On 4 August 2026, Mistral AI announced Shieldstral 1.0 3B. Shieldstral expresses moderation as a natural-language question so one checkpoint can adapt to changing policies without retraining.
This release brief was checked against first-party material on 10 August 2026. The date above is the public announcement date, not the date a repository was created or a third-party provider added the model. Where access or weights arrived later, that distinction is recorded below.
Release record
| Field | Verified detail |
|---|---|
| Announcement | 4 August 2026 |
| Availability or weight release | 4 August 2026 as Apache-2.0 weights, documentation and inference recipes |
| Release type | open-weight policy-adaptive multimodal safety classifier |
| Access | Apache-2.0 weights supporting vLLM, llama.cpp, SGLang and Transformers |
| Architecture | a 3B Ministral-based classifier with a Pixtral vision encoder and single-token yes/no scoring |
| Maximum stated context | trained to 32K tokens; architecture supports 256K but Mistral recommends staying within the training range |
What changed
Most guard models freeze their harm taxonomy into the weights. Shieldstral instead takes an instruction, one yes-or-no policy question and the document to judge, then returns calibrated logits from a single token. That lets teams version policies outside the model and cover text, images or both with one 3B checkpoint. It is small enough for a single 16GB GPU, but each threshold still needs deployment-specific calibration.
The practical comparison is therefore not simply whether Shieldstral 1.0 3B has the largest headline score. Teams need to ask whether its architecture, access terms, latency, tool behaviour and evaluation setup match the workload they actually intend to run. A model can lead one harness while losing on cost, refusal behaviour, multilingual quality or repeatability in another.
Benchmarks worth retaining
| Evaluation | Reported result | How to read it |
|---|---|---|
| HarmBench prompt F1 | 99.4% | Held-out safety classification result at the published threshold |
| VLGuard multimodal F1 | 97.7% | First-party comparison against multimodal guard models |
| ToxicChat prompt F1 | 84.1% | Shows performance varies materially by safety dataset |
These are release-time results, not independently reproduced guarantees. A flexible natural-language policy can also be ambiguous; F1 results depend on dataset mappings, a 0.5 default threshold and the exact phrasing of the query. Scores should remain attached to the disclosed effort setting, agent harness, tool access, timeout, context-management policy and judge model. Moving a number into a procurement sheet without those conditions creates false comparability.
Architecture and access
Shieldstral 1.0 3B is described as a 3B Ministral-based classifier with a Pixtral vision encoder and single-token yes/no scoring with trained to 32K tokens; architecture supports 256K but Mistral recommends staying within the training range of stated context. Its access position at verification time is Apache-2.0 weights supporting vLLM, llama.cpp, SGLang and Transformers. That wording matters: open weights, source-available weights, an API, a product preview and a research demonstration give adopters very different rights and different levels of reproducibility.
Before deployment, record the exact model identifier or checkpoint, inference stack, quantisation, reasoning setting, region, price schedule and supplier terms. If the release uses a custom licence, read the licence itself rather than relying on the word “open” in launch copy. If it is API-only, preserve the dated documentation and change-notice route because the served snapshot can change without a downloadable artefact.
What an evaluation should test next
For Shieldstral 1.0 3B, a credible internal gate should include:
- a frozen set of representative tasks with pass, fail and abstain criteria;
- a matched baseline using the same tools, timeout, prompt budget and reviewer rubric;
- repeated runs to expose variance rather than reporting a single best attempt;
- latency, token use and total task cost alongside task success;
- adversarial, multilingual and long-context cases relevant to the real deployment; and
- rollback evidence showing the previous model can be restored safely.
The wider model change-control guide explains how to keep model, prompt, tool and corpus changes reconstructable. The AI dependency inventory guide covers the release and supplier records needed after deployment.
AIEngine verdict
Shieldstral is a strong open safety-model release and an important late-window addition. It should augment—not replace—application controls, human escalation and post-deployment sampling.
This is a launch assessment, not a certification. Benchmark leadership is useful evidence of where to test; it is not authorization to place the model in a high-impact workflow without domain evaluation, security review and an accountable owner.
Primary sources
Image provenance
Hero image: Mistral AI official release artwork. The locally served WebP is a crop of the first-party release or model-card asset recorded in the repository provenance manifest.
