Shieldstral Encodes Moderation Policies in Queries; 3B Multimodal Model Achieves 84.9% Average F1 on Text Safety Benchmarks

Mistral AI’s research team has unveiled Shieldstral, a 3-billion-parameter multimodal safety classifier based on Ministral-3B-Base-2512. Rather than forcing inputs into fixed labels such as “violence,” “hate,” or “sexual content,” it accepts a natural-language policy query—for example, “Does the content encourage violence?”—and outputs normalized yes/no probabilities for text, images, or a combination of both. This allows the same content to be reassessed under different policies for children’s services, cybersecurity research, or general-purpose chat products.

The training corpus contains approximately 54.1 million examples, including 45.2 million public text examples, 4.4 million synthetic contrastive examples, and 4.5 million multimodal examples. The team converted heterogeneous datasets into a three-column instruction, query, and document format, then paired the same content with both relevant and irrelevant harm queries. This forces the model to identify the specific policy at issue instead of learning only a coarse safe/unsafe boundary. Using LoRA, the researchers separately trained checkpoints on public data and on public data augmented with synthetic examples, then merged them with the base instruction model using SLERP.

In the official experiments, which covered 16 benchmarks, 21 dataset splits, and 10 comparison models, Shieldstral achieved an average F1 of 84.9% for text safety and 83.8% for multimodal safety. On a fine-grained policy test designed independently without directly reusing training labels, it achieved an F1 of 91.3%. For engineering teams, this interface could reduce the need to retrain a classification head for every product and allow policy versions to be recorded directly in requests and audit logs.

One limitation is that all reported figures currently come from the authors’ own evaluations. Some test data was also generated and validated by LLMs, potentially preserving shared biases. A fixed 0.5 threshold is also unsuitable for direct deployment in scenarios where the cost of false positives varies widely. At the time of publication, the paper describes the full methodology, but corresponding model weights and reproducible inference code have not been released. Key issues to watch include weight licensing, latency, calibration curves, and whether the model remains robust against prompt injection, conflicting policies, and subtle Chinese-language expressions.