Shieldstral 1.0 3B Requirements: VRAM, Setup & Moderation
Shieldstral 1.0 3B is Mistral AI's Apache 2.0 moderation model, released Aug 4, 2026. It needs ~16GB VRAM in BF16 and screens both text and images together.
Shieldstral 1.0 3B is an open-weight multimodal moderation model Mistral AI released on August 4, 2026. Short answer: BF16 inference needs about 16GB of VRAM, small enough for a single NVIDIA GPU, and it ships under the Apache 2.0 license with no restrictions on commercial use, modification, or redistribution. It can screen text and images through one model, and — its standout feature — the moderation policy itself is passed in natural language at inference time. Within the Mistral 3 lineup covered in our Mistral Small 4 guide, Shieldstral occupies the lightweight, safety-focused slot.
Requirements Quick Reference
| Precision / Quantization | VRAM estimate | Disk estimate | Typical use |
|---|---|---|---|
| BF16 (full precision) | ~16GB | ~6GB (3B params) | Mistral's recommended configuration; production/eval on a GPU server |
| GGUF Q8_0 | Under 16GB (slightly lighter than BF16) | Slightly smaller than BF16 | Quantized deployment with accuracy priority |
| GGUF Q5_K_M | Lighter still | Smaller still | Deployments with constrained VRAM |
| GGUF Q4_K_M | Among the lightest options | One of the smallest footprints | Testing on lower-spec GPUs or CPU-leaning setups |
Eight GGUF quantization variants are officially published, including Q8_0, Q5_K_M, and Q4_K_M. Mistral hasn't published exact VRAM figures per quantization level, so treat the table above as a general guide to the precision/use-case tradeoff. A safe path is to start with the full-precision BF16 build on a 16GB-class GPU, then move to a quantized build if needed.
What Is Shieldstral — Policy Passed at Inference Time
Shieldstral 1.0 is a 3B-parameter multimodal model built on the Ministral-3-3B-Base-2512 backbone with a Pixtral-family vision encoder. Training data spans 12 languages across 54.1 million contrastive pairs, with a training context length of up to 32k tokens and theoretical support up to 256k.
Most traditional guard models classify content against a fixed set of predefined categories (violence, sexual content, hate speech, and so on), which typically means fine-tuning or a new release whenever the moderation policy changes. Shieldstral flips that: the moderation policy itself is passed as natural-language text in the inference-time prompt. That means internal policy revisions or domain-specific rule additions can be handled by editing the prompt — no retraining required.
What It Can Do
- Text moderation: Screen chat inputs, outputs, or posted text on their own.
- Image moderation: Feed an image alone and get a safety judgment.
- Multimodal review: Submit text and an image together for a single combined judgment.
- Refusal detection: Also usable to check whether an LLM's response counts as a refusal — handy for monitoring chatbot output quality.
Input/Output Format
The input is a structured, three-part prompt: <Instruct> sets the task context and strictness, <Query> is a single yes/no safety question, and <Document> is the content to evaluate (text, image, or both). The output is a continuous score from 0 to 1, derived from the logprobs of the yes/no tokens — apply a threshold to turn it into a binary decision.
<Instruct>
You are a content moderator. Apply a strict standard.
<Query>
Does this message contain content that encourages violence?
<Document>
(the text, or image plus text, to evaluate)Running Shieldstral
vLLM is the recommended inference path. Request with max_tokens: 1, logprobs: true, and top_logprobs: 20, then extract the yes/no token scores from the response's logprobs.
# start the server
vllm serve mistralai/Shieldstral-1.0-3B --dtype bfloat16from openai import OpenAI
client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")
prompt = (
"<Instruct>\nYou are a content moderator. Apply a strict standard.\n\n"
"<Query>\nDoes this message contain content that encourages violence?\n\n"
"<Document>\n(text to evaluate)"
)
resp = client.chat.completions.create(
model="mistralai/Shieldstral-1.0-3B",
messages=[{"role": "user", "content": prompt}],
max_tokens=1,
logprobs=True,
top_logprobs=20,
)
top_logprobs = resp.choices[0].logprobs.content[0].top_logprobs
# derive a 0-1 score from the yes/no token logprobsTo load it directly with transformers, use Mistral3ForConditionalGeneration together with MistralCommonBackend, loaded at dtype=torch.bfloat16. If VRAM is tight, starting with the vLLM API route keeps the setup simpler.
import torch
from transformers import Mistral3ForConditionalGeneration
model = Mistral3ForConditionalGeneration.from_pretrained(
"mistralai/Shieldstral-1.0-3B",
dtype=torch.bfloat16,
device_map="auto",
)
# use MistralCommonBackend for the tokenizerHow It Differs From Existing Guard Models
| Approach | Adapting to policy changes | Modalities | Deployment | License / cost |
|---|---|---|---|---|
| Shieldstral 1.0 3B | Policy passed as natural language in <Instruct>; prompt edits alone are enough | Text, image, or both (also usable for refusal detection) | Self-hosted (open weight) | Apache 2.0; only your own hosting cost |
| Llama Guard family | Generally built around fixed category taxonomies; major policy shifts tend to need fine-tuning | Varies by model (mostly text, some image-capable versions) | Self-hosted | Llama-family license |
| ShieldGemma family | Judgment centered on pre-trained safety categories | Mostly text | Self-hosted | Gemma terms of use |
| Cloud moderation APIs | Follows the provider's own policy; limited room for custom policies | Varies by service (text/image) | Cloud API call | Usage-based pricing; data leaves your infrastructure |
This table reflects general design characteristics, not a head-to-head accuracy comparison (Mistral claims Shieldstral matches or beats open guard models up to seven times its size on text safety, refusal detection, policy adaptability, and multimodal benchmarks, but hasn't named specific competing models or scores). Validate against your own data before committing to any of these approaches in production.
Where It Fits in Practice — and What to Watch For
Three typical use cases stand out: filtering your own chatbot's inputs and outputs, screening user-generated content on submission, and auditing chat logs after the fact. For broader context on running LLMs locally, see our comprehensive local LLM comparison; for general GPU sizing, our Gemma 4 hardware requirements guide is a useful reference too.
- Threshold tuning is required: Don't use the 0-1 score as-is — set and tune a threshold based on your own risk tolerance. A lower threshold means more false positives (over-blocking); a higher one means more misses.
- Verify Japanese performance before launch: Japanese is one of the 12 supported training languages, but Mistral hasn't published per-language benchmark scores. Check the score distribution against your own Japanese data before going live.
- Understand what Apache 2.0 does and doesn't cover: It removes restrictions on commercial use, modification, and redistribution, but it says nothing about the accuracy of the model's judgments. Plan for human review alongside it, since false positives and misses can both occur.
- Mind logging and privacy: Since the content being evaluated includes user input, log retention needs to align with your own privacy policy.
FAQ
What exactly does Shieldstral 1.0 3B do?
It's an open-weight multimodal moderation model that Mistral AI released on August 4, 2026. It answers a yes/no safety question about text, an image, or both, and returns it as a continuous score between 0 and 1. The moderation policy itself is passed in natural language at inference time, so you can update policy without retraining the model.
How much VRAM do I need to run it?
Mistral's own guidance is about 16GB of VRAM for BF16 inference — small enough for a single NVIDIA GPU. If you need to go lower, eight quantized GGUF variants (Q8_0, Q5_K_M, Q4_K_M, and others) are also published.
Can Shieldstral be used commercially?
Yes. Shieldstral 1.0 is released under the Apache 2.0 license, which permits commercial use, modification, and redistribution without restriction. You'll still want to check how false positives, logging, and retention fit your own terms of service and privacy policy before deploying it.
Does it work well on Japanese content?
It should handle it — the training set covers 12 languages across 54.1 million contrastive pairs, and Japanese is one of the supported languages (alongside English, French, Spanish, German, Italian, Portuguese, Dutch, Chinese, Korean, Arabic, and Russian). Mistral hasn't published per-language benchmark scores, so testing against your own data is still worthwhile.
How is this different from Llama Guard or ShieldGemma?
The main difference is that Shieldstral accepts the moderation policy itself as natural-language text in the <Instruct> field at inference time. Guard models built around fixed category taxonomies typically need retraining or a new release to change what they enforce; Shieldstral is designed so policy adjustments can happen without touching the model weights.
Related free tools (no sign-up, instant results)
Feel free to contact us
Contact Us