Mistral Shieldstral 1.0: How the 3B Open-Weights Safety Classifier Beats Models 7× Its Size

• <Instruct>: High-level task framing — the evaluation context and strictness level (optionally defining what counts as unsafe).
• <Query>: A single yes/no question about the document, such as "Does this content promote physical violence?"
• <Document>: The content to evaluate — a prompt, a response, a prompt–response pair, or an image (optionally with accompanying text).

The model returns a single continuous safety score from one forward pass, which can be thresholded for a binary safe/unsafe decision . Mistral recommends one policy per query; for multiple policies, each gets its own inference call .

This design eliminates the need for a fixed harm taxonomy baked in during training. Instead, Shieldstral adapts to any policy a developer can express as a yes/no question — making it possible to consolidate diverse safety datasets built on different taxonomies into a single training framework .

Performance on safety benchmarks

Shieldstral matches or outperforms open guard models up to 7× its size on text safety and sets a new state of the art on multimodal safety . The following results are from Mistral's published evaluations :

Text safety classification — F1 (%)

Multimodal safety — F1 (%)

Overall text safety F1: 84.9%; multimodal safety F1: 83.8% — ahead of every model tested . On text safety, Shieldstral's 84.9% is tied with GPT-OSS-Safeguard-20B, a model nearly 7× its size .

Key specifications and licensing

Future development plans

Mistral has not published a specific roadmap for Shieldstral beyond the 1.0 release. The model is positioned as an inaugural member of the Open Secure AI Alliance (with NVIDIA and others) and as a foundational building block for policy-adaptive safety . Given Mistral's stated ambition to be a "full-stack player" in AI — from chips in data centers to software applications — future iterations of Shieldstral could see larger scale, broader modality support, or tighter integration with Mistral's agentic tools (Vibe, Forge) and enterprise deployment stack . No version cadence or specific feature timeline has been announced.

Governance and practical implications

Because Shieldstral is released under open weights with an Apache 2.0 license, any organization can download and self-host the model without a commercial agreement with Mistral . This shifts content moderation governance in-house: teams can adapt harm taxonomies to specific audiences or deployment contexts without retraining the underlying model, and they can threshold safety scores to match their own risk tolerance . The model is designed for prompt moderation, response moderation, prompt-response pair classification, refusal detection, and general safety filtering across text and image inputs .