Shieldstral 1.0review, pricing and limits

Shieldstral is a 3B-parameter classifier that fits in 16GB of VRAM on a single GPU, with a 32K-token trained context. It suits teams that want a cheap, policy-swappable moderation layer in front of a chatbot or agent, not a general-purpose chat model.

Shieldstral 1.0 is Mistral AI's 3-billion-parameter open-weight safety classifier, released August 4, 2026, scoring 84.9% average F1 on text moderation. It screens text and images against a plain-language policy supplied at inference time, unlike guard models trained on a fixed harm taxonomy.

Provider: Mistral AI · Family: Shieldstral

More about Mistral AI on HokAI

Context window: 32,000 tokens · Max output: 1

Input modalities: text, image · Output: text

About Shieldstral 1.0

Shieldstral 1.0 is a safety classifier built by Mistral AI, the Paris-based AI lab, and released on August 4, 2026 as the company's first dedicated guardrail model. It pairs a 3-billion-parameter language backbone based on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder; Mistral's own API documentation counts the combined model at 3.8 billion parameters once the vision tower is included, and it fits in 16GB of VRAM in BF16 precision on a single GPU. It was built to solve a specific problem: teams running chatbots and agents need a fast, cheap layer that screens prompts, responses, and prompt-response pairs against a safety policy without retraining a classifier every time that policy changes. It sits alongside Mistral's Ministral and Mistral Medium/Large lines as a new, purpose-built model family rather than a variant of an existing chat model. Because Shieldstral is a classifier rather than a general chat or reasoning model, Mistral evaluated it against the guard-model benchmark suite used by rivals instead of SWE-bench or MMLU. On text safety, Shieldstral posts an average F1 of 84.9%, tying OpenAI's GPT-OSS-Safeguard-20B despite being roughly seven times smaller, and beating Qwen3Guard-8B, Nemotron-3.5-Safety-4B, and Meta's LlamaGuard-4-12B. On individual suites it scores 88.1% F1 on WildGuardTest prompt classification, 84.1% on ToxicChat, 99.4% on HarmBench, and 87.2% on Aegis v2 response classification. On multimodal safety, Shieldstral leads every baseline Mistral tested with an average F1 of 83.8%, driven by a 97.7% F1 score on VLGuard against 88.5% for OmniGuard-7B and 59.9% for LlamaGuard-4-12B. Shieldstral was trained and validated on sequences up to 32,000 tokens; Mistral recommends staying inside that range even though the Ministral-3B base it inherits theoretically supports up to 256,000 tokens. Output is unusual for a language model: instead of generating free text, it produces a single yes/no token in one forward pass, softmax-normalized into a continuous, calibrated safety score rather than a hard binary label alone. Shieldstral accepts text, images, or a combined prompt-response pair, and can moderate a prompt alone, a response alone, or the pair together, plus dedicated refusal detection that flags when a model incorrectly refused a benign request. The policy is supplied as a plain-language question at inference time rather than trained into the weights as a fixed harm taxonomy, so one checkpoint enforces different rules for different customers, regions, or products without fine-tuning. It scores 94.6% F1 for refusal detection on XSTest and 91.3% F1 on a fine-grained taxonomy evaluation designed to test generalization to categories it was never explicitly trained on. Mistral has not put a price on Shieldstral. Its own docs show the model listed for Mistral's hosted platform under preview status, but without a published rate, so the open weights on Hugging Face, distributed with no license fee, are the main way to use it today; see the pricing FAQ below for the full picture. Because the weights are open, Shieldstral runs anywhere with enough GPU memory, and Mistral documents serving paths through vLLM (0.26.0 or newer, the recommended path), SGLang, Hugging Face Transformers paired with mistral-common 1.11.5 or newer, and llama.cpp with GGUF quantization for lower-memory deployments. Axolotl support is documented for further fine-tuning. There is no announced availability on AWS Bedrock, Google Vertex AI, or Azure as of release. Shieldstral's training approach is documented in a technical report on arXiv (2607.25857, submitted July 28, 2026): Mistral fine-tuned it with LoRA adapters on 54.1 million samples using sibling-contrastive rewrites, then merged three specialized checkpoints via SLERP, one calibrated on public safety data, one trained for fine-grained policy discrimination on generated data, and the base instruct model. It was built end-to-end on Forge, Mistral's internal training, alignment, and evaluation platform, and released as a founding contribution to the Open Secure AI Alliance, a group that also includes NVIDIA. Shieldstral suits teams that already run a chatbot, agent, or generation pipeline and need a cheap guardrail layer in front of or behind it, especially if that layer has to screen images as well as text, or if the moderation policy changes often enough that retraining a fixed-taxonomy classifier like LlamaGuard is impractical. It is the wrong choice for anyone who needs the model itself to write, explain, or reason in free text, since it emits a single classification token rather than prose. Teams already invested in LlamaGuard, ShieldGemma, or Qwen3Guard need a concrete reason, such as image support or the smaller GPU footprint, to switch, since Shieldstral ties rather than dominates on pure text-only F1. Shieldstral is released under the Apache 2.0 license, permitting commercial and non-commercial use, modification, and redistribution without royalty. Mistral has not published a training-data cutoff date specific to Shieldstral's safety corpus beyond the 54.1 million sample figure, and there is no data-retention policy published because it ships as open weights rather than a hosted, logged service. Supported languages, per the Hugging Face model card, run to twelve: English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Japanese, Korean, Arabic, and Russian.

Pricing

No per-token API price is public for Shieldstral yet. It ships as free, open weights on Hugging Face under a permissive open-source license, with no fee for commercial or non-commercial use. Mistral's docs list a Public Preview model ID (shieldstral-1-0) on La Plateforme, but no rate card is live.

Key Features

• Policy-Adaptive Classification: Operators write the moderation policy as a plain-language question at inference time instead of retraining; the checkpoint scored 91.3% F1 on a fine-grained taxonomy it was never explicitly trained on.
• Native Multimodal Scoring: A built-in Pixtral vision encoder lets Shieldstral classify images and text in one forward pass, scoring 97.7% F1 on VLGuard versus 88.5% for the next-best tested baseline.
• Single-GPU Footprint: Runs inline in a request path on one consumer-class GPU instead of the multi-GPU clusters larger guard models typically need for comparable throughput.
• Calibrated Yes/No Output: Rather than a hard label, Shieldstral softmax-normalizes its single output token into a continuous safety score in one forward pass, giving downstream systems a threshold to tune.
• Open, Permissive Weights: Full weights are published on Hugging Face for free commercial and non-commercial reuse, unlike guard models released under bespoke community licenses.

Pros

• Matches a guard model roughly seven times its size on text-safety F1, without the multi-GPU footprint that size normally requires.
• The only tested guard model in its class that scores natively on images as well as text, leading every multimodal baseline Mistral evaluated.
• Self-hosts on a single consumer-class GPU rather than the multi-GPU clusters larger guard models need.
• Fully permissive open-source licensing lets teams redistribute and modify the weights with zero royalty, unlike guard models under bespoke community licenses.

Cons

• Pricing is unresolved: there is no hosted endpoint yet, so adopting it today means running your own GPU infrastructure.
• The trained context tops out well short of what the base model can theoretically handle, so very long documents need chunking before they're scored.
• A flagged message arrives as a bare score, not a written reason, so teams still need a second model to produce a human-readable explanation.

Benchmarks

• harmbench f1: 99.4
• toxicchat f1: 84.1
• beavertails f1: 85
• unsafebench f1: 81.8
• xstest refusal f1: 94.6
• text safety avg f1: 84.9
• aegis v2 response f1: 87.2
• vlguard multimodal f1: 97.7
• policy adaptability f1: 91.3
• wildguardtest prompt f1: 88.1
• multimodal safety avg f1: 83.8
• wildguardtest refusal f1: 90.3

Visit Shieldstral 1.0 Official Page