Mistral Shieldstral safety model posts a reported tie with OpenAI’s 20B guard

Mistral has released the Shieldstral safety model, a 3-billion-parameter open-weight classifier for text and images, under the Apache 2.0 license. The company says its 3B model matched OpenAI’s 20B GPT-OSS-Safeguard on a combined text-safety evaluation, a result that, if it holds beyond Mistral’s own testing, could give teams running open models a smaller moderation component to deploy.

The launch, announced August 4, puts Mistral into the market for guardrail models that screen prompts and outputs around a generative model. Mistral did not disclose a price, latency figure or independently replicated evaluation. It says Shieldstral can run on one 16GB Nvidia GPU, but that is a deployment claim rather than a measured operating-cost comparison.

How does the Mistral Shieldstral safety model change moderation policies?

Rather than rely only on harm categories fixed during training, Shieldstral takes three inputs at inference: an instruction that sets context and strictness, a yes-or-no policy question, and the document to assess. The document can be text, an image, or both. An operator might define the rule in plain language, then ask whether the submitted content violates it.

According to Mistral, the system converts the model’s probabilities for “yes” and “no” into a continuous safety score. That means an operator can change a moderation rule without retraining the classifier, and can set a threshold appropriate to a particular product. The distinction is material for products where the same subject may be permitted in one context and prohibited in another, such as cybersecurity research versus a mental-health service.

What do Mistral’s benchmarks show?

Mistral’s technical report puts Shieldstral at 84.9% F1 across its combined text benchmarks, tying GPT-OSS-Safeguard-20B. The parameter comparison is roughly 6.7-to-1, not a general finding that a 3B model equals a 20B model on every safety task. In the same reported comparison, Qwen3Guard-8B scored 84.0%, Nemotron-3.5-Safety-4B scored 83.3%, and LlamaGuard-4-12B scored 69.1%.

The result was less clear-cut on the separate policy-adaptability test, intended to measure rules that differ from training categories. GPT-OSS-Safeguard-20B led with 94.1% F1, followed by Nemotron-3.5-Safety-4B at 91.8% and Shieldstral at 91.3%. Mistral also reported an 83.8% score on images and image-text inputs, ahead of OmniGuard-7B at 77.6% and LlavaGuard-7B at 71.6%.

Training scale and the remaining questions

Mistral says it unified about 54.1 million examples from safety, harmful-content and manipulation datasets into a common question-answering format. The team also used generated contrastive examples meant to teach the model to distinguish closely related policies. In a fine-grained validation test, researchers said synthetic category data added 23.3 percentage points of F1.

Those are vendor-reported results, and the supplied evidence does not include independent replication, false-positive rates or adversarial-robustness measurements. Mistral says it is continuing work on multilingual coverage, longer-document performance and broader multimodal safety. For operators, Shieldstral’s useful proposition is policy editing at runtime in a small open-weight model; benchmark scores alone do not establish how it will behave under a production policy or attack pattern.

This story draws on original reporting from The Decoder.