Mistral AI Releases Shieldstral 1.0 3B: An Open-Weights Policy-Adaptive Multimodal Safety Classifier Matching Models 7× Its Size

Mistral AI has launched Shieldstral 1.0 3B, an open-weights, policy-adaptive multimodal security classifier that treats content material moderation as a single sure/no query relatively than a hard and fast taxonomy of hurt classes. Most guardrail fashions bake their class listing into the weights, so re-targeting one to a brand new deployment context means retraining — and the identical content material could be acceptable on a cybersecurity analysis instrument whereas being dangerous on a mental-health platform. Shieldstral inverts that: operators write the coverage as a plain-language query at inference time, and the mannequin returns a calibrated security rating from a single ahead move. Built on Ministral-3-3B-Base-2512 with a local Pixtral imaginative and prescient encoder and launched underneath Apache 2.0, it reviews 84.9% common F1 on textual content security — matching GPT-OSS-Safeguard-20B — and 83.8% on multimodal security, forward of each baseline Mistral evaluated.

Is it deployable?

Yes, and regionally. Shieldstral-1.0-3B suits in 16GB of VRAM in BF16, runs on a single GPU, and is licensed Apache 2.0 for industrial and non-commercial use. Serving paths are already in place: vLLM (≥0.26.0, beneficial), llama.cpp through GGUF conversion with Q8_0/Q5_K_M/Q4_K_M quantization, SGLang, and Transformers — with fine-tuning supported by way of Axolotl. The classifier emits one token, so latency and value sit far beneath reasoning-based guards like GPT-OSS-Safeguard-20B.

• Which degree of firm: the 16GB footprint places it inside attain of seed-stage AI product groups that can’t justify a moderation vendor contract, whereas the open license and self-hosting story go well with mid-market and enterprise groups that want guardrails inside a VPC or on-prem for data-residency and audit causes. Multi-tenant SaaS distributors get a selected win — one checkpoint can implement a unique coverage per buyer.
• Industries: shopper social and UGC platforms, ed-tech and child-safety surfaces, healthcare and mental-health apps, fintech and insurance coverage assist automation, gaming and voice chat, marketplaces and advert/artistic assessment, and public sector deployments with sovereignty necessities.
• Applications: user-prompt moderation, model-response moderation, refusal classification, image-plus-caption assessment for adverts and memes, training-data and RAG-corpus curation, output gating in agentic pipelines, and per-tenant coverage enforcement. Because the output is a steady rating relatively than a label, groups can tune the edge per floor or route borderline scores to human assessment as an alternative of hard-blocking.

Moderation as a binary query

Shieldstral reduces moderation to at least one sure/no query. A set system message establishes the duty; the person message carries three fields: <Instruct> (analysis context and strictness), <Query> (the coverage, phrased as a single sure/no query), and <Document> (a immediate, a response, a immediate–response pair, or a picture with non-obligatory textual content).

At inference the mannequin unembeds solely towards the sure and no token IDs and softmax-normalizes them right into a steady rating, thresholded at τ=0.5. That collapses immediate classification, response moderation, refusal detection, and toxicity detection into one drawback — and it means the coverage lives solely within the immediate. Mistral’s steering is one coverage per name; for a broad protected/unsafe verdict, listing the classes in <Instruct> and ask a single vast <Query>.

The knowledge recipe

The claimed benefit comes from knowledge, not scale: roughly 54.1M samples — 45.2M open-source textual content, 4.4M artificial contrastive textual content, 4.5M multimodal. A template-based unification layer converts each dataset into the identical instruction–question–doc format through per-dataset processors, with randomized phrasings and calibrated strictness (strict for adversarial jailbreaks, lenient for response-quality knowledge).

The extra fascinating piece is contrastive era. An LLM rewrites protected textual content into an unsafe variant that violates a goal class however intentionally not its sibling, producing a constructive and a tough detrimental over equivalent content material in a single name. That teaches the mannequin which coverage is violated relatively than a rough protected/unsafe break up. Image knowledge — which can’t be synthesized the way in which textual content can — is supplemented with general-purpose picture datasets as negatives, question mutation throughout a 14-subcategory visible taxonomy, and imaginative and prescient–language reranker filtering.

Training is LoRA fine-tuning adopted by a three-way SLERP merge: 0.6 public+generated, 0.3 public-only, 0.1 Ministral-3B-Instruct.

Results

On textual content security, Shieldstral reviews 84.9% common F1, tying GPT-OSS-Safeguard-20B (84.9%) because the smallest mannequin within the comparability, with wins on ToxicChat (84.1), HarmBench (99.4), and Aegis v2 response (87.2). On multimodal security it reviews 83.8% general versus 77.6% for OmniGuard-7B, main VLGuard (97.7) and UnsafeBench (81.8); LlavaGuard-7B nonetheless leads its namesake benchmark at 81.4.

On the adaptability benchmark — constructed on a intentionally divergent taxonomy of 12 tremendous lessons, 26 subcategories, and 52 leaf classes with 90 fastened queries, the place no leaf maps one-to-one to coaching — Shieldstral scores 91.3% F1, behind GPT-OSS-Safeguard-20B (94.1%) and Nemotron-3.5-Safety-4B (91.8%), however with out producing a reasoning hint. Refusal detection lands at 91.5% general towards 93.7% for GPT-OSS-Safeguard-20B.

Where it’s weaker: multilingual immediate classification lags on Arabic and Indonesian and on RTP-LX prompts (70.3 vs 86.1 for Nemotron-3.5-Safety-4B). Mistral additionally flags lowered reliability on adversarial or obfuscated inputs and really lengthy paperwork. Trained context is 32k tokens throughout 12 languages.