What is gpt-oss-safeguard?
gpt-oss-safeguard is a pair of open-weight safety classifiers from OpenAI, released on 29 October 2025 and fine-tuned from gpt-oss. The 20b model has 21B parameters with 3.6B active and fits on a 16 GB GPU; the 120b has 117B with 5.1B active. They are an open version of the Safety Reasoner that OpenAI uses inside its own products.
Instead of fixed categories, you supply your own written policy with each request and the model reasons through it before giving a label. The full chain of thought is visible, which lets reviewers see why something was flagged. Reasoning effort can be set to low, medium or high to trade accuracy against latency. Both models must be used with OpenAI's harmony prompt format.
The weights are Apache 2.0 on Hugging Face, without a gate. They launched with ROOST, the online-safety nonprofit, which runs a community for practitioners using open safety models. The 20b was downloaded 20,754 times in the last month.
How much does gpt-oss-safeguard cost?
| Plan | Price | What you get |
|---|---|---|
| gpt-oss-safeguard-20b | Free | 21B parameters, 3.6B active; 16 GB GPU |
| gpt-oss-safeguard-120b | Free | 117B parameters, 5.1B active |
Free open weights under Apache 2.0 on Hugging Face; self-hosted. The 20b fits on a 16 GB GPU; the 120b scores higher on OpenAI's multi-policy test.
Is gpt-oss-safeguard worth it?
gpt-oss-safeguard moves moderation from training to writing. A trust and safety team can publish a new rule in the morning and enforce it in the afternoon, with a written rationale for every decision. Classifier-style guards cannot do that without new labelled data.
OpenAI's own numbers are modest, and honest about it. On its internal multi-policy test, where every label across several policies must be right, the 120b scores 46.3% and the 20b 43.6%, ahead of gpt-5-thinking at 43.2% but behind OpenAI's internal Safety Reasoner at 52.2%. On the public ToxicChat set the 20b reaches 79.9% F1 and the 120b 79.3%, slightly behind gpt-5-thinking at 81.0%; both score 82.9% on OpenAI's 2022 moderation set.
The technical report is clear about the limits. Classifiers trained on tens of thousands of labelled examples still do better on complex categories, the models are slower and heavier than traditional classifiers, and the visible reasoning can contain hallucinated content that does not match the policy actually applied. OpenAI's own pattern is to run fast classifiers first and send only a share of traffic to the reasoning model.
Against Mistral's Shieldstral 3B, which also takes policies at run time and scores about the same text-safety F1 in Mistral's tests, gpt-oss-safeguard is far bigger but gives you its reasoning. That trade suits review queues and appeals, where an explanation is worth the wait.
Where it earns its place
A trust and safety lead at a marketplace facing a new kind of scam listing
Enforce a new rule this week, before any labelled examples exist
Write the rule as a policy with examples, run the 20b on flagged listings at medium reasoning effort and read the rationale on disagreements to refine the wording.
A moderation operations team handling user appeals
Give reviewers a written reason alongside each automated decision
Re-run appealed items through the 120b at high reasoning effort and attach the chain of thought to the case, remembering OpenAI's warning that it can contain hallucinated content.
A platform engineer with a fast classifier already in production
Add nuance for borderline content without slowing every request
Keep the classifier on all traffic and route only uncertain scores to gpt-oss-safeguard, the layered pattern OpenAI describes for its own systems.
Before you commit
- Setup
- Download openai/gpt-oss-safeguard-20b or -120b from Hugging Face, serve with an engine that supports gpt-oss and the harmony format, and supply your policy as OpenAI's cookbook prompting guide describes.
- Integrations
- Same serving stack as gpt-oss; a policy-writing guide in the OpenAI cookbook; ROOST Model Community for shared policies and feedback.
- Data and privacy
- Self-hosted, so content stays on your hardware. Apache 2.0 permits commercial use.
- Cost at scale
- No API fee. The 20b runs on one 16 GB GPU; every check generates reasoning tokens, so cost and latency rise with reasoning effort and policy length.
- Limits
- Text only; context length not stated in the card; harmony format required; OpenAI recommends regular gpt-oss models for anything other than safety classification.
What’s good
- Policies written in plain language and changed without retraining
- Visible reasoning for every decision
- Adjustable reasoning effort: low, medium or high
- Apache 2.0, ungated; 20b fits on a 16 GB GPU
What’s not
- Slower and heavier than dedicated classifiers
- Trails classifiers trained on large labelled sets for complex categories
- Reasoning can be hallucinated
- Works only with the harmony prompt format
Best for
Trust and safety teams who write and revise their own policies and need an explanation attached to each decision.
gpt-oss-safeguard alternatives
gpt-oss-safeguard: common questions
- Is gpt-oss-safeguard worth it?
- The right tool when your moderation policy changes faster than you can label training data, and the wrong one for screening every message at low latency. We rate it 4.0 out of 5.
- How much does gpt-oss-safeguard cost?
- Free open weights under Apache 2.0 on Hugging Face; self-hosted. The 20b fits on a 16 GB GPU; the 120b scores higher on OpenAI's multi-policy test.
- What are the downsides of gpt-oss-safeguard?
- Slower and heavier than dedicated classifiers; trails classifiers trained on large labelled sets for complex categories; reasoning can be hallucinated; works only with the harmony prompt format.
- Who is gpt-oss-safeguard best for?
- Trust and safety teams who write and revise their own policies and need an explanation attached to each decision.
- How much does gpt-oss-safeguard cost for a team or in production?
- No API fee. The 20b runs on one 16 GB GPU; every check generates reasoning tokens, so cost and latency rise with reasoning effort and policy length.
- Is gpt-oss-safeguard safe for company data?
- Self-hosted, so content stays on your hardware. Apache 2.0 permits commercial use.
- What are the best gpt-oss-safeguard alternatives?
- The closest alternatives we have reviewed are Shieldstral 1.0 3B, Granite Guardian 4.1 8B and Qwen3Guard.
Answers checked Nov 6, 2026.
Make gpt-oss-safeguard? Show this rating on your site
