News

Mistral opens a 3B moderator that reads the rulebook at run time — not during training

Mistral AI released Shieldstral 1.0 on 4 August 2026: a 3-billion-parameter safety classifier published under Apache 2.0, the first moderation model the company has given away with open weights after two hosted APIs. The design choice is the story. Guard models usually ship with a fixed taxonomy of harms decided during training, so a platform whose rules differ from that taxonomy — or whose rules change — is stuck between retraining and mismatch. Shieldstral turns moderation into a single yes/no question asked at inference time: the developer supplies the context, a plain-language policy question and the content, and the model returns only the probabilities of "yes" and "no", normalised into a continuous score. Changing a policy means editing a prompt. The reported numbers put a small model against much larger ones. Mistral claims 88.1 F1 on WildGuardTest, 84.1 on ToxicChat and 99.4 on HarmBench prompt classification, plus 97.7 on the multimodal VLGuard set — matching or beating open guard models up to seven times its size, on the vendor's own evaluations. It covers twelve languages, judges images as well as text, and was trained at a 32k context. The practical figure is 16 GB. That is a single mid-range GPU, and with llama.cpp quantisation it drops to a CPU. A moderation layer that fits on one machine is available to operators who legally or commercially cannot ship user content to a third-party API — hospitals, public administration, anyone under strict data-residency rules. It is also, conveniently for Mistral, the argument European buyers have been asking for. One limitation worth stating plainly: every benchmark figure above comes from the company that built the model, and guard models are notoriously sensitive to how the policy is phrased. The weights are public, so independent numbers should follow.