What is Qwen3Guard?
Qwen3Guard is a family of moderation models from Alibaba's Qwen team, released in September 2025 and built on Qwen3. It comes in two forms, each in 0.6B, 4B and 8B sizes. Qwen3Guard-Gen reads a whole prompt or prompt-and-response and writes out a safety label and categories. Qwen3Guard-Stream adds a classification head that labels each token as the main model generates it, so an unsafe answer can be cut off mid-stream.
Instead of a yes or no, it returns one of three labels: safe, controversial or unsafe. Controversial covers content whose harm depends on context; in strict mode you treat it as unsafe, in loose mode as safe. Categories are violent content, non-violent illegal acts, sexual content, personal data, suicide and self-harm, unethical acts, politically sensitive topics, copyright violation and, for inputs only, jailbreaks. Response checks also report whether the model refused.
The models were trained on 1.19 million labelled prompts and responses and support 119 languages and dialects. Weights are Apache 2.0 and ungated on Hugging Face; the 8B Gen model was downloaded 110,997 times in the last month.
How much does Qwen3Guard cost?
| Plan | Price | What you get |
|---|---|---|
| Qwen3Guard-Gen | Free | 0.6B, 4B or 8B; whole prompt or response |
| Qwen3Guard-Stream | Free | 0.6B, 4B or 8B; token by token |
Free open weights under Apache 2.0, ungated on Hugging Face, in 0.6B, 4B and 8B sizes; self-hosted. Alibaba Cloud also offers a hosted AI Guardrails service powered by it.
Is Qwen3Guard worth it?
Qwen3Guard's advantage is languages. In the Qwen team's technical report, the 8B Gen model averages 85.1 F1 on Chinese prompt benchmarks against 44.1 for Llama Guard 4 12B, and 85.0 on the multilingual RTP-LX set against 41.7. On English it averages 90.0 on prompts and 83.9 on responses, ahead of WildGuard 7B at 85.8 and 79.9. One caveat: Qwen's averages take the better of strict and loose mode for each benchmark, which flatters it somewhat.
The three-way label is the design choice that matters in practice. A children's education app and an adult fiction platform disagree about the same borderline text; with Qwen3Guard they share one model and differ only in whether controversial means block.
The Stream variant is the other reason to look. It scores each generated token, and the report says it lands within about two F1 points of the Gen model. On 813 unsafe responses it flagged the first unsafe sentence exactly about 86.0% of the time, and on reasoning traces it caught unsafe content within the first 128 tokens in about 66.8% of cases. The cost is integration: it reads Qwen3 token IDs, so other model families need their output re-tokenised, and vLLM and SGLang support for Stream is still in progress.
The documentation is rough. The README's response-moderation example uses the wrong model name and prints an undefined variable, benchmark tables are only images in the model card, and the GitHub repository has not changed since October 2025. The models are solid; expect to read the report rather than the README.
Where it earns its place
A trust and safety team at a messaging app with users across Asia and Latin America
Moderate user prompts and bot replies in Chinese, Indonesian, Spanish and Portuguese
Serve Qwen3Guard-Gen-4B behind vLLM with an OpenAI-compatible endpoint and run every turn through it; treat controversial as unsafe for minors' accounts and as safe elsewhere.
An engineer running a Qwen3-based assistant that streams long answers
Stop an unsafe answer while it is still being generated
Feed each generated token ID to Qwen3Guard-Stream with Transformers and close the stream when a token is labelled unsafe, instead of waiting to check the full answer.
A researcher training a model with reinforcement learning
Reward safe answers without rewarding blanket refusals
Use Gen's safety label and its refusal field as reward signals, as Qwen did with Gen-4B to train Qwen3-4B-SafeRL; a smaller size keeps the reward model cheaper to run.
Before you commit
- Setup
- vllm serve Qwen/Qwen3Guard-Gen-4B --max-model-len 32768 (vLLM 0.9.0+ or SGLang 0.4.6.post1+), then parse the Safety and Categories lines from the reply. Stream needs Transformers 4.51+ with trust_remote_code.
- Integrations
- Transformers, vLLM and SGLang for Gen; OpenAI-compatible endpoints; Alibaba Cloud's hosted AI Guardrails service is powered by it.
- Data and privacy
- Self-hosted, so text stays on your hardware. Apache 2.0 permits commercial use.
- Cost at scale
- No API fee; you pay for your own GPUs, and the 0.6B size is the cheapest to serve. Stream costs grow roughly linearly with response length, while re-checking a growing answer with Gen costs much more.
- Limits
- Context length not stated beyond the 32,768-token serving examples; Stream is tied to the Qwen3 tokenizer; categories are fixed.
What’s good
- 119 languages and dialects; strong Chinese and multilingual scores in Qwen's report
- Safe, controversial and unsafe labels with strict and loose modes
- Stream variant moderates token by token during generation
- Apache 2.0, ungated, sizes from 0.6B to 8B
What’s not
- Qwen's averages pick the better mode per benchmark
- Stream needs Qwen3 tokens; no vLLM or SGLang support yet
- README examples contain errors
- Fixed categories; no plain-language custom policies
Best for
Teams moderating chat or model output in many languages who want an open model with a tunable middle ground between safe and unsafe.
Qwen3Guard alternatives
Qwen3Guard: common questions
- Is Qwen3Guard worth it?
- The open guard model to beat for multilingual moderation, with a controversial label that saves you arguing over borderline cases and a streaming mode that checks answers while they are written. We rate it 4.3 out of 5.
- How much does Qwen3Guard cost?
- Free open weights under Apache 2.0, ungated on Hugging Face, in 0.6B, 4B and 8B sizes; self-hosted. Alibaba Cloud also offers a hosted AI Guardrails service powered by it.
- What are the downsides of Qwen3Guard?
- Qwen's averages pick the better mode per benchmark; stream needs Qwen3 tokens; no vLLM or SGLang support yet; rEADME examples contain errors; fixed categories; no plain-language custom policies.
- Who is Qwen3Guard best for?
- Teams moderating chat or model output in many languages who want an open model with a tunable middle ground between safe and unsafe.
- How much does Qwen3Guard cost for a team or in production?
- No API fee; you pay for your own GPUs, and the 0.6B size is the cheapest to serve. Stream costs grow roughly linearly with response length, while re-checking a growing answer with Gen costs much more.
- Is Qwen3Guard safe for company data?
- Self-hosted, so text stays on your hardware. Apache 2.0 permits commercial use.
- What are the best Qwen3Guard alternatives?
- The closest alternatives we have reviewed are Granite Guardian 4.1 8B, Shieldstral 1.0 3B and gpt-oss-safeguard.
Answers checked Nov 6, 2026.
Make Qwen3Guard? Show this rating on your site
