What is Shieldstral 1.0 3B?
Shieldstral 1.0 3B is a content-safety classifier from Mistral AI, released with open weights on 4 August 2026 as the first release of the Open Secure AI Alliance that Mistral set up with NVIDIA and others. Instead of a fixed list of harm categories, it checks content against a policy you describe at run time: you write a yes-or-no question and an instruction setting the context and strictness, and it returns a single calibrated safety score.
It can check prompts, model responses or both together, in text and images. It is built on the Ministral 3 3B base model with Mistral's Pixtral vision encoder, trained on about 54 million examples. It fits in 16 GB of video memory in BF16 and runs on vLLM, llama.cpp, SGLang and Transformers, with fine-tuning through Axolotl.
The weights are under Apache 2.0, gated on Hugging Face behind Mistral's terms. There is no hosted API price; you run it yourself.
How much does Shieldstral 1.0 3B cost?
| Plan | Price | What you get |
|---|---|---|
| Weights | Free | Apache 2.0, gated download |
| Self-hosted | Free | One 16 GB GPU in BF16 |
Free open weights under Apache 2.0, gated on Hugging Face; self-hosted only, on a single 16 GB GPU in BF16.
Is Shieldstral 1.0 3B worth it?
Shieldstral solves a real problem with moderation models: fixed categories. Most guard models are trained on a set list of harms, so a new policy means retraining or living with mismatches. Shieldstral takes the policy as plain-language input at run time, so a team can add "no medical dosing advice" or "no competitor pricing" without touching the model.
Mistral's numbers are strong for its size. It reports 84.9% average F1 on text safety, tying OpenAI's GPT-OSS-Safeguard-20B, a model about seven times larger, and 83.8% on image-plus-text safety against 77.6% for OmniGuard-7B. On a test built with deliberately different harm categories, meant to check how well it adapts, it scores 91.3% F1. It trails GPT-OSS-Safeguard-20B slightly at spotting refusals, 91.5% against 93.7%. These are Mistral's figures, with a technical report on arXiv.
The practical cost is throughput. Each policy is a separate query, so checking a message against ten policies takes ten passes. At 3B parameters each pass is cheap, and it runs on a single 16 GB GPU, but teams with many rules should batch or group them.
It is a classifier, not a complete guardrail product: you still need the surrounding pipeline, logging and appeals. As an open, self-hosted building block for moderation, it is one of the best available.
Where it earns its place
A marketplace with its own listing rules
Screen product listings and photos against house policies
Write each rule as a yes-or-no question and run Shieldstral on the listing text and images. Group related rules into one policy to cut the number of passes.
A team shipping a customer-facing chatbot
Check model replies before they reach users
Run Shieldstral on prompt-response pairs with your support policy as the instruction, and block or escalate replies whose safety score crosses your threshold.
A company with data that cannot leave its network
Moderate content entirely on-premises
Serve the 3B model with vLLM 0.26+ or a GGUF build in llama.cpp on a single 16 GB GPU; no content goes to a third-party API.
Before you commit
- Setup
- Accept Mistral's terms on Hugging Face, download mistralai/Shieldstral-1.0-3B, and serve with vLLM 0.26+, SGLang, Transformers or a GGUF build. Write each policy as a question plus an instruction.
- Integrations
- vLLM, llama.cpp, SGLang, Transformers; fine-tuning with Axolotl. Part of the Open Secure AI Alliance with NVIDIA.
- Data and privacy
- Self-hosted only, so content stays on your hardware. Apache 2.0 permits commercial use; the download is gated behind Mistral's terms.
- Cost at scale
- No API fee. One 16 GB GPU in BF16 runs it; each policy check is a separate short inference, so cost scales with messages times policies.
- Limits
- Outputs one safety score per policy query. Trained on about 54 million examples; multilingual coverage is not clearly specified.
What's good
- Policies written in plain language at run time; no retraining
- 84.9% text-safety F1, tying a 20B model, per Mistral
- Checks text and images, prompts and responses
- Apache 2.0; runs on one 16 GB GPU
What's not
- One query per policy reduces throughput
- Benchmarks are Mistral's own
- Gated download behind Mistral's terms
- Language coverage not clearly stated
Best for
Teams building their own moderation or guardrail layer who need to enforce custom policies on text and images without retraining a model.
Shieldstral 1.0 3B alternatives
Shieldstral 1.0 3B: common questions
- Is Shieldstral 1.0 3B worth it?
- A small, open moderation model that adapts to your own rules without retraining, matching a 20B rival on Mistral's tests; each extra policy costs another pass. We rate it 4.2 out of 5.
- How much does Shieldstral 1.0 3B cost?
- Free open weights under Apache 2.0, gated on Hugging Face; self-hosted only, on a single 16 GB GPU in BF16.
- What are the downsides of Shieldstral 1.0 3B?
- One query per policy reduces throughput; benchmarks are Mistral's own; gated download behind Mistral's terms; language coverage not clearly stated.
- Who is Shieldstral 1.0 3B best for?
- Teams building their own moderation or guardrail layer who need to enforce custom policies on text and images without retraining a model.
- How much does Shieldstral 1.0 3B cost for a team or in production?
- No API fee. One 16 GB GPU in BF16 runs it; each policy check is a separate short inference, so cost scales with messages times policies.
- Is Shieldstral 1.0 3B safe for company data?
- Self-hosted only, so content stays on your hardware. Apache 2.0 permits commercial use; the download is gated behind Mistral's terms.
- What are the best Shieldstral 1.0 3B alternatives?
- The closest alternatives we have reviewed are GLiNER2.5-Decide, Perplexity Decider (pplx-decider) and Jev.
Answers checked Oct 25, 2026.
Make Shieldstral 1.0 3B? Show this rating on your site
