Mistral's Shieldstral: 3B open-weights model for multimodal moderation

Mistral’s Shieldstral: 3B open-weights model for multimodal moderation

Introducing Shieldstral. August 4, 2026 By Mistral

Summary

Shieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size by framing content moderation as a policy-adaptive question-answering task. Unlike traditional guardrail models, it accepts plain-language policies at inference time, unifying text and image safety evaluation without retraining. Released under Apache 2.0, it delivers calibrated safety scores across diverse benchmarks while running efficiently on a single 16GB NVIDIA GPU.

Shieldstral 引入了一个 3B 参数的开源权重多模态安全分类器。通过将内容审核定义为“策略自适应问答任务”，它的表现超越了体积为其 7 倍的模型。与传统的护栏（guardrail）模型不同，它在推理时接受自然语言策略，无需重新训练即可统一评估文本和图像的安全性。该模型以 Apache 2.0 协议发布，能够在单个 16GB NVIDIA GPU 上高效运行，并提供跨多种基准测试的校准安全评分。

A 3B open-weights, policy-adaptive multimodal safety classifier that matches models up to 7x its size on text safety and sets a new state of the art on multimodal moderation. “Does this content promote violence against a protected group? Is this image safe to show to a minor? Did the assistant refuse the request?”

这是一个 3B 参数的开源权重、策略自适应多模态安全分类器，在文本安全性方面媲美体积为其 7 倍的模型，并在多模态审核领域树立了新的行业标杆。“这段内容是否煽动了针对受保护群体的暴力？这张图片展示给未成年人是否安全？助手是否拒绝了该请求？”

Every product that ships a model needs to answer questions like these — but the right answer depends on the product, the audience, and the moment. The same content can be fine for a cybersecurity research tool and harmful on a mental-health platform. Most guardrail models bake a fixed taxonomy of harm categories into their weights, so re-targeting them to a new deployment context means retraining. And because safety definitions differ across applications and domains, there is no single “correct” set of categories to model in the first place.

每一款发布模型的产品都需要回答这些问题，但正确的答案取决于产品本身、受众以及具体情境。同样的内容，对于网络安全研究工具来说可能是合适的，但对于心理健康平台来说可能是有害的。大多数护栏模型将固定的危害类别分类体系固化在权重中，因此若要将其重新应用于新的部署环境，通常意味着需要重新训练。此外，由于安全定义在不同应用和领域间存在差异，根本不存在一套单一的“正确”分类体系。

Shieldstral takes a different approach: you write the policy as a plain-language question at inference time, and the model returns a calibrated safety score. No retraining, one interface for text and images, and a verdict from a single token. Please refer to our technical report here.

Shieldstral 采取了不同的方法：你在推理时以自然语言问题的形式编写策略，模型会返回一个校准后的安全评分。无需重新训练，一套接口即可处理文本和图像，并通过单个 Token 输出判定结果。请点击此处查看我们的技术报告。

As an inaugural member of the Open Secure AI Alliance with NVIDIA and other organizations, today we’re releasing Shieldstral as open weights under Apache 2.0, available for download here.

作为与 NVIDIA 及其他组织共同发起的“开放安全 AI 联盟”（Open Secure AI Alliance）的创始成员，我们今天以 Apache 2.0 协议发布 Shieldstral 的开源权重，可在此处下载。

Moderation as a question

Shieldstral frames content moderation as a binary question-answering task. Each request has three parts:

— the evaluation context, strictness, and (optionally) a definition of what counts as unsafe content.
— a single yes/no question, e.g. “Does this content promote physical violence?”
— the content to judge: a prompt, a response, a prompt–response pair, or an image with optional text.

将审核视为问答

Shieldstral 将内容审核定义为二元问答任务。每个请求包含三个部分：

（指令） — 评估背景、严格程度，以及（可选的）对何为不安全内容的定义。
（查询） — 一个简单的“是/否”问题，例如：“这段内容是否煽动了身体暴力？”
（文档） — 待评估的内容：提示词（prompt）、回复、提示词-回复对，或带有可选文本的图像。

At inference the model reads out only the yes and no logits and softmax-normalizes them into a continuous safety score. This one simple formulation does a lot of work: it unifies prompt classification, response moderation, refusal detection, and toxicity detection into a single problem; it lets policies live entirely in the prompt, so one checkpoint adapts to novel policies at deployment time.

在推理时，模型仅读取“是”和“否”的 Logits，并通过 Softmax 归一化将其转换为连续的安全评分。这一简单的公式发挥了巨大作用：它将提示词分类、回复审核、拒绝检测和毒性检测统一为一个问题；它使策略完全存在于提示词中，从而使单个检查点（checkpoint）能够在部署时适应全新的策略。

Highlights

Strong performance — matches or outperforms open guard models up to 7× its size across text safety, refusal detection, policy adaptability, and multimodal benchmarks.
Adaptive and flexible — a single natural-language interface covers text, image, and text+image content across prompts, responses, and prompt–response pairs. Policies are supplied as free-form queries and re-targeted at inference time, without retraining.
Small, trained on heterogeneous sources — a 3B model that runs on a single 16GB GPU, trained on real and synthetic data with diverse label formats and taxonomies, consolidated into one framework.
Continuous safety score — returns a calibrated yes/no probability from a single forward pass, so you can threshold or rank by confidence rather than relying on a discrete label.
Open — Apache 2.0 weights.

亮点

强大的性能 — 在文本安全、拒绝检测、策略适应性和多模态基准测试中，表现媲美甚至超越了体积为其 7 倍的开源护栏模型。
自适应与灵活性 — 单一的自然语言接口涵盖了文本、图像以及文本+图像内容，适用于提示词、回复及提示词-回复对。策略以自由格式查询的形式提供，并在推理时重新定向，无需重新训练。
轻量化，基于异构数据源训练 — 这是一个 3B 参数的模型，可在单个 16GB GPU 上运行，使用具有多种标签格式和分类体系的真实及合成数据进行训练，并整合到一个框架中。
连续安全评分 — 通过单次前向传播返回校准后的“是/否”概率，因此你可以根据置信度设置阈值或进行排序，而无需依赖离散的标签。
开源 — 采用 Apache 2.0 权重。

Benchmarks

We evaluate Shieldstral against open guard models up to 7x its size across four axes. All evaluation samples are held out from training.

Text safety
Refusal detection
Policy adaptability
Multimodal safety

基准测试

我们在四个维度上将 Shieldstral 与体积为其 7 倍的开源护栏模型进行了对比评估。所有评估样本均未包含在训练集中。

文本安全
拒绝检测
策略适应性
多模态安全

How we built it

The core idea is that a small model can beat much larger ones if the data is right. Getting the data right meant solving four problems:

我们是如何构建它的

核心理念是：如果数据处理得当，小模型可以击败大得多的模型。要处理好数据，意味着需要解决四个问题：

Unify heterogeneous data. Public safety datasets disagree on taxonomies, labels, and annotation conventions. We convert every dataset into the same instruction–query–document format with a per-dataset processor, and we vary the wording of instructions, queries, and prompt–response delimiters so the model generalizes across phrasing instead of overfitting to one style. We also calibrate strictness per source — strict for adversarial jailbreaks, lenient for response-quality data — so the model learns calibrated decision boundaries. This lets us consolidate sources that would otherwise be incompatible.
统一异构数据。 公共安全数据集在分类体系、标签和标注规范上各不相同。我们通过针对每个数据集的处理器，将所有数据转换为统一的“指令-查询-文档”格式。我们改变了指令、查询和提示词-回复分隔符的措辞，使模型能够泛化不同的表达方式，而不是过拟合于某种特定风格。我们还针对不同来源校准了严格程度——对对抗性越狱攻击采取严格标准，对回复质量数据采取宽松标准——从而使模型学习到校准后的决策边界。这使我们能够整合原本不兼容的数据源。
Teach discrimination, not memorization. If trained on a fixed set of policy labels, a model learns only to classify those predefined policies. Instead, we construct sets of deliberately similar, easily confused policies and ask an LLM to rewrite safe text into contrastive pairs: each rewrite is engineered to violate one policy but not its sibling. This trains the model to distinguish which specific policy a piece of content violates, a skill that transfers to unseen, user-defined policies at inference time.
教授辨别能力，而非死记硬背。 如果在固定的策略标签集上训练，模型只会学习如何分类那些预定义的策略。相反，我们构建了多组故意相似、容易混淆的策略，并要求大语言模型（LLM）将安全文本重写为对比对：每次重写都旨在违反其中一个策略，但不违反另一个。这训练了模型去区分内容具体违反了哪项策略，这种能力在推理时可以迁移到未见过的、用户自定义的策略上。
Ground safety in images. Unsafe images can’t be synthesized by an LLM the way text can, so visual safety data is scarce. We supplement limited moderation datasets with general-purpose image datasets as high-quality negatives, mutate queries to augment the dataset, and filter every image–query pair through a vision–language reranker to reduce mislabeled data and hallucinations.
将安全性植根于图像。 不安全图像无法像文本那样通过大语言模型合成，因此视觉安全数据非常稀缺。我们利用通用图像数据集作为高质量的负样本来补充有限的审核数据集，通过变异查询来增强数据集，并使用视觉-语言重排序器（reranker）过滤每一对图像-查询，以减少错误标注和幻觉。
Combine complementary checkpoints. We fine-tune with LoRA and merge — via SLERP — a checkpoint calibrated on public data, one that adds fine-grained policy discrimination from generated data, and the base instruct model. The merge recovers common policy calibration and policy adaptability in a single model, and instruction-follow.
结合互补的检查点。 我们使用 LoRA 进行微调，并通过 SLERP 合并了三个检查点：一个在公共数据上校准的检查点、一个增加了生成数据中细粒度策略辨别能力的检查点，以及基础指令模型。这种合并在单个模型中恢复了通用的策略校准和策略适应性，以及指令遵循能力。