Mistral releases Shieldstral, a 3B open-weights safety classifier

Mistral has released Shieldstral, a 3B-parameter open-weights multimodal content-moderation model, licensed under Apache 2.0. The release makes Mistral an inaugural member, alongside NVIDIA and other unnamed organizations, of the newly formed Open Secure AI Alliance.

Most guardrail models bake a fixed set of harm categories into their weights, so adapting one to a new product or audience means retraining it. Shieldstral instead treats moderation as a question-answering task: at inference time, an operator supplies the evaluation context and a plain-language yes/no question (for example, "does this content promote physical violence?") alongside the content to judge, which can be a prompt, a response, a prompt-response pair, or an image with optional text. The model reads out only the yes and no logits from a single forward pass and softmax-normalizes them into a continuous, calibrated safety score, rather than a discrete label. Mistral says this design needs no retraining to cover a new policy, uses one interface for both text and images, and returns a verdict from a single token.

Mistral states that Shieldstral matches or outperforms open guard models up to 7 times its size across text safety, refusal detection, policy adaptability, and multimodal benchmarks, and claims a new state of the art on multimodal moderation specifically; the underlying benchmark scores are not given in the released text. The model runs on a single 16GB NVIDIA GPU.

On training, Mistral describes four problems it says it had to solve. It converted disparate public safety datasets, which disagree on taxonomies and annotation conventions, into a common instruction-query-document format, varying phrasing so the model would not overfit to one dataset's style, and calibrated strictness per source (strict for adversarial jailbreak data, lenient for response-quality data). To stop the model from merely memorizing a fixed label set, Mistral built sets of deliberately similar, easily confused policies and used an LLM to rewrite safe text into contrastive pairs, each engineered to violate one policy but not a similar sibling policy, so the model learns to reason about policy boundaries rather than recall categories. Because, per Mistral, unsafe images cannot be synthesized by an LLM the way unsafe text can, visual safety data is scarce; the team supplemented limited moderation datasets with general-purpose image datasets used as high-quality negatives and filtered image-query pairs through a vision-language reranker to cut mislabeled data. Finally, Mistral fine-tuned three checkpoints with LoRA, one calibrated on public data, one adding fine-grained policy discrimination from generated data, and the base instruct model, and merged them via SLERP. The model was built on Forge, Mistral's internal platform for training, aligning, and evaluating custom models.

Mistral says it is continuing work on multilingual coverage, longer-document robustness, and broader multimodal safety, and that these are future goals rather than current capabilities of the released model.

Key facts

Shieldstral is a 3B-parameter, open-weights multimodal safety classifier released by Mistral under Apache 2.0.
It accepts a plain-language policy question at inference time and returns a calibrated yes/no safety score from a single forward pass, without retraining for new policies.
Mistral claims it matches or outperforms open guard models up to 7 times its size on text safety, refusal detection, policy adaptability, and multimodal benchmarks, and sets a new state of the art on multimodal moderation.
It runs on a single 16GB NVIDIA GPU.
The release makes Mistral an inaugural member, with NVIDIA and other organizations, of the new Open Secure AI Alliance.

Why it matters

Guardrail models typically bake a fixed taxonomy of harmful categories into their weights, so retargeting one to a new product or audience means retraining it. Shieldstral instead lets an operator write the policy as a plain-language question at inference time and get back a calibrated score, covering text, image, and text-plus-image content with one checkpoint. Mistral positions this as moderation that adapts to context rather than forcing every deployment through one frozen taxonomy.

Who it affects

The model targets teams building products that need content moderation, prompt classification, response moderation, refusal detection, or toxicity detection, particularly those whose safety requirements differ from a generic fixed taxonomy, such as a cybersecurity research tool versus a mental-health platform. It also affects the broader open-weights safety tooling ecosystem through the Open Secure AI Alliance that Mistral and NVIDIA are founding alongside unnamed other organizations.

How to use it

Shieldstral is available as open weights under the Apache 2.0 license for download from Mistral, and is designed to run on a single 16GB NVIDIA GPU. Mistral has not published pricing, a hosted API, or specific release timelines in the announcement; the model is presented as a self-hosted download rather than a managed service.

How solid is it

The claims come from Mistral's own announcement post, without independent benchmarking. Mistral states Shieldstral matches or outperforms open guard models up to 7 times its size across text safety, refusal detection, policy adaptability, and multimodal benchmarks, and separately claims a new state of the art on multimodal moderation, but the underlying benchmark tables and scores are not included in the released text, so the magnitude behind these comparative claims cannot be verified from the source alone.

Risks and caveats

All performance and training claims originate from Mistral itself, with no third-party evaluation cited. No individual author or spokesperson is named, and no release date is given beyond the announcement itself. Multilingual coverage, longer-document robustness, and broader multimodal safety are described only as future goals, not current capabilities of the released model. The other organizations in the Open Secure AI Alliance besides Mistral and NVIDIA are not identified.

“No retraining, one interface for text and images, and a verdict from a single token.”

— Mistral