Shieldstral Makes Self-Hosted Moderation Actually Cheap Mistral released Shieldstral, a 3B-parameter multimodal safety classifier under Apache 2.0, that accepts plain-language moderation policies at inference time and returns a calibrated score from a single output token, running on one 16GB GPU. The company reports 84.9% average F1 on text safety benchmarks and 83.8% on multimodal benchmarks, matching gpt-oss-safeguard-20B at a seventh of the size, with 91.3% F1 on a held-out taxonomy. Shieldstral is a LoRA fine-tune of Ministral-3B with Pixtral vision encoder, trained on roughly 54 million samples. AI https://sourcefeed.dev/c/ai Article Shieldstral Makes Self-Hosted Moderation Actually Cheap Mistral's Apache-2.0 3B classifier scores text and images against plain-language policies on a single 16GB GPU. Mariana Souza https://sourcefeed.dev/u/mariana souza For two years, running your own content moderation meant choosing between bad options: a fixed-taxonomy classifier you'd have to retrain every time policy changed, a 20B-parameter policy-reasoning model that needs serious hardware, or shipping every user message to someone else's API. Mistral https://mistral.ai/news/shieldstral/ just collapsed that trade-off. Shieldstral, released today under Apache 2.0, is a 3B-parameter multimodal safety classifier that takes your moderation policy as a plain-language question at inference time and returns a calibrated score from a single output token — on one 16GB GPU. That combination, not any single ingredient, is the story. Policy as input, verdict as one token The idea of feeding a guard model your policy instead of baking categories into its weights has been converging for a while. Meta's Llama Guard line trained against the MLCommons hazard taxonomy — you could nudge categories in the prompt, but the model fundamentally knew one rulebook. Google's ShieldGemma got closer, accepting guideline text and reading a yes/no probability off the logits. Then OpenAI's gpt-oss-safeguard https://openai.com/index/introducing-gpt-oss-safeguard/ went all-in last October: full policy documents, chain-of-thought reasoning about them, Apache 2.0 — but at 20B and 120B parameters, with reasoning tokens on every call. Shieldstral takes the bring-your-own-policy premise and strips it to the bone. Every request is three parts — a system instruction, a natural-language safety question, and the content to judge — and the model emits exactly one token. The safety score is the softmax over the "yes" and "no" logits, thresholded at 0.5 by default. No reasoning chain, no generated rationale, no variable-length output. Moderation cost becomes essentially prefill cost. The paper https://arxiv.org/abs/2607.25857 behind it is a data-engineering exercise more than an architectural one: a LoRA fine-tune of Ministral-3B with the Pixtral vision encoder attached, trained on roughly 54 million samples — 45M unified open-source text examples, 4.4M synthetic contrastive pairs generated against a 73-category taxonomy, and 4.5M image samples. The contrastive pairs matter most: the same content paired with matching and non-matching policy questions, which is what teaches the model to actually read your policy rather than pattern-match on the content. The numbers, with the usual asterisk Mistral reports 84.9% average F1 across text safety benchmarks ToxicChat, OpenAI Moderation, WildGuardTest, BeaverTails, and others , which it says matches gpt-oss-safeguard-20B at a seventh of the size, and 83.8% on multimodal benchmarks, ahead of OmniGuard-7B. The most interesting result is 91.3% F1 on a held-out taxonomy the team built with deliberately different category names and granularity than the training taxonomy — that's the number that tests whether policy adaptation is real or memorized. These are the authors' own evaluations; nobody independent has reproduced them yet, and guard-model benchmarks are notoriously sensitive to threshold choices. But the comparison set is honest — ShieldGemma 2, WildGuard, Llama Guard 4 12B , Qwen3Guard 8B , gpt-oss-safeguard — and the claim isn't "best classifier ever," it's "parity at a fraction of the cost," which is the claim that changes deployment decisions. What you'd actually do with it Deployment is deliberately boring: vllm serve mistralai/Shieldstral-1.0-3B --max-model-len 32768 And a moderation call is just a formatted prompt: prompt = "