---
title: "Shieldstral 1.0 3B: the safety policy is a sentence you write, not a clause"
description: "Mistral releases Shieldstral, an open-weight Apache 2.0 safety classifier: the policy is written in natural language, not buried in a clause."
url: https://csidia.com/en/notes/guardrail-pesi-aperti-politica-invece-di-clausola/
lang: en
date: 2026-08-06
label: "Observatory"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/guardrail-pesi-aperti-politica-invece-di-clausola/
---

# Shieldstral 1.0 3B: the safety policy is a sentence you write, not a clause

Mistral has released **Shieldstral 1.0 3B** under an open-weight **Apache 2.0** licence: "Open weights for both commercial and non-commercial use." It is a safety classifier — it decides whether a piece of content meets a policy — built on Ministral-3-3B-Base-2512 "with a native Pixtral vision encoder", producing its verdict "from a single forward pass". What sets it apart from a conventional moderation model is a single sentence in the model card: rather than predicting a fixed set of categories decided upstream, "Shieldstral evaluates content against a safety policy expressed in natural language and returns a single continuous safety score". The policy is not fixed by the vendor at the factory: it can be redefined "at inference time, without retraining" — at the moment of use, with no retraining at all.

## How it works, in practice

Every query is a fixed system message — "Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be 'yes' or 'no'" — plus a user message with three fields: ` ` sets the context and the severity ("high-level task framing"), ` ` poses a single yes/no question about the content, ` ` carries the content to be assessed — text, an image, or a prompt–response pair. The model card is explicit on one point: "One policy per query." To check two different policies you run two queries, not one query with two rules folded together. The output is a single token, yes or no; from the renormalised probabilities of the two tokens comes a continuous score, which the vendor's own benchmarks threshold at 0.5 — but that threshold, unlike the score itself, is not a property of the model: it is a parameter you set. The model is compact — "a 3B checkpoint that runs on a single GPU", and the card specifies that it "fits in 16GB of VRAM in BF16" — it covers twelve languages, Italian included, and was trained "on sequences of up to 32k tokens"; on the wider context, the card itself warns: "while it theoretically supports a 256k context window, we recommend keeping your context within the training range."

## The numbers, in full — not just the wins

On prompt-classification benchmarks, Shieldstral tops the field on HarmBench (99.4 F1) and on ToxicChat (84.1); in the multimodal table it scores 97.7 on VLGuard. These are strong results, and they deserve to be said. But on the multilingual RTP-LX Prompt benchmark it scores **70.3**, against 86.1 for Nemotron-3.5-Content-Safety-4B and 83.9 for GPT-OSS-Safeguard-20B: on that test it is clearly behind, not by a rounding error. And here a clarification is needed that is usually missing: F1 is not an error rate — it is the harmonic mean of precision and recall, and 70.3 does not translate into "wrong one time in five". It does say something plain, though: on that test a substantial share of cases lands on the wrong side, through false alarms or missed ones, and the two errors do not cost the same. A false alarm blocks a legitimate document; a missed one lets it through. This is not a control that guarantees an outcome — it is a control that produces evidence, to be checked, not a wall to lean on without looking further. The model card says as much itself, under limitations: "reliability varies across languages and domains represented unevenly in the training data"; "synthetic and public safety data retain some bias and noise"; and, above all — because it is precisely the condition under which a safety classifier gets attacked for real — "adversarial / obfuscated inputs (encoded or transliterated text) and very long documents can reduce reliability."

## A new model, not yet a standard

Checked by us on 6 August 2026: the `mistralai/Shieldstral-1.0-3B` repository on Hugging Face shows **166 downloads and 128 likes**. That is few. We are not writing this to talk it down — the licence is open, the architecture is clean, the benchmarks are strong where they are strong — but because our credibility rests on exactly this line: it is a new model, adopted so far by very few, and we are not presenting it as a market standard. If anything, it is a candidate to test against your own data before anything else.

## The constructive reverse of yesterday's piece

[Yesterday we wrote](https://csidia.com/en/notes/contratti-ai-difesa-usa-clausole-non-leggibili) about US defence AI contracts in which the safeguards live inside clauses no one can get shown in full — not even a United States senator, who had to ask for them by letter and came away without them. This piece is the constructive reverse of that problem, not its magic solution: here the safeguard is not a clause resting on a vendor's word. It is a file you download, inspect line by line, and run on your own machine — "deployed locally", inside 16GB of video memory. It does not remove the error rate, which stays exactly what the benchmarks above measure. It removes the blind spot: no one has to take the classifier's author on trust, because the classifier itself can be read.

## Three concrete consequences

**The policy is a sentence you write.** Not a list of categories decided by a distant vendor, but your own internal rule — "does anything leaving here identify a supplier?", "does this answer cite a confidential document?" — written in your own language, kept in your own repository, versioned the way code is versioned.

**The output is a number, and the threshold is yours.** The model does not decide on its own where the line between safe and unsafe falls: it returns a score, and whoever uses it chooses where to cut it. That is the difference between "the system blocked it" — an opaque behaviour you simply have to trust — and "the system assigned 0.72 against a threshold of 0.50, on 6 August, under this policy at this version" — a documented decision you can account for at an inspection or to a client.

**It runs inside your own perimeter, on a single GPU.** The content under review does not leave in order to be reviewed. That is the paradox of any moderation handed to an outside service: to find out whether a document is confidential, an outside service would first require sending it out — precisely the risk you were trying to avoid.

## Sources

- [Mistral AI — Shieldstral announcement](https://mistral.ai/news/shieldstral/)
- [Hugging Face — mistralai/Shieldstral-1.0-3B, model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B)
- [arXiv — Shieldstral technical report (2607.25857)](https://arxiv.org/abs/2607.25857)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/guardrail-pesi-aperti-politica-invece-di-clausola/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com