Your moderation queue doesn't care which taxonomy a model was trained on. It cares whether that screenshot breaks the rule your legal team wrote last Tuesday. That's the pitch behind Shieldstral 1.0, which Mistral put on Hugging Face on 4 August 2026 under Apache 2.0: a 3B classifier that reads text and images, takes your policy as a plain English question at inference time, and answers with a calibrated probability rather than a fixed category label. It fits in 16 GB of VRAM. Mistral says it matches guard models close to seven times its size, its own paper words that claim more carefully, and we went and read both.
The short answer
Mistral released Shieldstral 1.0 on 4 August, an open-weights classifier that moderates text and images against a policy you write in plain English at inference time. It matches a 20B guard model on text safety and beats a 7B on images, from a checkpoint that fits on one card. What it won’t give you is a reason for any given verdict.
Image: Mistral AI, announcement thumbnail from the Shieldstral release post.
Guard models normally ship with their opinions baked in. Shieldstral ships with a slot where yours goes.
The trick is that moderation became a yes or no question
Most guard models learn a taxonomy. Violence, self-harm, whatever the vendor decided mattered, fixed at training time. Shieldstral does something narrower and, honestly, smarter: it treats every moderation job as one binary question-answering problem. The prompt has three labelled blocks. <Instruct> sets the moderator persona, <Query> holds the question you want answered, <Document> holds the content under judgement.
That structural choice is why the training set could be so big. Mistral consolidated roughly 54.1M samples with wildly different taxonomies into one framework, because once every dataset becomes yes-or-no, incompatible label schemes stop mattering. Around 45.2M of those are open-source text, 4.4M are synthetic contrastive pairs built specifically to teach the model to discriminate between policies rather than memorise categories, and 4.5M are multimodal.
The output side is where it gets cheap. The model answers with one token, so you cap generation at one and read the top log probabilities to recover a probability between 0 and 1. No reasoning trace, no JSON to parse.
Same job it does for prompt moderation, it does for response moderation, refusal detection and prompt-response pairs. You change the <Query> line. That’s the whole configuration surface.
Read the benchmark line twice
Mistral’s blog says Shieldstral outperforms guard models up to seven times its size. The paper abstract says “matches or outperforms models nearly 7x its size”, and that hedge is doing real work.
On text safety the average is 84.9 F1. GPT-OSS-Safeguard-20B, the strongest text baseline in Mistral’s own table, also scores 84.9. That’s a tie from a model roughly a sixth the size, which is a genuinely good result and is not the same sentence as beating it. The clear win is multimodal, 83.8 against 77.6 for OmniGuard-7B. And on policy adaptability, the metric this entire design exists to serve, Shieldstral takes 91.3 against 94.1 for the 20B. It loses that one.
Per-benchmark numbers on the model card are strong where you’d expect and softer where the data is messy: 99.4 on HarmBench prompts, 88.1 on WildGuardTest, 84.1 on ToxicChat. Multimodal runs 97.7 on VLGuard and 81.8 on UnsafeBench. Nobody outside Mistral has published an independent run yet, so treat all of it as vendor-reported.
When you’d actually reach for it
Here’s the awkward part nobody in the coverage mentioned. Mistral already gives away text moderation: mistral-moderation-2603 is listed on the API pricing page at no cost. If your problem is English text and you don’t mind sending it to Paris, that endpoint was already free before Thursday.
So the case for Shieldstral is narrower and clearer than “better guard model”. Three things push you toward it. Images, because the free endpoint is text-only. Data that can’t leave your building, which is the reason a healthcare platform on Hacker News flagged local deployment as the whole point. And a policy that’s yours rather than a vendor’s, especially the awkward domain-specific rules that never map onto anyone’s stock taxonomy.
For pricing sanity, the Ministral 3B backbone costs 0.10 dollars per million tokens either way on Mistral’s API, which is roughly what you’re replacing with your own electricity. Nothing has been published for shieldstral-1-0 itself, which sits in Public Preview.
What Mistral left fuzzy
Two parameter counts are in circulation right now. The blog and the Hugging Face repo say 3B, the API model card says 3.8B. Our reading, from the config, is that 3.8B counts the Pixtral vision encoder bolted onto the Ministral 3B backbone while 3B counts the language model alone. Mistral hasn’t said that anywhere we could find, so we’re inferring it.
Language coverage moves too. The model card lists 12 languages, the paper evaluates 28 across PolyGuard and RTP-LX, and Mistral admits in its own limitations that prompt classification trails on Arabic and Indonesian. If you moderate in either, benchmark before you commit.
The licence, at least, is boring in the best way. Apache 2.0, no excluded territories, no revenue threshold, no attribution banner in your UI. That is a sharper contrast than it used to be, given MiniMax shipped H3 last week under a licence naming the EU and the US as excluded territories, and given how much work the phrase open weights is doing in current release notes.
One last thing worth planning around if you publish in Europe. Article 50 of the AI Act went live on 2 August, and a moderation classifier is exactly the sort of component that ends up load-bearing in a transparency workflow. A model that emits a number and no reason is a thin foundation for a decision you may have to defend. I’d keep humans on the ambiguous band for now, and I say that as someone who’d otherwise be happy to automate it.
Sources
Announcement and specifications from Mistral AI, the Shieldstral-1.0-3B model card on Hugging Face, and the Mistral API model card. Benchmark tables, training data volumes and the stated limitations come from the technical report, arXiv 2607.25857, submitted 28 July 2026. Pricing for the existing moderation endpoint is from the Mistral API pricing page. Practitioner reaction from the Hacker News discussion, and additional reporting from Unite.AI.
Frequently asked questions
What is Shieldstral 1.0?
It is an open-weights safety classifier Mistral released on 4 August 2026 under Apache 2.0, at mistralai/Shieldstral-1.0-3B on Hugging Face. It takes a moderation policy written as a plain language yes or no question, plus the text or image you want judged, and returns a calibrated probability. Because the policy lives in the prompt rather than in the training data, you change what it enforces by editing a string.
Is Shieldstral free to use commercially?
The weights are Apache 2.0, which is a genuine open source licence with no territory restriction, no revenue ceiling and no obligation to display the model name in your product. That is a real contrast with several recent open-weights releases. On the hosted API the model id is shieldstral-1-0 and it sits in Public Preview, with no price published at the time of writing.
What hardware do I need to run Shieldstral?
One GPU with 16 GB of VRAM runs it in BF16, which puts it inside a single mid-range card rather than a multi-GPU node. Mistral recommends up to 32k of context. The quickest path is vLLM: install it, then run vllm serve mistralai/Shieldstral-1.0-3B with a max model length of 32768. llama.cpp and Transformers are both documented on the model card as well.
Is Shieldstral actually better than a 20B guard model?
On Mistral's own numbers it ties rather than wins. Shieldstral averages 84.9 F1 on text safety, the same figure Mistral reports for GPT-OSS-Safeguard-20B. It leads clearly on multimodal safety at 83.8 against 77.6 for OmniGuard-7B, and it loses on policy adaptability at 91.3 against 94.1. The achievement is the size, not the ceiling.
Can Shieldstral explain why it flagged something?
No, and that is the main practical objection. The model emits a single token, so what you get is a probability, not a reasoning trace you could show a user who appeals a decision. If you need an audit trail, you either pair it with a larger model on the flagged subset or keep humans on the ambiguous band.
