Shieldstral Takes Your Safety Policy at Inference Time

Mistral released Shieldstral 1.0 on August 4, 2026 — a 3B-parameter, Apache 2.0 guard model that takes a plain-language safety policy as prompt text at inference time rather than baking a fixed set of harm categories into its weights. It evaluates text and images in a single pass, it is on Hugging Face, and it is small enough to sit inline in a request path on one GPU.

That shape matters more than the model does. A fixed content-moderation endpoint assumes one policy for every caller. An agent stack does not have one policy — it has a different one per tool, per tenant, and per surface, and those policies change on product timelines rather than model-training timelines. A guard model whose policy lives in the prompt is the first widely available component built for that reality.

This guide covers what actually shipped, the input format and scoring mechanic in concrete terms, and an honest row-by-row read of Mistral’s own benchmark tables — which show a mixed picture, not the clean sweep the announcement’s headline sentence implies. Everything below is sourced from Mistral’s announcement and the Hugging Face model card, with the gaps in that evidence called out where they exist.

Shieldstral 1.0 is a 3B-parameter, policy-adaptive, multimodal safety classifier released as open weights. The Hugging Face model card gives the lineage directly: it is built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder, which is what lets a single evaluation take text, an image, or both together rather than routing images to a separate classifier.

The license is the part worth reading twice. Apache 2.0 covers both commercial and non-commercial use, which puts Shieldstral in a different bucket from guard models released under bespoke community-licence terms. For teams that need a moderation layer to run inside their own perimeter — regulated sectors, data-residency obligations, or simply a refusal to route user content through a third party — that combination of a permissive licence and a 16GB footprint is the whole story.

Most coverage describes Shieldstral’s input format in the abstract. The concrete version is available verbatim from the model card and is worth walking through, because the plumbing is where the design decision actually lives.

Each request carries a fixed system message plus a user message built from three parts. The system message, verbatim from the model card:

Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be 'yes' or 'no'.

The user message then supplies the three adaptive fields:

• <Instruct> — the evaluation context and the strictness level. This is where your policy actually goes, in plain language.
• <Query> — a single yes/no question about the content, scoped to one thing you want decided.
• <Document> — the content under evaluation: text, an image, or both in the same call.

The output side is equally spare. The model card’s reference implementation calls the model with a single-token generation budget, requests log probabilities, and renormalizes the probabilities of the yes and no tokens into a continuous safety score. That score is then thresholded — Mistral uses 0.5 in its own benchmark tables.

The practical consequence is that you are not stuck with a binary. Because the raw output is a calibrated score rather than a label, you can set different thresholds per surface: aggressive on a public comment field, permissive on an internal drafting tool, somewhere in between on a customer-facing agent. That is a materially different operating model from a fixed endpoint that returns category flags you cannot tune. Our production safety-layer reference covers where a scored classifier sits relative to the other layers in a defended stack.

The claim that one checkpoint generalises to policies it has never seen needs a training story, and Mistral gives a partial one. The policy-adaptability component is trained on generated data built around rewrite pairs that the announcement describes as engineered to violate one policy but not its sibling — teaching the model to distinguish which specific policy a piece of content violates rather than whether it is broadly unsafe. Mistral says that discrimination is what transfers to unseen, user-defined policies at inference time.

That is a sharper framing than it first appears. Most safety classifiers are trained to answer a coarse question — is this harmful — and then have categories layered on top. Training on pairs that are deliberately near-identical except for which rule they break forces the model to attend to the rule text itself rather than to surface features of harmful content. If the mechanism works as described, it is the reason a policy written by your trust-and-safety team on a Tuesday can be enforced by the same weights on Wednesday.

The final model is described as a merge: a fine-grained policy-discrimination component trained on generated data, merged with the base instruct model, which Mistral says recovers common policy calibration and policy adaptability in a single model while instruction-following ability transfers from the base. Mistral also states it built Shieldstral end to end on its own Forge tooling; we have not examined Forge and make no claims about it beyond that.

Every piece of coverage we found repeats one sentence from the announcement and stops there. Here it is verbatim, and then here is what Mistral’s own tables say underneath it.

Mistral publishes five benchmark tables on the Hugging Face model card — text safety by prompt classification, text safety by response classification, multilingual, refusal detection, and multimodal safety. Across those tables we counted 21 rows in which Shieldstral appears alongside at least one competitor. The scorecard below is our tally of those rows, not a Mistral-published summary; Mistral states no averages anywhere on either page.

Splitting the 21 rows three ways makes the picture legible. Six rows are outright Shieldstral wins. Six more are rows where Shieldstral trails by a margin — 0.1 to 0.9 of an F1 point — that is well inside the noise of any single evaluation and is fairly described as a match. The remaining nine are rows where Shieldstral trails by more than a full point, five of them by more than 2.5.

So the honest version of the headline is this: a 3B model that leads outright on about a quarter of the rows its vendor chose to publish, matches on another quarter, and trails on the rest, against comparators up to roughly seven times its size. That is a genuinely impressive result for the parameter count. It is not the clean sweep a reader would take from the announcement sentence, and the distribution is not random — Shieldstral is strongest exactly where multimodal capability is the differentiator and weakest on multilingual and refusal detection, which are the two categories where a fixed-category classifier trained at scale has the most advantage.

The one row that deserves singling out is Aegis v2 response classification, where Shieldstral posts 87.2 against GPT-OSS-Safeguard-20B’s 75.2 — a twelve-point margin, the largest in either direction across the two text-safety tables. A gap that size from a model one-seventh the size is not a rounding artefact; it is the policy-adaptability training showing up in a benchmark that rewards it.

The model card’s footnotes are load-bearing and almost nobody quotes them. GPT-OSS-Safeguard-20B’s numbers are produced with reasoning effort set to high. Nemotron-3.5’s are produced with reasoning effort set to none for default categories. ShieldGemma and Shieldstral both use a fixed 0.5 threshold. Qwen3Guard’s numbers are averaged over its strict and loose unsafe-mapping settings.

Those are four different operating points, not a level playing field. Each competitor is represented at a configuration Mistral chose for it, which is not necessarily that model’s best achievable setting — and reasoning effort in particular changes both the score and the cost per call by a large factor. A 20B model running at high reasoning effort and a 3B model emitting one token are not comparable on latency or spend, and neither page attempts to make that comparison. Since no source states throughput or latency figures for Shieldstral, we are not going to invent them either.

The same discipline applies to the accompanying technical report. Both the announcement and the model card link one on arXiv. We have not read it, so nothing on this page is attributed to it — if you need the training details in depth, that is where to go, and you should expect it to contain claims this page does not make.

A fixed moderation endpoint encodes an assumption that stopped being true somewhere around the point agent stacks became normal: that one policy is correct for every caller. It is not. A support agent reading customer email, an internal research agent reading a competitor’s filings, and a public-facing content agent generating marketing copy have genuinely different tolerances for the same input, and the correct answer for one is the wrong answer for the others.

That per-surface variance is exactly what Anthropic’s own published classifier data makes concrete — see the per-surface classifier evidence Anthropic published for that argument in its own terms. The point that carries over here is structural: if the false-positive picture differs by surface, a single global policy is not a simplification, it is a defect. A guard model whose policy is an argument rather than a property of the weights is the component shape that follows from accepting that.

Worth being precise about scope: a guard model is a content classifier, not an injection defence. It answers whether a document violates a stated policy. It does not answer whether an instruction embedded in that document will hijack your agent, which is a different failure mode requiring different controls — a layered prompt-injection defence framework covers that side. Treating a policy classifier as an injection defence is a common and expensive category error. For the wider picture of where classification sits in a trust-and-safety operation, our content-moderation and trust-and-safety guide walks the full stack.

The model card lists vLLM as the recommended runtime, requiring vLLM 0.26.0 or newer, alongside llama.cpp with GGUF quantization, SGLang, and Transformers. Fine-tuning is supported via Axolotl, with a dedicated example in Axolotl’s own repository. Specific GGUF quantization levels circulate in secondary coverage; we would treat the framework support as confirmed and the exact quant levels as something to check against the repository before you plan around them.

Every number on this page originates with Mistral. At the time of writing we could not find third-party replication of any of the benchmark tables, which is the normal state of affairs in the first week after a model release and is also the reason the tables should be read as a hypothesis about how the model will behave rather than as a result you can plan a rollout around.

The evaluation that actually matters is not on the model card anyway. Every benchmark here measures Shieldstral against policies it was benchmarked on; the entire product claim is that it generalises to policies it has never seen — specifically yours. That is the one thing the published tables structurally cannot tell you, and it is the one thing a half-day of work can. Write your real policy into the instruction field, assemble a couple of hundred labelled examples from your own traffic including the edge cases your team argues about, and measure the score distribution before you pick a threshold.

Our projection for the next two quarters: policy-in-the-prompt becomes the default shape for guard models rather than a differentiator, and the competitive axis moves to calibration quality — how stable the score is as the policy text is rephrased. That is the failure mode nobody is benchmarking yet, and it is the one that will bite in production, because policy text gets edited by people who are not thinking about model behaviour when they edit it. A team that starts measuring rephrasing stability now will be ahead of the tooling. If you want that evaluation designed and run against your own content rather than a public benchmark, our AI transformation engagements start with exactly this kind of comparative work.