Mistral's Shieldstral: 3B open-weights model for multimodal moderation

SolutionsIntroducing Shieldstral.August 4, 2026By Mistral Back to Blog 5 min readShare this post Copy url to clipboardCopied ThinkingSummaryShieldstral introduces a 3B open-weights multimodal safety classifier that outperforms models up to 7x its size by framing content moderation as a policy-adaptive question-answering task. Unlike traditional guardrail models, it accepts plain-language policies at inference time, unifying text and image safety evaluation without retraining. Released under Apache 2.0, it delivers calibrated safety scores across diverse benchmarks while running efficiently on a single 16GB NVIDIA GPU.A 3B open-weights, policy-adaptive multimodal safety classifier that matches models up to 7x its size on text safety and sets a new state of the art on multimodal moderation. “Does this content promote violence against a protected group? Is this image safe to show to a minor? Did the assistant refuse the request?”Every product that ships a model needs to answer questions like these — but the right answer depends on the product, the audience, and the moment. The same content can be fine for a cybersecurity research tool and harmful on a mental-health platform. Most guardrail models bake a fixed taxonomy of harm categories into their weights, so re-targeting them to a new deployment context means retraining. And because safety definitions differ across applications and domains, there is no single "correct" set of categories to model in the first place.Shieldstral takes a different approach: you write the policy as a plain-language question at inference time, and the model returns a calibrated safety score. No retraining, one interface for text and images, and a verdict from a single token. Please refer to our technical report here.As an inaugural member of the Open Secure AI Alliance with NVIDIA and other organizations, today we're releasing Shieldstral as open weights under Apache 2.0, available for download here. Moderation as a questionShieldstral frames content moderation as a binary question-answering task. Each request has three parts:<Instruct> — the evaluation context, strictness, and (optionally) a definition of what counts as unsafe content.<Query> — a single yes/no question, e.g. "Does this content promote physical violence?"<Document> — the content to judge: a prompt, a response, a prompt–response pair, or an image with optional text.At inference the model reads out only the yes and no logits and softmax-normalizes them into a continuous safety score. This one simple formulation does a lot of work: it unifies prompt classification, response moderation, refusal detection, and toxicity detection into a single problem; it lets policies live entirely in the prompt, so one checkpoint adapts to novel policies at deployment time.HighlightsStrong performance — matches or outperforms open guard models up to 7× its size across text safety, refusal detection, policy adaptability, and multimodal benchmarks.Adaptive and flexible — a single natural-language interface covers text, image, and text+image content across prompts, responses, and prompt–response pairs. Policies are supplied as free-form queries and re-targeted at inference time, without retraining.Small, trained on heterogeneous sources — a 3B model that runs on a single 16GB GPU, trained on real and synthetic data with diverse label formats and taxonomies, consolidated into one framework.Continuous safety score — returns a calibrated yes/no probability from a single forward pass, so you can threshold or rank by confidence rather than relying on a discrete label.Open — Apache 2.0 weights.BenchmarksWe evaluate Shieldstral against open guard models up to 7x its size across four axes. All evaluation samples are held out from training.Text safetyRefusal detectionPolicy adaptabilityMultimodal safetyHow we built itThe core idea is that a small model can beat much larger ones if the