Welcoming Mistral's Shieldstral to the ROOST Model Community
Written by
Jeremie Ponak
Published
Last week Mistral released Shieldstral, a 3B open weights safety classifier for text and images under Apache 2.0. It now joins the ROOST Model Community alongside other models such as gpt-oss-safeguard, CoPE-B, and the Mila Suicide Prevention Guardrail as part of a growing set of open, auditable safety models. Shieldstral comes out of Mistral's research team, built to meet two of their own needs: screening the datasets used to fine-tune their models, and moderating both inputs and outputs from large language models in Vibe.
Releasing Shieldstral in the open mattered to us: safety tooling should be sovereign — run where you run, governed by your policy. A guardrail only gets better when the community can push on it.
— Pierre Stock, VP of Science at Mistral
This is a powerful moment for people who believe that when it comes to safety and security, openness isn't the poison, it's the antidote. Shieldstral is a safety tool built to be studied, adapted, and held to account by everyone it protects, and ROOST is delighted to welcome this model to the RMC. Every company that opens its safety tooling makes the commons richer, and makes safe deployment easier for the next team, whatever their size.
— Dr. Camille François, President and CEO, ROOST
About Shieldstral
Shieldstral is a policy-adaptive, multimodal safety classifier. It sits in front of generative AI systems and flags harmful inputs and outputs, across both text and images.
Three design choices make it stand out:
One model, any policy – Many guardrail models classify content against a fixed list of harm categories. Shieldstral espouses the “bring your own policy” (or policy steerability) approach which model developers are increasingly turning to by default: operators express their moderation criteria as a natural-language question ("Does this content promote violence?" "Does this image contain NSFW material?") and mark whether the outputs pass or fail. A trust and safety team can tighten, loosen, or redefine its policies by editing a sentence, with no retraining and no redeployment. The ROOST community gathers builders from diverse organizations, caring for different communities with their specific rules and context: this flexibility is a welcome trait for moderation models.
This is how it works in practice. Shieldstral turns moderation into a single yes or no question. Each call has three parts:
<Instruct>: the evaluation context and how strict to be. Usually constant across a product surface.
<Query>: one yes or no question, such as "Does this content promote physical violence?"
<Document>: the content being judged. A prompt, a response, a prompt and response pair, or an image with optional text.
A team running response moderation sets the instruct once for its product, the query asks "Does this content promote physical violence?", and the document is the user message under review. The model answers with the probability of yes. To enforce a different rule, change the question. To enforce several, ask one query per policy.
How faithfully any steerable model follows the policy you supply, rather than the safety priors it learned in training, is itself an open evaluation question, and early results vary with how the policy is written. In our own testing, Shieldstral rewards detailed, explicit policies and does less with terse ones. We say more about why this is hard to measure below.
Small – At 3 billion parameters, Shieldstral runs on a single consumer GPU, or on CPU for low-throughput use. On Mistral's published evaluations, it matches or beats safety models roughly seven times its size, with an average F1 of 84.9% across text safety benchmarks and state-of-the-art results among evaluated baselines on multimodal safety. Cost is often the constraint that decides whether safety filtering runs on every call or only on a sampled few. A 3B model that fits on a single consumer GPU allows a self-hoster to gate their chatbot's inputs and outputs, a nonprofit to moderate their platform, and a frontier lab to screen tens of millions of training samples. At this size, evaluations and retraining can also be run optimally.
Multimodal – Open multimodal safety classifiers are scarce and in high demand. Shieldstral evaluates text, images, and combined content in a single model.
A safety model is only as useful as the tooling around it: ROOST tools exist so that any organization can actually put cutting-edge tools like Shieldstral to work. Shieldstral's continuous safety scores can feed human review queues in Coop, ROOST's open source review console, and its binary decisions can drive automated enforcement in Osprey, ROOST's open source rules engine.
Where Open Guardrails Are Going
Through the RMC, we build with practitioners and hear directly from the teams deploying models for detection in production, and join forces with organizations at the forefront of making open safety models. Here are a few reflections from this summer, as we welcome Shieldstral to the RMC.
Cost per call reflects design, not measured latency. This is driven by 1) how much a model generates per decision (a single token for single-pass classifiers, a full reasoning trace for reasoning models) and 2) model size.
Steerability follows the Shieldstral paper's "adaptive" classification. CoPE-B's text classifier is open weights; its multimodal variant is subscriber-only.
BYOP (“Bring Your Own Policy”) models are becoming a norm in the field: Policy steerability is becoming a norm in the field. The vast majority of open weights safety models added to the RMC or released to the developer community in 2026 are policy-adaptive. This is pluralism at work – model creators don’t have to be the ones deciding what counts as harmful on your platform.
Steerable models are specializing: new models are increasingly either smaller and lighter, to allow for fine-tuning and modification, or heavy but with high explicability. This trend is bringing natural complementarity to the field. Reasoning guardrails are helpful for teams and use-cases where auditability or justifications are at a premium. Meanwhile single-pass guardrails may be ideal when you’re enforcing that policy on every call, at scale, on modest hardware. A handful of organizations using ROOST tools and models from the RMC even run both types of models at different stages in their pipeline and based on the nature of the workload.
The newest wave is also multimodal by default: newest wave is also multimodal by default, allowing for the evaluation of images alongside text, unlike the 2024 generation that was consistently text-only. Harms are multimodal and contextual: a screenshot of a conversation, a meme with the text baked into the image, and specializing in format can leave gaps. Stitching together multiple classifiers means encoding the same policy three times, adding complexity and requiring reconciliation, on top of risking policy drift. By prioritizing mulit-modality, model developers are expecting developers to choose flexibility in format, while asking for intentionality in processing choice.
Figure 2. Open guardrail models at a glance.
Policy-steerability also introduces new layers of opportunity: with every model starting from craftable, individualized policies, the policy itself becomes an asset. Precise, machine-readable definitions of harm, written by people who understand the communities they protect lead to more effective safety. Through policy packs (shareable examples of well-written policies contributed by the community) the RMC gives practitioners a repository for effective policies, written by the teams building and using safety models in production.
These models can be difficult to evaluate. While fixed-taxonomy classifiers are tested on whether their policies catch violative content and leave benign content alone, a steerable model evaluation must also consider whether the model follows specific policies supplied by the evaluator. The two tests can diverge: a model can score well on a safety benchmark because its built-in judgment happens to match your rules, then miss the moment custom rules differ from that judgment. Which of these evaluators measure is easy to conflate, with different evaluations of the same model reaching different conclusions depending on which one they test. Building that shared evaluation vocabulary, across labs, policies, and harm areas, is early work, and it is exactly the kind of open, comparative assessment the RMC exists to host.
Get involved
Join the ROOST Model Community: come to office hours on September 2nd, ask implementation questions, and share policies that work
Try Shieldstral: open weights under Apache 2.0
Read the model card: benchmarks, prompting guidance, and limitations
Read the technical report: how it was built and evaluated
The RMC exists so that no organization has to choose between running no safety model at all and paying for one it cannot inspect. Every model added, every policy pack shared, and every benchmark published makes that choice easier for the next team – and every model in the RMC is openly licensed, designed for safe and ethical use. A huge thank you to the Mistral team for contributing to this growing community!