What is Llama Guard 4?
Llama Guard 4 is a 12-billion-parameter safety classifier from Meta, published in April 2025 with the Llama 4 models. It is the last Llama Guard: Meta has released no Llama model since April 2025, and moved its main line to the Muse models in April 2026. It replaces two earlier models, Llama Guard 3 8B for text and Llama Guard 3 11B Vision for images, with one that handles both, including prompts with several images.
Meta built it by pruning the pre-trained Llama 4 Scout down to a dense model, keeping only the shared expert in each layer, then fine-tuning it on safety data with roughly three parts text to one part images. It checks either a user's prompt or a model's reply and writes "safe" or "unsafe" followed by the categories breached. These follow the MLCommons hazard list, S1 to S13 (violent crimes to elections), plus S14 for code-interpreter abuse in text.
The weights are gated on Hugging Face under the Llama 4 Community License and were downloaded 90,071 times in the last month. DeepInfra hosts it through OpenRouter at $0.18 per million tokens in and out; Groq shut down its endpoint on 5 March 2026 and pointed users to gpt-oss-safeguard-20b.
How much does Llama Guard 4 cost?
| Plan | Price | What you get |
|---|---|---|
| Weights | Free | 12B, BF16, Llama 4 Community License |
| DeepInfra | $0.18 per 1M tokens in and out | $0.144 on the flex tier |
Free weights under the Llama 4 Community License (gated on Hugging Face). Hosted on DeepInfra via OpenRouter at $0.18 input and $0.18 output per 1M tokens ($0.144 on the flex tier).
Compare this price with other models
Is Llama Guard 4 worth it?
Llama Guard 4's strength is coverage in one model. It reads text and several images together, labels prompts and replies, and uses the MLCommons categories many safety teams already report against. Meta's evaluation, on an in-house test set, shows recall of 69% on English replies at an 11% false-positive rate, up 4 points on Llama Guard 3, and 61% on multi-image prompts, up 20 points, because the old vision model saw only one image.
Those numbers are modest, and they are Meta's. On single images recall is 41% and on the seven non-English languages 43%, so most unsafe content in those cases goes through. Meta publishes no comparison with rival classifiers, arguing their policies differ. The card also warns that categories needing current facts, such as defamation, intellectual property and elections, need more than a classifier trained on fixed data, and that it was mostly tested with three images.
The design is fixed. Guard 4 checks against its 14 categories; you cannot hand it a new written policy and expect it to reason about it, which is what gpt-oss-safeguard does. It is also an LLM itself, so the card points to Prompt Guard 2 for injection attacks aimed at the classifier.
Operationally it is light: about 24GB of BF16 weights on one GPU, or around 15GB and 11GB for Red Hat's FP8 and 4-bit builds. The licence brings the Llama 4 terms, and its use policy withholds multimodal rights from EU-based companies, which matters for a model whose point is image moderation. Groq's switch to gpt-oss-safeguard-20b in March 2026 is a fair signal of where hosted demand has gone.
Where it earns its place
A trust-and-safety engineer at a dating app with photo messages
Flag messages that combine text and several images before they reach the recipient
Send the message text and attached photos to Guard 4 in one call and act on the S-codes it returns. At 10 million checks a month of about 500 tokens each, DeepInfra charges roughly $900 for input, plus little for the few output tokens.
A platform team running Llama 4 Scout or Maverick behind a coding assistant
Block replies that try to misuse the code interpreter
Run Guard 4 on model replies with S14, code-interpreter abuse, enabled; it shares Llama 4's tokenizer and vision encoder. Pair it with Prompt Guard 2 on inputs, as Meta suggests, since Guard 4 itself can be prompt-injected.
A compliance lead who reports moderation results against the MLCommons taxonomy
Produce per-category counts of unsafe prompts for a quarterly review
Log the categories Guard 4 lists for each unsafe prompt; the labels map one to one onto MLCommons hazards. Sample flagged and passed items for human review, since Meta's own recall in English is 69%.
Before you commit
- Setup
- Accept the Llama 4 licence on Hugging Face, load meta-llama/Llama-Guard-4-12B with Hugging Face Transformers and pass the conversation through its chat template; or call it on OpenRouter with no download.
- Integrations
- Hugging Face Transformers; DeepInfra via OpenRouter; quantised FP8 and 4-bit builds from Red Hat; Meta's card pairs it with Prompt Guard 2 for injection attacks.
- Data and privacy
- Self-hosted, content stays on your hardware. Llama 4 Community License: a Meta licence is needed above 700 million monthly users, "Built with Llama" attribution is required, and the use policy excludes EU-based individuals and companies from rights to multimodal models.
- Cost at scale
- 10 million checks a month at 500 tokens is about $900 on DeepInfra. Self-hosted, the 24GB BF16 model runs on a single 40GB-class or larger GPU; the 4-bit build at about 11GB fits a 16GB card.
- Limits
- Text output of safe or unsafe plus categories, no calibrated score; 14 fixed categories; English plus 7 languages; mostly tested with 3 images; weak on facts-dependent categories; Groq endpoint shut down 5 March 2026.
What’s good
- One model for text, single images and multiple images
- Standard MLCommons categories S1 to S13 plus code-interpreter abuse
- Multi-image recall up 20 points on Llama Guard 3 (Meta)
- About 24GB in BF16; $0.18 per 1M tokens hosted
What’s not
- 41% recall on single images and 43% in non-English text (Meta)
- Fixed categories; cannot follow a custom written policy
- No comparisons with other classifiers published
- EU-based companies excluded from the multimodal licence rights
Best for
Teams outside the EU that need one self-hosted check for text and images against the MLCommons harm categories, ahead of or behind an existing chat model.
Llama Guard 4 alternatives
Llama Guard 4: common questions
- Is Llama Guard 4 worth it?
- Guard 4 is the simple choice for screening text and images against a standard harm list, provided you accept that it misses about a third of unsafe English replies on Meta's own test. We rate it 3.6 out of 5.
- How much does Llama Guard 4 cost?
- Free weights under the Llama 4 Community License (gated on Hugging Face). Hosted on DeepInfra via OpenRouter at $0.18 input and $0.18 output per 1M tokens ($0.144 on the flex tier).
- What are the downsides of Llama Guard 4?
- 41% recall on single images and 43% in non-English text (Meta); fixed categories; cannot follow a custom written policy; no comparisons with other classifiers published; eU-based companies excluded from the multimodal licence rights.
- Who is Llama Guard 4 best for?
- Teams outside the EU that need one self-hosted check for text and images against the MLCommons harm categories, ahead of or behind an existing chat model.
- How much does Llama Guard 4 cost for a team or in production?
- 10 million checks a month at 500 tokens is about $900 on DeepInfra. Self-hosted, the 24GB BF16 model runs on a single 40GB-class or larger GPU; the 4-bit build at about 11GB fits a 16GB card.
- Is Llama Guard 4 safe for company data?
- Self-hosted, content stays on your hardware. Llama 4 Community License: a Meta licence is needed above 700 million monthly users, "Built with Llama" attribution is required, and the use policy excludes EU-based individuals and companies from rights to multimodal models.
- What are the best Llama Guard 4 alternatives?
- The closest alternatives we have reviewed are gpt-oss-safeguard, Qwen3Guard, Granite Guardian 4.1 8B, Shieldstral 1.0 3B and Llama Prompt Guard 2.
Answers checked Nov 9, 2026.