unsafe split. The training dataset comprises approximately 54.1 million samples, including 45.2 million open-source text, 4.4 million synthetic contrastive text, and 4.5 million multimodal data.

DATA PREPARATION AND MODEL TRAINING
The data preparation process utilizes a template-based unification layer to convert datasets into a consistent instruction–query–document format via per-dataset processors. Randomized phrasings and calibrated strictness (strict for adversarial jailbreaks, lenient for response-quality data) are applied. The model is primarily trained using LoRA fine-tuning, followed by a three-way SLERP merge: 0.6 public+generated, 0.3 public-only, and 0.1 Mistral-3B-Instruct.

COMPARATIVE PERFORMANCE ACROSS BENCHMARKS
Shieldstral demonstrates strong performance across several benchmarks. On text safety, it matches GPT-OSS-Safeguard-20B (84.9%) on ToxicChat, HarmBench, and Aegis v2 response, achieving wins on all three. On multimodal safety, it outperforms OmniGuard-7B (83.8%) and VLGuard (97.7) and UnsafeBench (81.8). In the adaptability benchmark, Shieldstral achieves 91.3% F1, trailing GPT-OSS-Safeguard-20B (94.1%) and Nemotron-3.5-Safety-4B (91.8%) but without generating a reasoning trace. Refusal detection reaches 91.5% against GPT-OSS-Safeguard-20B's 93.7%. Weaknesses are observed in multilingual prompt classification, particularly for Arabic and Indonesian, and on RTP-LX prompts.

CONTEXT WINDOW, LANGUAGE SUPPORT, AND TRAINING DETAILS
Shieldstral is trained with a 32k token context window across 12 languages. The training process involves a combination of LoRA fine-tuning and a three-way SLERP merge, utilizing public and generated data, public-only data, and Mistral-3B-Instruct data.

RESOURCES AND COMMUNITY SUPPORT
Further information can be found in the Paper, Model on Hugging Face, and Technical Details. The community is encouraged to follow Mistral AI on Twitter and join the 150k+ ML SubReddit and Subscribe to the Newsletter. Additionally, opportunities exist to partner with Mistral AI for promoting GitHub Repos, Hugging Face Pages, Product Releases, or Webinars.