Mistral open-sources Shieldstral, a 3B moderation model
The Apache-2.0 guard model takes safety policies as plain-language questions at inference and runs on a single 16GB GPU.
Policy at inference, not in the weights
Mistral released Shieldstral on August 4, a 3-billion-parameter content-safety model published under Apache 2.0 alongside a technical report. Its design departs from the usual guard model: instead of a taxonomy of harm categories fixed during training, Shieldstral treats moderation as a binary question-answering problem. The deployer supplies the policy as a natural-language question at inference time and receives a calibrated score, over both text and images through one interface.
That shift is the point. Conventional guardrail classifiers force operators to either accept a vendor's category list or fine-tune their own model whenever the policy changes — a marketplace, a children's product and a medical service all need different lines drawn. Shieldstral pushes that decision into the prompt, so a policy change is a text edit rather than a training run.
Size and claimed performance
Mistral says the model matches or beats open guard models up to seven times its size across text safety, refusal detection, policy adaptability and multimodal safety evaluations, and claims state-of-the-art results on multimodal moderation. At 3B parameters it runs on a single 16GB Nvidia GPU, which puts it within reach of on-device and edge deployment as well as inline filtering in front of a hosted model.
Why it matters
Moderation is where a lot of deployed AI quietly fails: too strict and the product is useless, too loose and it is a liability, and the same filter usually cannot serve both. A small, permissively licensed, runtime-configurable classifier lowers the cost of getting that layer right — and lowers it most for the smaller teams that cannot afford a bespoke safety stack. The licence matters as much as the benchmarks. Apache 2.0 means enterprises can self-host the filter inside their own perimeter, which is directly relevant for European operators facing AI Act transparency and content obligations and for anyone who cannot route user content through a third-party moderation API. It also extends a pattern in which safety tooling, not just frontier capability, is being released openly.