Mistral shipped Shieldstral 1.0 on 4 August 2026; it wins 4 of 18 text-safety rows

Summary. Mistral released Shieldstral 1.0, an Apache 2.0 multimodal safety classifier, on 4 August 2026. The launch post's own summary says it "outperforms models up to 7x its size." Counting best-in-row results on the model card's benchmark tables gives a different picture: across the 18 text-based rows Mistral publishes, GPT-OSS-Safeguard-20B holds the best score in 9 and Shieldstral in 4, and Shieldstral loses all 3 refusal-detection rows, at 90.3% against 93.9% F1 on WildGuardTest. The multimodal claim holds up: Shieldstral leads 2 of 3 image rows, taking VLGuard at 97.7% F1 against 88.5% for the next model, as of the model card last modified on 5 August 2026. Two operating details never appear in the launch post. The model card instructs "one policy per query," so a six-category taxonomy costs six forward passes per item, not one. And Mistral's model page, which still carries a Public Preview badge dated 4 August 2026, lists the parameter count as 3.8B rather than the 3B in the model's name, with the GPU RAM column showing "N/A" and the context capped at 32k tokens. As of 24 August 2026, twenty days after launch, Mistral's own moderation how-to still names only mistral-moderation-2603.

What Mistral actually published

Shieldstral 1.0 is a policy-adaptive classifier built on Ministral-3-3B-Base-2512 with a Pixtral vision encoder. Rather than predicting a fixed taxonomy, it takes a plain-language yes/no question at inference time and returns a calibrated score from the softmax over the yes and no logits. Mistral published it as open weights under Apache 2.0, alongside a technical report, and describes itself in the launch post as "an inaugural member of the Open Secure AI Alliance with NVIDIA and other organizations."

The interesting part is not the architecture. It is the gap between the announcement and the three Mistral-owned pages that describe the same model.

Count the rows

Mistral's model card publishes five benchmark tables. Every table bolds the best score per row. Counting those bolds is the fastest honest read of a guard-model release, because the vendor chose both the benchmarks and the comparison set.

The remaining text rows go to Qwen3Guard-8B (2) and Nemotron-3.5-Content-Safety-4B (3). Note that last one: a 4B model takes three best-in-row scores to Shieldstral's four, on tables Mistral assembled.

Refusal detection is the sharpest divergence. Shieldstral scores 90.3, 94.6 and 89.5 F1 on WildGuardTest, XSTest and PolyGuard; GPT-OSS-Safeguard-20B scores 93.9, 94.9 and 92.3 and takes all three rows. The launch post nonetheless lists refusal detection among the axes where Shieldstral "matches or outperforms open guard models up to 7× its size." On the XSTest row the gap is 0.3 F1, which is fair to call a match. On WildGuardTest it is 3.6.

Multimodal is where the release earns its claim. On VLGuard, Shieldstral scores 97.7 against 88.5 for OmniGuard-7B and 59.9 for LlamaGuard-4-12B. On UnsafeBench it scores 81.8 against 72.6. It loses the third row, LlavaGuard, to LlavaGuard-7B at 81.4 against 72.0 — and Mistral flags in a footnote that "some LlavaGuard test images were unavailable; scores are based on the available subset."

The launch post contradicts itself in two lines

The Shieldstral post carries a machine-written summary block above the article. That block says the model "outperforms models up to 7x its size." The hero line immediately below it says the model "matches models up to 7x its size on text safety and sets a new state of the art on multimodal moderation."

"Matches on text, state of the art on multimodal" is what the tables support. "Outperforms" is not, and it is the line that will be quoted. If you are evaluating guard models by reading vendor announcements, that one word is the difference between a swap-in decision and a benchmark run.

One policy per query

The cost model is the finding a buyer acts on, and it appears only in the model card's prompt-engineering notes.

Shieldstral answers one yes/no question per call. The card is explicit: "One policy per query. Shieldstral answers a single yes/no question per call. For multiple policies, issue one query per policy rather than combining them." The card does offer a cheaper mode — list categories in <Instruct> and ask one broad <Query> such as "Is this content unsafe?" — but that returns a single aggregate verdict, not per-category scores.

So there are two operating points, and they differ by a multiple, not a margin. If you need per-policy scores across a six-category taxonomy, that is six forward passes per moderated item. Mistral's own Moderation API, by contrast, returns scores for every category in one call. The launch post's "a verdict from a single token" is true per query and misleading per policy set.

For a chat product moderating both the prompt and the response, six policies becomes twelve inferences per turn. That is a capacity-planning number, and it is not in the announcement.

Three Mistral pages, three descriptions

The parameter number is worth a sentence because the marketing claim rests on it. Each of the two weight files in the Hugging Face repository is 7,698.2 MB; at bf16 that is roughly 3.85 billion parameters, matching the model page's 3.8B rather than the 3B in the name. "7x its size" against 3.8B is 26.6B, not 21B.

The docs gap is the one that will cost a team an afternoon. Mistral's Moderation and Guardrailing page — the page a developer lands on when implementing moderation — describes exactly two routes, Custom Guardrails and the Moderation API, and names only mistral-moderation-2603 and the deprecated mistral-moderation-2411. Shieldstral appears in that page's navigation tree and in a cookbook, and nowhere in its body. Twenty days after launch, Mistral's own how-to for moderation still routes you to the closed Premier model with a 128k context and jailbreak detection, not to the open one.

What the download actually costs

The Hugging Face repository is 15.43 GB. It ships two copies of the weights: consolidated.safetensors and model.safetensors, each 7,698.2 MB. A plain full-repository clone pulls both. The card's own deployment note says the model "fits in 16GB of VRAM in BF16", which is accurate for one copy — but a CI job that mirrors the repo moves twice the bytes it needs.

That last row is the cleanest test available. Mistral's public pricing page does not mention moderation at all, for either Shieldstral or mistral-moderation-2603. If you are budgeting a moderation layer on Mistral, there is no published unit price to budget against, and self-hosting the open weights is the only route with a cost you can calculate yourself. Teams already sizing local inference will recognise the arithmetic from running production LLMs on vLLM and Ollama.

How to evaluate this properly

Do not swap a guard model on a row count, including this one. Run the four checks the tables cannot answer.

First, measure on your own traffic at your own threshold. Shieldstral's published numbers use a 0.5 threshold; the score is continuous, so the operating point is yours to choose and the F1 you get will not be the F1 on the card.

Second, decide between per-policy scoring and a single aggregate verdict before you benchmark, because the two differ in cost by the number of policies you run.

Third, keep inputs inside 32k tokens. The card recommends staying within the training range and the model page lists 32k flat, so a long conversation history sent to the classifier is outside validated behaviour.

Fourth, treat "Public Preview" as what it says. The model page carries that badge; the launch post does not mention it.

Shieldstral looks like a real advance on image and text-plus-image moderation, and a reasonable, cheap, self-hostable option on text where an aggregate verdict is enough. It is not, on Mistral's own evidence, a text-safety leader. Those are different purchases. The same discipline applies to any guard model you put in front of an agent, which we covered in prompt-injection guardrails for AI agents, and it sits inside the wider model-selection question we track in the 2026 frontier model comparison.

India-specific considerations

For Indian teams, the open-weights route matters for a reason beyond cost. Running Shieldstral on your own GPUs keeps moderated content — which routinely contains personal data, and under the Digital Personal Data Protection Act 2023 is personal data being processed — inside infrastructure you control, with no cross-border transfer to reason about in a data-protection impact assessment. Mistral's separate regional-inference work, announced on 11 August 2026, addresses the hosted path; the Apache 2.0 weights sidestep the question entirely. The trade is operational: you now own the GPU capacity, the vLLM 0.26.0 upgrade path and the threshold calibration. We discussed the hosted-side residency detail in Mistral's agentic search and EU residency gaps.

What is still unknown

Mistral has not said whether Shieldstral will get an API model identifier, and no mistral-shieldstral string appears on its model page. It has not said whether Shieldstral replaces mistral-moderation-2603 or sits beside it, and the two have different context limits, 32k against 128k, plus a jailbreak category the moderation model has and Shieldstral's tables do not report. There is no published price for either. Until the guardrailing docs are updated, the safe assumption is that the API path and the open-weights path are separate products that happen to share a vendor.

FAQ

How many benchmark rows does Shieldstral actually win?

Across the four text-based tables on Mistral's model card there are 18 rows. Shieldstral holds the best score in 4 of them and GPT-OSS-Safeguard-20B in 9, with the rest split between Qwen3Guard-8B and Nemotron-3.5-Content-Safety-4B. On the three multimodal rows, Shieldstral leads 2.

Is the "outperforms models 7x its size" claim wrong?

The launch post says both "outperforms" in its summary block and "matches models up to 7x its size on text safety" in the hero line below it. The tables support "matches" on text and support the separate leading-score claim on multimodal moderation. The word "outperforms" overstates what the text tables show.

How many API calls does a six-policy taxonomy need?

Six. The model card states one policy per query and tells you to issue one query per policy rather than combining them. A single broad query across listed categories is possible, but it returns one aggregate verdict instead of per-category scores, which is a different product decision.

What context length is safe to send it?

Keep it inside 32k tokens. Mistral's model page lists the context as 32k, and the model card says training used sequences up to 32k and recommends staying within that range even though the architecture theoretically supports 256k. Longer conversation histories fall outside validated behaviour.

Is Shieldstral available through the Mistral API?

Not clearly. The Moderation and guardrailing documentation names only mistral-moderation-2603 and the deprecated mistral-moderation-2411, and no Shieldstral model identifier appears anywhere on its own model page in the Mistral docs. The published route today is the Apache 2.0 open weights on Hugging Face, plus a policy-moderation cookbook in the Mistral docs.

How big is the download?

The Hugging Face repository totals 15.43 GB because it ships two copies of the weights, consolidated.safetensors and model.safetensors, at 7,698.2 MB each. You need one. The model card says the model fits in 16 GB of VRAM in BF16, and vLLM 0.26.0 or newer is required.

Is it 3B parameters or 3.8B?

Mistral's model page lists Parameters (B) as 3.8 and Active (B) as 3.8, while the model name, the launch post and every benchmark table header say 3B. Each 7,698.2 MB weights file at bf16 works out to roughly 3.85 billion parameters, which matches the model page.

What does the Public Preview badge mean here?

Mistral's model page marks Shieldstral 1.0 as Public Preview and dates it 4 August 2026. The launch post does not mention a release phase. Treat the interface, the recommended prompt format and the benchmark positioning as subject to change until that badge is removed.

How eCorpIT can help

Choosing a guard model is a measurement problem before it is a procurement one, and vendor tables rarely match production traffic. Our teams benchmark candidate classifiers on your own logs at your own thresholds, size the per-policy call volume before it becomes a bill, and build the moderation layer as part of AI agent security and guardrails engagements. If you are weighing an open-weights guard model against a hosted moderation API, book a guardrail evaluation and we will start by measuring both on your data. Related reading: enterprise AI agents in production.

References

1. Introducing Shieldstral, Mistral AI, 4 August 2026
2. Shieldstral 1.0 3B model card on Hugging Face
3. Shieldstral 1.0 model page, Mistral docs
4. Moderation and guardrailing, Mistral docs
5. Mistral models overview
6. Mistral API pricing
7. Shieldstral technical report, arXiv 2607.25857
8. Hugging Face model API record for Shieldstral 1.0 3B
9. Ministral-3-3B-Base-2512 base model
10. In-region inference, open models, and new European infrastructure, Mistral AI, 11 August 2026
11. vLLM project
12. Axolotl Shieldstral fine-tuning examples

Last updated: 24 August 2026.