Mistral AI Shieldstral 1.0 3B Release

Mistral AI has introduced Shieldstral, a 3B parameter open-weights model designed as a policy-adaptive multimodal safety classifier. Unlike traditional guardrail models that use fixed taxonomies of harm, Shieldstral allows users to define safety policies as plain-language questions at inference time, enabling it to match the performance of models up to seven times its size on text safety and establish a new state of the art in multimodal moderation.

Policy-Adaptive Moderation via Binary Question-Answering

Shieldstral treats content moderation as a binary question-answering task. This approach removes the need for retraining when safety definitions change across different applications or audiences. Each request to the model consists of three components:

<Instruct>: Defines the evaluation context, the level of strictness, and optional definitions of what constitutes unsafe content.
<Query>: A single yes/no question (e.g., "Does this content promote physical violence?").
<Document>: The content being evaluated, which can be a prompt, a response, a prompt-response pair, or an image with optional text.

By reading only the yes and no logits and softmax-normalizing them, the model produces a calibrated continuous safety score. This single interface unifies prompt classification, response moderation, refusal detection, and toxicity detection into one problem.

Key Technical Capabilities

Shieldstral is designed for efficiency and flexibility across multiple modalities:

Multimodal Support: A single natural-language interface handles text, images, and combined text-image content.
Hardware Efficiency: The 3B model is capable of running on a single 16GB GPU.
Continuous Scoring: Instead of discrete labels, the model provides a probability from a single forward pass, allowing developers to threshold or rank results by confidence.
Open Weights: The model is released under the Apache 2.0 license.

Training Methodology

Mistral AI developed Shieldstral by focusing on data quality and diversity to overcome the size limitations of a 3B parameter model:

Unifying Heterogeneous Data

To handle conflicting taxonomies and labels from public safety datasets, Mistral AI used per-dataset processors to convert all data into the a consistent instruction-query-document format. The team varied the wording of instructions and queries to prevent overfitting and calibrated strictness based on the source (e.g., strict for adversarial jailbreaks, lenient for response-quality data).

Policy Discrimination

To prevent the model from simply memorizing fixed labels, the team used an LLM to create contrastive pairs of safe text. These pairs were engineered so that a rewrite would violate one specific policy but not a similar "sibling" policy, training the model to distinguish precise boundaries between different safety policies.

Multimodal Grounding

Due to the scarcity of visual safety data, Mistral AI supplemented moderation datasets with general-purpose image datasets as high-quality negatives. They also used a vision-language reranker to filter image-query pairs to reduce hallucinations and mislabeled data.

Model Merging

Shieldstral was created by fine-tuning with LoRA and merging checkpoints via SLERP. The final model combines a checkpoint calibrated on public data, one focused on fine-grained policy discrimination, and the base instruct model to maintain instruction-following capabilities.

Development Infrastructure

Shieldstral was built using Forge, Mistral AI's platform for training, aligning, and evaluating custom models. Forge handled the infrastructure, data and model sharding, and logging, allowing the research team to focus on data curation.

Future Directions

Mistral AI intends to continue improving Shieldstral's capabilities in areas of multilingual coverage, robustness for longer documents, and broader multimodal safety.