Mistral's Shieldstral is a 3B Apache-2.0 guard model that takes your policy as a plain-English question

Mistral released Shieldstral 1.0 3B on August 4, 2026. (Source: Mistral AI, 2026-08-04) It is an open-weights multimodal safety classifier, and it ships under Apache 2.0 — commercial use included.

Key facts:

• The model is 3B parameters. It is built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder. (Source: Mistral model card, retrieved 2026-08-05)
• The license is Apache 2.0. No gating on commercial deployment.
• It fits in 16GB of VRAM in BF16. Mistral’s own serve instruction is vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768.
• Overall text-safety F1 is 84.9%, across 13 benchmarks spanning 45 languages — exactly tied with GPT-OSS-Safeguard-20B, a model roughly 7× its size. (Source: Mistral AI, 2026-08-04)
• Multimodal safety F1 is 83.8%, ahead of OmniGuard-7B (77.6), Nemotron-3.5-Content-Safety-4B (73.9), LlavaGuard-7B (71.6), ShieldGemma-2-4B (57.5) and LlamaGuard-4-12B (37.5).
• Refusal-detection F1 is 91.5%, second to GPT-OSS-Safeguard-20B’s 93.7%.
• The context window used in training is 32k tokens. Mistral notes it theoretically supports 256k but recommends staying inside the training range.
• 12 languages are listed as supported: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, Russian.
• The API model id is shieldstral-1-0, currently in public preview on Mistral’s platform. (Source: Mistral docs model card, retrieved 2026-08-05)

What this means if you’re building an AI product that needs a moderation layer

The interesting part is not the benchmark. It’s that Shieldstral throws out the fixed category taxonomy that every previous guard model was built around.

1. Your policy is a prompt, not a fine-tune. LlamaGuard, ShieldGemma and friends classify into a category list baked in at training time. If your actual policy is “don’t let users ask our cooking app for pharmacology advice,” you either bend it into someone else’s S6: Specialized Advice bucket or you fine-tune. Shieldstral takes three fields — <Instruct> for context and strictness, <Query> for one yes/no question, <Document> for the content — and answers that question. New policy on Tuesday means new string on Tuesday.

2. The output is a single token, so the cost model is unusually good. The model emits one yes/no token; you call with max_tokens=1, read the top logprobs, and softmax the yes/no pair into a 0-1 score. Threshold at 0.5. That means one forward pass per policy check, a real number you can tune per surface rather than a hard label, and latency that is prefill-bound rather than decode-bound.

3. The catch is one query per policy. Mistral is explicit: “Shieldstral answers a single yes/no question per call. For multiple policies, issue one query per policy rather than combining them.” If you’re screening against eight categories, that’s eight calls — or you follow their other suggestion and list categories in <Instruct> with a single broad <Query> like “Is this prompt unsafe?”, trading granularity for one call. Budget accordingly; a 3B model on your own GPU makes the fan-out affordable in a way a hosted moderation API does not.

One number to watch. There is a documentation discrepancy worth flagging: Mistral’s docs page lists Shieldstral 1.0 at 3.8B parameters, while the Hugging Face model card and the repo name (Shieldstral-1.0-3B) say 3B. Size your VRAM from the 16GB BF16 figure Mistral gives for serving, not from the parameter count.

Mistral also names the weak spots in the model card: reliability varies by language and domain, adversarial or transliterated text degrades it, and very long documents reduce accuracy. Every benchmark above is vendor-reported. Run it against your own flagged-content log before you put it in the request path.

If you want the general pattern for standing up a small open-weights model locally with vLLM and hitting it from your own code, our guide to running NuExtract 3 locally walks the same shape end to end. For picking the generation model that sits behind the guard, see Gemini 3.5 Flash and how to run GLM-5.2 locally.

Sources

• Shieldstral: a compact multimodal moderation model — Mistral AI, 2026-08-04
• mistralai/Shieldstral-1.0-3B model card (benchmarks, vLLM / llama.cpp / transformers usage, policy format) — Hugging Face
• Shieldstral 1.0 model card (API id, 32k context, public preview status) — Mistral docs