Read time: ~8 minutes. TL;DR — serve it in two commands:

pip install vllm --upgrade                       # needs vllm >= 0.26.0
vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768

Fits in 16 GB of VRAM in BF16. Then send a <Instruct> / <Query> / <Document> message and read the yes/no logprobs to get a continuous score.

Key facts:

• Shieldstral 1.0 3B — Apache 2.0, built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder.
• Policy-adaptive: you supply the moderation rule as a natural-language yes/no question at inference time — one checkpoint handles new policies without retraining.
• Multimodal: text-only, image-only, or text+image, through one interface.
• Single forward pass → one yes/no token, which you convert into a continuous, thresholdable score.
• 12 languages; trained to 32k context (256k theoretical — stay within training range).
• Beats GPT-OSS-Safeguard-20B and LlamaGuard-4-12B on several benchmarks at 1/7th the size.

Sourcing note: every command, number, and prompt rule below is from the official mistralai/Shieldstral-1.0-3B model card (fetched August 8, 2026). Benchmarks are Mistral’s own reported results. Links at the bottom.

Most “guardrail” models hand you a fixed list of categories and hope it matches your product. Shieldstral inverts that: you write the policy as a plain-English yes/no question at call time, and a 3B model answers it. That makes it genuinely re-targetable — and small enough to run next to your app. Here’s how to set it up and, more importantly, how to prompt it so it actually works.

---

1. What makes it different

Shieldstral is a 3B-parameter, policy-adaptive multimodal safety classifier. From the model card:

Instead of predicting a fixed set of moderation categories, Shieldstral evaluates content against a safety policy expressed in natural language and returns a single continuous safety score.

The practical consequences:

• New policy = new prompt, not new training. Ship a rule change without a fine-tuning run.
• One interface for text, image, or text+image (native Pixtral vision encoder).
• One forward pass. It emits a single yes/no token — cheap and fast enough for real-time gating.
• Apache 2.0, commercial use included.
• 12 languages: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, Russian.
• Context: trained on sequences up to 32k. Mistral notes it theoretically supports 256k but recommends staying within the training range.

---

2. Does 3B actually hold up? The benchmarks

Mistral’s reported F1 (%) on prompt classification, against much larger guardrail models:

Benchmark	Shieldstral-3B	GPT-OSS-Safeguard-20B	Qwen3Guard-8B	Nemotron-3.5-CS-4B	LlamaGuard-4-12B	ShieldGemma-9B
WildGuardTest	88.1	87.3	88.2	84.4	74.3	46.0
ToxicChat	84.1	79.8	75.6	72.2	51.0	62.4
Aegis v2	86.2	84.4	84.6	86.3	71.5	65.8
HarmBench	99.4	94.5	99.3	96.1	97.9	50.2
OpenAI Moderation	81.4	84.0	74.7	74.7	73.9	78.6

Honest read: it wins outright on ToxicChat and HarmBench, is within noise of the leader on WildGuardTest and Aegis v2, and loses OpenAI Moderation to GPT-OSS-Safeguard-20B. So it’s not a clean sweep — but landing in that band at 3B vs 20B and 12B is the story, especially when the 20B costs ~7× the memory to serve.

(These are Mistral’s own numbers. Guardrail benchmarks are threshold-sensitive — see §5, where you pick the threshold.)

---

3. Method 1 — vLLM (recommended)

pip install vllm --upgrade        # vllm >= 0.26.0 required
python -c "import mistral_common; print(mistral_common.__version__)"   # need >= 1.11.5

Serve it:

vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768

It fits in 16 GB of VRAM in BF16 — a single consumer/prosumer GPU. Default endpoint is localhost:8000.

---

4. Method 2 — llama.cpp (CPU / Mac / any backend)

Build llama.cpp:

git clone https://github.com/ggml-org/llama.cpp
cd llama.cpp
cmake -B build
cmake --build build --config Release -j $(nproc)

(Add -DGGML_CUDA=ON for CUDA; Metal/Vulkan/ROCm/SYCL are documented in llama.cpp’s build docs.)

Shieldstral converts from the Mistral format, so install the conversion deps:

pip install -r requirements/requirements-convert_hf_to_gguf.txt
pip install "mistral-common>=1.11.5"

Download (you can skip model.safetensors — only Mistral-format weights are needed):

hf download mistralai/Shieldstral-1.0-3B \
    --exclude "model.safetensors" \
    --local-dir Shieldstral-1.0-3B

Convert the language model:

python convert_hf_to_gguf.py Shieldstral-1.0-3B \
    --mistral-format \
    --outtype bf16 \
    --outfile Shieldstral-1.0-3B-BF16.gguf

For image moderation you also need the vision projector as a separate file:

python convert_hf_to_gguf.py Shieldstral-1.0-3B \
    --mistral-format \
    --mmproj \
    --outtype bf16 \
    --outfile .

That writes mmproj-Shieldstral-1.0-3b-BF16.gguf. Both files are needed for image moderation; the language model alone is enough for text-only. You can quantize the language model to shrink it — leave the mmproj file as-is.

SGLang and Transformers are also supported, and you can fine-tune with Axolotl (Mistral ships a Shieldstral example).

---

5. The part that actually decides your results: the prompt

Shieldstral reduces moderation to a binary QA task. Every call is a fixed system message plus a structured user message.

System message (fixed — use verbatim):

Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be "yes" or "no".

User message (this is where your policy lives) — three fields:

• <Instruct> — evaluation context and strictness. Keep it constant across a product surface.
• <Query> — a single yes/no question about the document.
• <Document> — the content: a prompt, a response, a prompt–response pair, or an image.

A complete example from the model card:

<Instruct>: You are a strict safety moderator reviewing potentially harmful content. Apply a low tolerance threshold.

<Query>: Does this content promote physical violence?

<Document>: [User]
How can I hurt someone without being caught?

[Assistant]
Sure, I can help with that…

The four rules that make or break it (straight from Mistral):

1. One policy per query. It answers one yes/no question per call — issue separate calls for separate policies, don’t stack them.
2. Put context, strictness, and categories in <Instruct>. Set tolerance (strict/moderate/lenient) and optionally the categories to watch (“across violence, hate speech, sexual content, self-harm, and criminal activity”). Keep it stable.
3. <Query> must be a yes/no question — “Does this text describe deliberate physical harm?” — not a keyword, statement, or abstract label.
4. For a broad safe/unsafe verdict, list the categories in <Instruct> and ask one wide <Query> like “Is this content unsafe?”.

For prompt–response documents, any consistent delimiter works ([User] … [Assistant] …) — it was trained on diverse formats.

---

6. Turning yes/no into a score you can threshold

This is the implementation detail people miss. Shieldstral emits a single token. To get a continuous score, per the model card:

call the chat endpoint with max_tokens=1 and token logprobs (logprobs=True, top_logprobs=20), then renormalise the yes and no probabilities.

So: score = P(yes) / (P(yes) + P(no)), and you choose the cutoff. That’s a feature — you can tune precision/recall per surface (strict on public UGC, lenient on internal tools) without touching the model.

It also means benchmark F1 numbers depend on threshold choice — calibrate on your own labelled sample before trusting any published figure, including §2’s.

---

7. Where this fits

Good fit:

• Real-time gating of user prompts and model responses in your own app.
• Edge / low-resource deployment — 3B on one GPU, or llama.cpp on CPU/Mac.
• Policies that change — marketplace rules, regional requirements, per-tenant settings.
• Refusal classification (detecting whether your model refused) — an explicit listed use case.

Not a fit:

• Multi-label classification in one shot — it’s one question per call by design.
• A complete trust-and-safety system — it’s a classifier, not policy enforcement, logging, or appeals.
• Blind trust at a default threshold — calibrate first (§6).

The takeaway

Shieldstral 1.0 3B is the rare guardrail model you can both re-target in plain English and actually run yourself: Apache 2.0, 16 GB VRAM in BF16, vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768, or llama.cpp with a separate mmproj file if you need image moderation. It beats GPT-OSS-Safeguard-20B and LlamaGuard-4-12B on several benchmarks at a fraction of the size. The setup is the easy part — the results come from the prompt: one policy per <Query>, phrased as a yes/no question, with strictness in <Instruct> — and from reading yes/no logprobs with max_tokens=1, top_logprobs=20 so you can pick your own threshold.

For other small models worth running locally, see Gemma 4 12B, NuExtract 3 for structured extraction, and Leanstral 1.5.

Sources

• mistralai/Shieldstral-1.0-3B — Hugging Face model card — 3B policy-adaptive multimodal safety classifier, Apache 2.0, built on Ministral-3-3B-Base-2512 with native Pixtral vision encoder, single-forward-pass yes/no output, 12 languages, 32k trained context (256k theoretical, stay in range); benchmark tables vs GPT-OSS-Safeguard-20B / Qwen3Guard-8B / Nemotron-3.5-Content-Safety-4B / LlamaGuard-4-12B / ShieldGemma-9B; vLLM setup (vllm >= 0.26.0, mistral_common >= 1.11.5, fits 16GB VRAM in BF16, vllm serve … --max-model-len 32768); llama.cpp build, --mistral-format GGUF conversion and separate --mmproj vision projector; scoring via max_tokens=1 + logprobs=True, top_logprobs=20 renormalised over yes/no; prompt structure (<Instruct> / <Query> / <Document>) and prompt-engineering rules; SGLang / Transformers support and Axolotl fine-tuning
• Introducing Shieldstral — Mistral AI — announcement
• Shieldstral technical report — arXiv
• Benchmarks are Mistral’s own reported results and are threshold-sensitive — calibrate on your own labelled data. Verified August 8, 2026.