Mistral AI Releases Shieldstral 1.0 3B: An Open-Weights Policy-Adaptive Multimodal Safety Classifier Matching Models 7× Its Size

AI Releases Shieldstral 1.0 3B: An Open-Weights Policy-Adaptive Multimodal Safety Classifier Matching Models 7× Its Size">

Mistral AI has released Shieldstral 1.0 3B , an open-weights, policy-adaptive multimodal safety classifier that treats content moderation as a single yes/no question rather than a fixed taxonomy of harm categories. Most guardrail models bake their category list into the weights, so re-targeting one to a new deployment context means retraining — and the same content can be acceptable on a cybersecurity research tool while being harmful on a mental-health platform. Shieldstral inverts that: operators write the policy as a plain-language question at inference time, and the model returns a calibrated safety score from a single forward pass. Built on Ministral-3-3B-Base-2512 with a native Pixtral vision encoder and released under Apache 2.0, it reports 84.9% average F1 on text safety — matching GPT-OSS-Safeguard-20B — and 83.8% on multimodal safety, ahead of every baseline Mistral evaluated.

Yes, and locally. Shieldstral-1.0-3B fits in 16GB of VRAM in BF16, runs on a single GPU, and is licensed Apache 2.0 for commercial and non-commercial use. Serving paths are already in place: vLLM (≥0.26.0, recommended), llama.cpp via GGUF conversion with Q8_0/Q5_K_M/Q4_K_M quantization, SGLang, and Transformers — with fine-tuning supported through Axolotl . The classifier emits one token, so latency and cost sit far below reasoning-based guards like GPT-OSS-Safeguard-20B.

Shieldstral reduces moderation to one yes/no question. A fixed system message establishes the task; the user message carries three fields: (evaluation context and strictness), (the policy, phrased as a single yes/no question), and (a prompt, a response, a prompt–response pair, or an image with optional text).

At inference the model unembeds only toward the yes and no token IDs and softmax-normalizes them into a continuous score, thresholded at τ=0.5. That collapses prompt classification, response moderation, refusal detection, and toxicity detection into one problem — and it means the policy lives entirely in the prompt. Mistral’s guidance is one policy per call; for a broad safe/unsafe verdict, list the categories in and ask a single wide .

The claimed advantage comes from data, not scale: roughly 54.1M samples — 45.2M open-source text, 4.4M synthetic contrastive text, 4.5M multimodal. A template-based unification layer converts every dataset into the same instruction–query–document format via per-dataset processors, with randomized phrasings and calibrated strictness (strict for adversarial jailbreaks, lenient for response-quality data).

The more interesting piece is contrastive generation. An LLM rewrites safe text into an unsafe variant that violates a target category but deliberately not its sibling, producing a positive and a hard negative over identical content in one call. That teaches the model which policy is violated rather than a coarse safe/unsafe split. Image data — which cannot be synthesized the way text can — is supplemented with general-purpose image datasets as negatives, query mutation across a 14-subcategory visual taxonomy, and vision–language reranker filtering.