Mistral AI Releases Shieldstral-1.0-3B, a 3B-Parameter Policy-Adaptive Safety Classifier

Mistral AI has released Shieldstral-1.0-3B, an open-weight, policy-adaptive safety classifier that moderates text, images, and combined text-image content without requiring retraining for new moderation policies. The model is available now on Hugging Face under an Apache 2.0 license.

What's different

Most content-moderation models predict against a fixed set of hardcoded categories (violence, hate speech, self-harm, etc.). Shieldstral instead takes a safety policy written in natural language as part of its input at inference time and returns a single continuous safety score. According to Mistral, this lets one checkpoint handle novel policies without retraining — a single system prompt plus a query/document pair produces a yes/no verdict in one forward pass.

The model is built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder, giving it a shared interface for text-only, image-only, and text+image moderation. It was trained on sequences up to 32,000 tokens; Mistral states it theoretically supports a 256K context window but recommends staying within the 32K training range. Shieldstral supports 12 languages: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, and Russian.

At 3B parameters, the model fits in 16GB of VRAM in BF16 and can be served with vLLM (recommended, requiring vllm >= 0.26.0), llama.cpp, SGLang, or Transformers, and fine-tuned with Axolotl.

Benchmark results

Mistral published F1 scores across five benchmark categories comparing Shieldstral-3B against larger models including GPT-OSS-Safeguard-20B, Qwen3Guard-8B, Nemotron-3.5-Content-Safety-4B, LlamaGuard-4-12B, and ShieldGemma-9B.

On prompt classification, Shieldstral scored 99.4 F1 on HarmBench (best of the group), 88.1 on WildGuardTest, and 84.1 on ToxicChat — all top or near-top results. On response classification it posted 87.2 on Aegis v2 and 93.5 on XSTest Harm. On multimodal safety benchmarks, Shieldstral led with 97.7 F1 on VLGuard and 81.8 on UnsafeBench, both ahead of OmniGuard-7B, Nemotron-3.5-Safety-4B, LlavaGuard-7B, ShieldGemma-2-4B, and LlamaGuard-4-12B.

Results were mixed on multilingual benchmarks: Shieldstral trailed Nemotron-3.5-Content-Safety-4B on RTP-LX Prompt (70.3 vs. 86.1) and RTP-LX Completion (93.5 vs. 95.9), and GPT-OSS-Safeguard-20B edged it on refusal detection tasks like WildGuardTest (93.9 vs. 90.3) and XSTest (94.9 vs. 94.6). These figures come directly from Mistral's published benchmark tables and have not been independently verified.

How it works

Each moderation call combines three fields: an <Instruct> field setting evaluation context and strictness, a <Query> phrased as a single yes/no question (e.g., "Does this content promote physical violence?"), and a <Document> containing the content to judge. Mistral recommends issuing one query per policy rather than combining multiple policies into a single call, and provides reference code for extracting a continuous confidence score by renormalizing yes/no token logprobs from a single forward pass.

What this means

Shieldstral targets a real operational gap: most moderation systems require retraining or fine-tuning whenever a platform's policy changes, which is slow and expensive. A model that accepts policy as a runtime parameter could let developers adjust moderation rules — say, tightening thresholds for a new product surface — without touching model weights. Its small size (fits on a single GPU) also makes it viable for edge deployment and real-time filtering pipelines where larger guardrail models like LlamaGuard-4-12B or GPT-OSS-Safeguard-20B would be impractical. The mixed multilingual results, however, suggest the policy-adaptive approach doesn't uniformly outperform fixed-category models trained explicitly for multilingual robustness — buyers evaluating moderation stacks should test against their own language and policy mix rather than relying on aggregate benchmark averages.