Shieldstral 1.0 3B: the safety policy is a sentence you write, not a clause
7 min read
Mistral has released Shieldstral 1.0 3B under an open-weight Apache 2.0 licence: “Open weights for both commercial and non-commercial use.” It is a safety classifier — it decides whether a piece of content meets a policy — built on Ministral-3-3B-Base-2512 “with a native Pixtral vision encoder”, producing its verdict “from a single forward pass”. What sets it apart from a conventional moderation model is a single sentence in the model card: rather than predicting a fixed set of categories decided upstream, “Shieldstral evaluates content against a safety policy expressed in natural language and returns a single continuous safety score”. The policy is not fixed by the vendor at the factory: it can be redefined “at inference time, without retraining” — at the moment of use, with no retraining at all.
How it works, in practice
Every query is a fixed system message — “Judge whether the Document meets the requirements based on the Query and the Instruction provided. Note that the answer can only be ‘yes’ or ‘no’” — plus a user message with three fields: <Instruct> sets the context and the severity (“high-level task framing”), <Query> poses a single yes/no question about the content, <Document> carries the content to be assessed — text, an image, or a prompt–response pair. The model card is explicit on one point: “One policy per query.” To check two different policies you run two queries, not one query with two rules folded together. The output is a single token, yes or no; from the renormalised probabilities of the two tokens comes a continuous score, which the vendor’s own benchmarks threshold at 0.5 — but that threshold, unlike the score itself, is not a property of the model: it is a parameter you set. The model is compact — “a 3B checkpoint that runs on a single GPU”, and the card specifies that it “fits in 16GB of VRAM in BF16” — it covers twelve languages, Italian included, and was trained “on sequences of up to 32k tokens”; on the wider context, the card itself warns: “while it theoretically supports a 256k context window, we recommend keeping your context within the training range.”
The numbers, in full — not just the wins
On prompt-classification benchmarks, Shieldstral tops the field on HarmBench (99.4 F1) and on ToxicChat (84.1); in the multimodal table it scores 97.7 on VLGuard. These are strong results, and they deserve to be said. But on the multilingual RTP-LX Prompt benchmark it scores 70.3, against 86.1 for Nemotron-3.5-Content-Safety-4B and 83.9 for GPT-OSS-Safeguard-20B: on that test it is clearly behind, not by a rounding error. And here a clarification is needed that is usually missing: F1 is not an error rate — it is the harmonic mean of precision and recall, and 70.3 does not translate into “wrong one time in five”. It does say something plain, though: on that test a substantial share of cases lands on the wrong side, through false alarms or missed ones, and the two errors do not cost the same. A false alarm blocks a legitimate document; a missed one lets it through. This is not a control that guarantees an outcome — it is a control that produces evidence, to be checked, not a wall to lean on without looking further. The model card says as much itself, under limitations: “reliability varies across languages and domains represented unevenly in the training data”; “synthetic and public safety data retain some bias and noise”; and, above all — because it is precisely the condition under which a safety classifier gets attacked for real — “adversarial / obfuscated inputs (encoded or transliterated text) and very long documents can reduce reliability.”
A new model, not yet a standard
Checked by us on 6 August 2026: the mistralai/Shieldstral-1.0-3B repository on Hugging Face shows 166 downloads and 128 likes. That is few. We are not writing this to talk it down — the licence is open, the architecture is clean, the benchmarks are strong where they are strong — but because our credibility rests on exactly this line: it is a new model, adopted so far by very few, and we are not presenting it as a market standard. If anything, it is a candidate to test against your own data before anything else.
The constructive reverse of yesterday’s piece
Yesterday we wrote about US defence AI contracts in which the safeguards live inside clauses no one can get shown in full — not even a United States senator, who had to ask for them by letter and came away without them. This piece is the constructive reverse of that problem, not its magic solution: here the safeguard is not a clause resting on a vendor’s word. It is a file you download, inspect line by line, and run on your own machine — “deployed locally”, inside 16GB of video memory. It does not remove the error rate, which stays exactly what the benchmarks above measure. It removes the blind spot: no one has to take the classifier’s author on trust, because the classifier itself can be read.
Three concrete consequences
The policy is a sentence you write. Not a list of categories decided by a distant vendor, but your own internal rule — “does anything leaving here identify a supplier?”, “does this answer cite a confidential document?” — written in your own language, kept in your own repository, versioned the way code is versioned.
The output is a number, and the threshold is yours. The model does not decide on its own where the line between safe and unsafe falls: it returns a score, and whoever uses it chooses where to cut it. That is the difference between “the system blocked it” — an opaque behaviour you simply have to trust — and “the system assigned 0.72 against a threshold of 0.50, on 6 August, under this policy at this version” — a documented decision you can account for at an inspection or to a client.
It runs inside your own perimeter, on a single GPU. The content under review does not leave in order to be reviewed. That is the paradox of any moderation handed to an outside service: to find out whether a document is confidential, an outside service would first require sending it out — precisely the risk you were trying to avoid.
The two axes, applied here
The internal rule written into <Instruct> and <Query> becomes a control that actually runs on the client’s own documents and systems, not an opinion filed away in a document: the trail to produce at an inspection is date, document, policy applied and its version, score, threshold in force, outcome — generated by the system itself, not reconstructed by hand afterwards. The same set-up that verifies also brings together the organisation’s scattered data — plant, archives, business systems, sensors, documents — into a single operating model on which AI agents execute decisions with a human operator in command: for large enterprises, defence, the public sector and healthcare. Our own systems stay multi-model — this classifier can be swapped out whenever you like, if only to compare it against another one — because the value does not sit in whichever model happens to be running: it sits in your own ontology, your own data, your own processes. Always in both modes: on-premise on self-contained machines that do not require deep integration into your network, or a dedicated cloud with a data centre in Italy — and always with joint management, because you do not need to already have, in house, someone who administers a safety classifier.
Want to test Shieldstral, or another classifier, on your own documents before writing it into a specification? Half an hour with one of our experts, at no cost: we put your own policy, written in your own language, to the test — not the vendor’s benchmark.