Mistral Opens a 3B Moderation Model That Ties GPT-OSS-Safeguard 20B

A content moderation guard model decides whether a user's post or image breaks your service rules. Until now, that decision was baked in at training time. Categories like "violence," "sexual content," and "self-harm" ship inside the weights, and putting your own rule in front of the model meant fine-tuning it again.

Shieldstral 1.0-3B, which Mistral AI released on August 4, 2026, takes the rule as input instead. You write the question in ordinary language at inference time and the model answers yes or no. The weights are Apache 2.0 and downloadable now from Hugging Face.

The policy is a sentence, not a training run

The input has three parts.

Write "Does this post contain medical advice?" into <Query> and that sentence becomes the classification boundary. Mistral describes the design as recasting moderation into yes/no question answering.

The single-token output is where the operational cost shows up. The existing prompt-configurable guards, GPT-OSS-Safeguard (20B) and Nemotron-3.5-Safety, generate a reasoning chain before committing to an answer. That is hundreds of tokens and the matching latency on every judgment. Shieldstral renormalizes the logits of the yes and no tokens into a continuous score between 0 and 1, with a default threshold of 0.5. One forward pass per decision.

The base is Ministral-3B-Base-2512 with a Pixtral vision encoder attached, so text and images go through the same query format. Training used roughly 54.1 million samples: 45.2 million public text, 4.4 million synthetic contrastive pairs, and 4.5 million multimodal.

Where 3B ties 20B, and where it loses

Aggregate text safety F1 is 84.9 across 13 benchmarks. The model that posted the same number has roughly seven times the parameters: GPT-OSS-Safeguard at 20B.

The bottom of that chart is the more interesting part. LlamaGuard-4 (12B) lands at 69.1 and ShieldGemma (9B) at 54.7, three to four times the parameter count and far behind. Both judge through a taxonomy fixed at training time, which costs them on an evaluation spanning 21 splits where each benchmark defines harm differently.

Add images and the gap widens. Multimodal aggregate F1 is 83.8 for Shieldstral against 77.6 for second-place OmniGuard (7B). LlamaGuard-4 (12B) scores 37.5, close to a coin flip on image judgments.

There is a loss column too. On the evaluation that measures policy adaptability against a fine-grained taxonomy, Shieldstral scores 91.3 and GPT-OSS-Safeguard (20B) scores 94.1. A 2.8-point deficit. The paper concedes the gap and argues back on deployment cost, since the 20B builds a reasoning chain before answering. If your rules are genuinely fine-grained and you can absorb the latency, the 20B is still the more accurate judge.

Small specialist models displacing large general ones has shown up in security too. In the case of Microsoft's first security model cutting cost in half, the hard tier stayed with the bigger model, and the same split holds here: fine-grained policy work remains 20B territory.

Input checking and output checking diverge outside English

The model card lists 12 officially supported languages: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, and Russian.

The per-language table in the paper splits those languages by what you point the model at. Prompt classification screens what the user sent. Response classification screens what your model produced. The two numbers are not the same language to language.

The paper states directly that performance drops on prompt classification for lower-resource languages including Arabic and Indonesian. Indonesian is the extreme case at 55.5 against 94.1, a 38.6-point spread on the same language. Korean is not named in that sentence, but it runs the same direction: input checking sits 5.2 points below output checking. If your deployment only screens user input, that gap is the volume you are missing.

Three other limits are stated on the model card. Confidence degrades on adversarially manipulated or obfuscated input, degrades again on very long documents, and training-data bias survives the filtering pipeline.

What you can use today

The missing API is the sharpest constraint on this release. Mistral already runs a separate moderation endpoint at mistral-moderation-latest, but that is a text classifier over a fixed taxonomy and not the same model. There is no path to trying Shieldstral without a GPU right now.

vLLM is the recommended runtime.

vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768

Running through llama.cpp requires a GGUF conversion plus a separately prepared multimodal projector, and the Transformers path needs mistral-common 1.11.5 or newer.

If you already run moderation on a non-English service and you have a GPU, the first job is replaying last week's reported content with your own rules written as sentences in <Query>. Measure false positives and false negatives separately for the input stage and the output stage rather than pooling them, since a pooled number hides whether the prompt-versus-response spread in the table above reproduces on your data. Without a GPU, the signal to start testing is the model identifier and pricing appearing on the Shieldstral row at docs.mistral.ai/models/overview.