Shieldstral 1.0 3B: How to Run Mistral's New AI Safety Classifier Locally

What You'll Learn

• Why Shieldstral's question-based moderation beats fixed harm taxonomies
• How the Instruct-Query-Document format works for text, images, and combined inputs
• Verified benchmark numbers against guard models up to 7x its size
• Step-by-step local setup with vLLM, llama.cpp, SGLang, and Transformers

What Is Shieldstral 1.0 3B?

The Shieldstral 1.0 3B is Mistral AI's new open-weights model for content safety, released on August 4, 2026. It is not a chatbot. It is a policy-adaptive multimodal safety classifier that checks AI prompts, model responses, and images for harmful content. Mistral built it on the Ministral-3-3B-Base-2512 checkpoint with a native Pixtral vision encoder, so one small model handles text-only, image-only, and text-plus-image moderation.

The model is open weights under the Apache 2.0 license, which means both commercial and non-commercial use is allowed. It is an inaugural member of the Open Secure AI Alliance, a group Mistral joined alongside NVIDIA and other organizations. The weights are available on Hugging Face as mistralai/Shieldstral-1.0-3B, and the technical report is published on arXiv. This is a similar move to the one Mistral made with its Mistral Small 4 release, where one compact model replaced several specialized ones.

How Shieldstral Works: Moderation as a Question

Most guardrail models, such as Llama Guard, bake a fixed taxonomy of harm categories into their weights. Re-targeting them to a new deployment context means retraining. Shieldstral inverts this approach. It frames content moderation as a binary question-answering task, and each request has three parts.

The Instruct field carries the evaluation context and strictness level, such as "You are a strict safety moderator. Apply a low tolerance threshold." The Query is a single yes or no question, for example "Does this content promote physical violence?" The Document is the content to judge: a prompt, a response, a prompt-response pair, or an image with optional text. At inference, the model reads out only the yes and no logits and softmax-normalizes them into a continuous safety score from a single forward pass.

This formulation unifies prompt classification, response moderation, refusal detection, and toxicity detection into one problem. Policies live entirely in the prompt, so a single checkpoint adapts to novel policies at deployment time without retraining. Mistral trained it on real and synthetic data with diverse label formats, using contrastive pairs so the model learns which specific policy a piece of content violates. The company also combined three LoRA checkpoints through SLERP merging, built end to end on its Forge training platform.

Shieldstral Benchmarks: Matches Models 7x Its Size

Mistral evaluated Shieldstral against open guard models up to seven times its size across four axes: text safety, refusal detection, policy adaptability, and multimodal safety. All evaluation samples were held out from training. The headline claim is that the 3B model matches or outperforms much larger models, and the numbers back it up.

On prompt classification, Shieldstral scores 88.1 F1 on WildGuardTest and 99.4 F1 on HarmBench. On response classification, it hits 85.0 F1 on BeaverTails and 87.2 F1 on Aegis v2. For refusal detection, it scores 90.3 F1 on WildGuardTest and 94.6 F1 on XSTest. Its strongest area is multimodal safety, where it scores 97.7 F1 on VLGuard and 81.8 F1 on UnsafeBench, beating every larger model in the comparison, including OmniGuard-7B and Nemotron-3.5-Safety-4B.

Shieldstral vs Llama Guard and Other Guardrails

How does a 3B model compare with the established guardrail lineup? The table below uses prompt-classification F1 scores from the official Shieldstral model card, where higher is better. Shieldstral wins or ties on most benchmarks while running on a fraction of the memory.

Llama Guard, Meta's well-known guardrail, classifies content against a fixed 14-category hazard taxonomy. Shieldstral's advantage is that you can change the policy without touching the weights: swap the Query and the same checkpoint enforces a different rule set. That flexibility is why Mistral positions it for lightweight, real-time moderation on edge and low-resource devices, a category that also matters when you run local AI without an NVIDIA GPU.

How to Run Shieldstral Locally

Shieldstral fits in 16GB of VRAM in BF16, so a single consumer GPU is enough. The official model card recommends vLLM, and vLLM shipped day-0 support for the model. Install vLLM 0.26.0 or newer, which automatically installs mistral_common 1.11.5 or newer, then serve the model with this command.

vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768

The model emits a single yes or no token. To get a continuous safety score, call the chat endpoint with max_tokens=1 and top_logprobs=20, then renormalize the yes and no probabilities. A score above 0.5 flags the content as unsafe. A complete text moderation example sends a system message that says the answer can only be yes or no, followed by a user message with the Instruct, Query, and Document fields.

For image moderation, the user content is a text-image-text sandwich: the Instruct and Query prefix, then the image as a base64 data URI, then any trailing caption. The model judges the combined content in one pass. If you prefer other runtimes, the model card documents llama.cpp with a GGUF conversion plus a separate mmproj file for the vision encoder, SGLang from the main branch, and plain Transformers with mistral-common. Each runtime exposes an OpenAI-compatible endpoint, so the same moderation code works everywhere.

Use Cases and Limitations

Shieldstral is aimed at real-time safety screening. Practical uses include moderating user prompts before they reach a large model, checking model responses before they are shown to users, classifying refusals, and screening images on platforms that accept user uploads. The same guardrail logic applies when you build agentic AI systems that act autonomously. Its 12-language support covers English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, and Russian, and it was trained on sequences up to 32k tokens.

There are real limits. Coverage varies across languages and domains that are unevenly represented in the training data. Residual label noise remains in the synthetic and public safety data despite multi-model verification. Adversarial, encoded, or transliterated inputs and very long documents can reduce reliability. Mistral says it is working on multilingual coverage, longer-document robustness, and broader multimodal safety next, and the community is expected to build on the open weights.

The Bottom Line

Shieldstral 1.0 3B makes a strong case that small, policy-adaptive guardrails can replace heavyweight moderation stacks. It matches models up to seven times its size on text safety, sets a new state of the art on multimodal benchmarks, and runs on a single 16GB GPU. The Apache 2.0 license and day-0 vLLM support lower the barrier for teams that want production-grade safety screening without a fixed taxonomy.

For developers, the practical next step is to serve the model with vLLM and test your own policies as plain-language queries. For the wider ecosystem, the direction is clear: moderation that adapts to context instead of forcing every product through one frozen set of categories. As Mistral continues to push multilingual and multimodal coverage, this model is worth watching, especially if you are exploring how to build AI agents or comparing top AI agents for production work.