PaperlayerView exact revision on arXiv

Source-linked AI summary

Shieldstral

Antonia Calvi, Avinash Sooriyarachchi, Giada Pistilli, Guillaume Lample, Maarten Buyl, Maximilian Augustin, Maximilian Müller, Pierre Stock, Tom Bewley, Wassim Bouaziz, Yimu Pan, Abdelaziz Bounhar, Abhijeet Somani, Aditi Kabra, Adrian Valente, Adrien Petralia, Adrien Sadé, Alan Jeffares, Albert Jiang, Aleksandr Timashov, Alexandre Cahill, Alexandre Gavaudan, Alexandre Laval, Alexandre Sablayrolles, Amélie Héliou, Amos You, André Jonasson, Andrew Bai, Andrew Ehrenberg, Andrew Zhao, Angele Lenglemetz, Anmol Agarwal, Arata Suzuki, Arjun Majumdar, Arthur Fournier, Artjom Joosen, Aylin Guliz Akkus, Aysenur Karaduman, Baptiste Bout, Baptiste Rozière, Baudouin De Monicault, Benjamin Holzschuh, Benjamin Lefaudeux, Benjamin Tibi, Bernhard Stadlbauer, Błażej Osiński, Camille Le Scao, Chaoran Yu, Charlotte Cronjäger, Chen-Yo Sun, Chris Bamford, Christian Wallenwein, Christophe Renaudin, Clémence Lanfranchi, Corentin Barreau, Corentin Sautier, Cristiana-Diana Diaconu, Cyprien Courtot, Daniel Marczak, Darius Dabert, Diego de Las Casas, Dominik Nuss, Dylan Rubini, Dzmitry Soupel, Elizaveta Demyanenko, Elliot Chane-Sane, Emilien Fugier, Emmanuel Gottlob, Erik Aas, Etienne Goffinet, Étienne Millon, Eujeong Choi, Fabian Paischer, Fabian Schlager, Faruk Ahmed, Federico Baldassarre, Filip Szatkowski, Florian Wiesner, Gabrielle Berrada, Gaëtan Ecrepont, Gaétan Lepage, Gaspard Blanchet, Gaspard Donada-Vidal, Gauthier Delerce, Gauthier Guinet, Genevieve Hayes, Georgii Novikov, Gianluca Galletti, Guillaume Breton, Guillaume Kunsch, Guillaume Martin, Guillaume Raille, Gunjan Dhanuka, Gunshi Gupta, Han Zhou, Harshil Shah, Hasan Furkan Vural, Hédi Hadiji, Hope McGovern, Hugo Cisneros, Hugo Thimonier, Indraneel Mukherjee, Ivan Cuevas Salazar, Jacques Sun, Jan Ludziejewski, Jason Rute, Jean Quentin, Jean-Hadrien Chabran, Jean-Malo Delignon, Jie Zhang, Joachim Studnia, Joep Barmentlo, Johannes Brandstetter, John Harvill, Jonas Amar, Jonas Schweizer, Joséphine Delas, Josselin Somerville, Julien Denize, Julien Tauran, Kartik Khandelwal, Khyathi Raghavi Chandu, Kilian Tep, Kush Jain, Larissa Laich, Laura Calem, Laurence Aitchison, Laurent Callot, Laurent Fainsin, Léo Cotteleer, Léonard Blier, Lingxiao Zhao, Louis Martin, Louis Serrano, Lucile Saulnier, Ludovic Ho Fuh, Luis Montero, Manon Chossegros, Marcin Możejko, Margaret Jennings, Markus Hennerbichler, Martin Alexandre, Mathieu Poirée, Mathieu Schmitt, Mathilde Guillaumin, Matthieu André, Matthieu Dinot, Matthieu Futeral, Maurits Bleeker, Mauro Comi, Max Mynter, Maxim Berman, Maxime Darrin, Maxime Louis, Melina Jingting Laimon, Mert Unsal, Mia Chiquier, Michael Pilcer, Michał Pietruszka, Michał Zając, Mikhail Biriuchinskii, Minh-Quang Pham, Minwoo Kang, Morgane Rivière, Namit Katariya, Nathan Grinsztajn, Nathan Simpson, Neeraj Aggarwal, Neha Gupta, Ola Mysiak, Oliver Leicht, Olivier Bousquet, Olivier Duchenne, Parag Jain, Patricia Wang, Patrick Blies, Patrick von Platen, Paul Jacob, Paul Wambergue, Paula Kurylowicz, Pavan Kumar Reddy, Pavel Kuksa, Philippe Pinel, Philomène Chagniot, Pierre-André Savalle, Piotr Milos, Prateek Gupta, Pravesh Agrawal, Quentin Desreumaux, Quentin Torroba, Quercus Hernandez, Ram Ramrakhya, Randall Isenhour, Ranjit Parva, Raul Perez Pelaez, Reinhard Sonnleitner, Rémi Delacourt, Richard Kurle, Rishi Shah, Rob Romijnders, Rohin Arora, Romain Sauvestre, Roman Soletskyi, Rosalie Millner, Rupert Menneer, Sagar Vaze, Samuel Barry, Samuel Belkadi, Samuel Humeau, Sanchit Gandhi, Sandeep Subramanian, Sarthak Mittal, Saskia Adaime, Sean Cha, Sebastian Kaltenbach, Shashwat Dalal, Shashwat Verma, Sherif Waly, Shrimai Prabhumoye, Siddhant Waghjale, Siddharth Gandhi, Simon Lepage, Simon Sorg, Soham Ghosh, Sophie Marbach, Srijan Mishra, Stanislas Lange, Steve Hong, Sumukh Aithal, Szymon Antoniak, Tarun Kumar Vangani, Teven Le Scao, Théo Cachet, Thibaut Lavril, Thomas Chabal, Thomas Coste, Thomas Defard, Thomas Foubert, Thomas Robert, Thomas Wang, Tianyu Zhang, Tim Lawson, Timothée Lacroix, Tobias Kronlachner, Tom Edwards, Tomas Hodan, Tuhin Das, Tyler Wang, Ulrick BLE, Umar Jamil, Umberto Tomasini, Valentin Macé, Van Phung, Vedant Nanda, Victor Jouault, Victor Letzelter, Victor Paltz, Victor Poucheret, Vincent Maladière, Vincent Pfister, Virgile Richard, Vladislav Bataev, Wen Ding Li, William Havard, William Marshall, Xinghui Li, Xingran Guo, Xinyu Yang, Yann Dreze, Yassine El Ouahidi, Yassir Bendou, Yihan Wang, Yves Martin des Taillades, Zaccharie Ramzi, Zhenlin Xu, Zsofia Csakany

arXiv:2607.25857v2cs.CLcs.CV

TL;DR

Existing guardrails often rely on fixed safety categories, while public safety datasets use divergent taxonomies. Shieldstral frames moderation as binary question answering and matches or outperforms larger models on text safety benchmarks while outperforming evaluated baselines on multimodal safety.

  • Problem

    Existing guardrails commonly use fixed safety taxonomies, while public safety datasets differ in their category taxonomies, leaving no one-size-fits-all taxonomy.

    Source: §1 · p. 1

  • Method

    Shieldstral evaluates content against a natural-language safety query and returns a continuous safety score, reducing diverse moderation tasks to binary question answering.

    Source: §1 · p. 1, §2 · p. 2

  • Results

    Shieldstral matches or outperforms larger models across text safety benchmarks and outperforms all evaluated baselines in multimodal safety, with 83.8% average F1.

    Source: §1 · p. 1

  • Takeaways & Limitations

    The results provide additional evidence for unified adaptive moderation, with a small adaptive model matching or outperforming larger fixed-taxonomy models.

    Source: §8 · p. 13

    The adaptability evaluation uses training and evaluation taxonomies that differ in structure, granularity, and category definitions.

    Source: §4.2 · p. 8

Abstract

from arXiv · show

We introduce Shieldstral, a 3B-parameter policy-adaptive multimodal safety classifier that matches or outperforms models nearly 7$\times$ its size on text safety benchmarks and sets a new state of the art on multimodal safety classification. Shieldstral formulates content moderation as a binary question-answering task. This simple formulation unifies diverse moderation tasks into a single yes/no problem, enabling heterogeneous safety datasets with divergent taxonomies to be consolidated under one training framework. We present the data construction recipe, covering curation and generation of approximately 54.1M samples and a fine-grained evaluation set to evaluate policy adaptability. Together, these enable a small adaptive model to match or outperform much larger models.

1 Introduction

Shieldstral unifies content moderation as policy-adaptive binary question answering, using a natural-language safety query and text and/or image content to produce a continuous safety score. With 54.1M curated samples, its 3B-parameter model reports strong text, multimodal, and policy-adaptive benchmark results.

Introduction

  • Fixed-taxonomy guardrails [Inan et al., 2023, Zeng et al., 2024, Han et al., 2024, Zhao et al., 2025] face heterogeneous safety datasets and cannot tailor labels to deployment context.The introduction contrasts cybersecurity research use with mental-health support, where the same content can carry different safety implications.Source: §1 · p. 1
  • Shieldstral turns moderation into binary question answering: a natural-language safety query and text and/or image content produce one continuous safety score.The score is derived from the softmax-normalized logits of the “yes” and “no” tokens and thresholded for binary classification.Source: §1 · p. 1, Figure 1 · p. 2
  • Curating 54.1M samples enables a 3B-parameter adaptive model to match or outperform much larger models.Shieldstral is built on Ministral-3B [Liu et al., 2026].Source: §1 · p. 1
  • 84.9% average F1 ranks Shieldstral at the top overall on text benchmarks; 83.8% average F1 beats all evaluated multimodal baselines; policy-adaptive evaluation reaches 91.3% F1.The paper also reports that Shieldstral matches or outperforms models nearly 7× its size across diverse text safety benchmarks.Source: §1 · p. 1

2 Task Definition

Shieldstral formulates policy-adaptive safety classification across varied datasets as a binary question-answering task.

2 Task Definition

  • Shieldstral recasts safety classification as binary question-answering and thresholds softmax-normalized yes/no token scores at 0.5 for inference.Training uses standard cross-entropy over the full output vocabulary.Source: §2 · p. 2
  • Each example combines a fixed system instruction with a user message containing <Instruct>, <Query>, and <Document> fields.The instruction sets the meta-task and input/output grammar; the fields frame evaluation context and strictness, ask a document-specific yes/no question, and supply a user prompt, model response, prompt–response pair, or image optionally with text.Source: §2 · p. 2

3 Training Data Construction

Shieldstral’s training data pipeline unifies heterogeneous safety datasets as yes/no questions and augments them with contrastive text and multimodal samples. It combines dataset-specific templates, contrastive curation and generation, and image-data processing to support fine-grained policy distinctions.

3 Training Data Construction

  • Approximately 54.1M samples—45.2M open-source text, 4.4M synthetic contrastive text, and 4.5M multimodal—unify heterogeneous safety sources.The sources span safety, toxicity, hate speech, jailbreak detection, content moderation, and response quality, with differing label formats and taxonomies.Source: §3 · p. 2, §3.1 · p. 3, §3.3 · p. 5

3.1 Template-Based Data Unification

  • Dataset-specific processors map diverse tasks into a shared instruction–query–document yes/no format, with varied phrasings and strictness levels tailored to each dataset.Query templates support category-specific, binary safety, and refusal-detection questions.Source: §3.1 · pp. 3–4

3.2 Contrastive Sample Curation

  • Contrastive curation pairs content with matching and non-matching queries, using category, demographic, and safe-content negatives to teach distinctions beyond coarse safety labels.An open-source LLM cross-validates binary and per-category labels, removing samples where its classification disagrees with the dataset label.Source: §3.2 · pp. 4–5

3.3 Contrastive Sample Generation

  • LLM-generated contrastive rewrites yield approximately 4.4M samples, pairing target-category positives with sibling-category negatives to distinguish subtle policy-relevant differences.Generation uses a taxonomy of 11 superclasses and 73 leaf categories; hierarchical ancestor queries add positive examples without additional LLM calls.Source: §3.3 · p. 5

3.4 Image Data Processing

  • To address scarce visual safety data, the image pipeline combines moderation sources with general-purpose image datasets, mapping heterogeneous labels into yes/no questions and yielding approximately 4.5M multimodal samples.It uses about 2,000 query phrasings across 14 visual subcategories, including inverse formulations, and reranker filtering plus sibling-category hard negatives to improve pair quality and discrimination.Source: §3.4 · pp. 5–6

4 Adaptability Evaluation

Shieldstral’s adaptability evaluation tests whether it can distinguish policy categories beyond its training labels, using an independently designed taxonomy and contrastively generated examples. The evaluation taxonomy differs from training in category structure, granularity, and definitions.

4 Adaptability Evaluation

  • Adaptability is evaluated on policy categories that drift from training or are absent from it, using contrastive samples and an independently designed taxonomy.This aims to test genuine discrimination rather than memorisation of training categories.Source: §4 · pp. 6–7

4.1 Taxonomy Design

  • The three-level evaluation taxonomy has 12 super classes, 26 subcategories, and 52 leaves, with fixed canonical queries and contrastive sibling-category examples.It uses disjoint, type-based categories with operational names and at least two sibling categories per subcategory. A separate LLM verifies label correctness and answerability; positive and negative samples receive the same target query, and test generation and verification use different LLMs and seed samples from training.Source: §4.1 · pp. 7–8

4.2 Taxonomy Divergence

  • No evaluation leaf maps one-to-one to a training leaf, despite 10 of 12 evaluation super classes having a loose training counterpart.The taxonomies also differ in structure, granularity, category names, and groupings; evaluation uses exactly two leaves per subcategory and three severity tiers, versus variable subcategory sizes and four tiers in training.Source: §4.2 · p. 8

5 Model Architecture

Shieldstral is built on a 3B-parameter causal language model from the Mistral-3 family, with native multimodal support via a Pixtral vision encoder.

Model Architecture

6 Training Recipe

Shieldstral trains specialized public-data and public-plus-generated-data checkpoints with LoRA, then merges checkpoints to combine benchmark calibration, fine-grained policy adaptation, and general instruction following.

6.1 Fine-Tuning

  • LoRA [Hu et al., 2022] fine-tunes language-model parameters with cross-entropy on the single output token; because LoRA and full SFT showed no significant difference (Table 6), they chose LoRA for efficiency.The public-data checkpoint excludes generated data, while the other uses public and generated taxonomy data from the full pipeline.Source: §6.1 · p. 9

6.2 Model Merging

  • SLERP merges checkpoints without additional training, combining PG’s fine-grained policy-adaptive generalization with P’s standard-benchmark calibration.The two regimes have complementary strengths, although PG may suffer from distribution drift.Source: §6.2 · p. 9
  • The final checkpoint uses pairwise SLERP merges of PG (0.6), P (0.3), and Ministral-3B-Instruct (0.1), adding general instruction-following capability.PG is trained on public and generated taxonomy data; P uses public data only; the base instruct checkpoint contributes general instruction following.Source: §6.2 · p. 9

7 Evaluation

Shieldstral performs strongly across text, adaptability, and multimodal safety evaluation despite its 3B size; ablations show that generated taxonomy data and model merging improve generalisation to unseen policies. All evaluation samples are held out from training.

7 Evaluation

  • 16 benchmarks across 21 splits and 10 baselines are evaluated using samples held out from training.The benchmark and baseline summary is presented in Table 4.Source: §7 · p. 9, Table 4 · p. 10

7.1 Text Results

  • 84.9% overall F1 lets 3B Shieldstral match 20B GPT-OSS-Safeguard-20B on text evaluation, with strong refusal detection performance.The evaluation covers prompt classification, response classification, and multilingual evaluation.Source: §7.1 · p. 9, Figure 5 · p. 11, Figure 6 · p. 12

7.2 Adaptability Results

  • 94.1% F1 gives GPT-OSS-Safeguard-20B the highest adaptability score, while Shieldstral reaches 91.3% with 3B parameters and single-token output.GPT-OSS-Safeguard-20B benefits from per-category policy prompts, reasoning, and greater size; its and Nemotron-3.5-Safety’s long reasoning traces reduce inference efficiency.Source: §7.2 · p. 9, Figure 7 · p. 12

7.3 Multimodal Results

  • 83.8% overall F1 makes Shieldstral the top multimodal model, ahead of OmniGuard’s 77.6%, despite using 3B rather than 7B parameters.Shieldstral leads on VLGuard and UnsafeBench, while LlavaGuard-7B scores highest on its namesake benchmark at 81.4%.Source: §7.3 · p. 10, Figure 8 · p. 12

7.4 Ablations

  • 61.1% F1 from public-data fine-tuning generalises to the unseen taxonomy, and generated taxonomy data adds 23.3% F1 to reach 84.4%.The base Ministral-3B has 0% recall without safety fine-tuning; the independently designed evaluation taxonomy uses different category names, granularity, and groupings, supporting genuine policy-adaptive generalisation rather than memorisation.Source: §7.4 · pp. 10, 12
  • LoRA and full SFT perform slightly better on different validation sets, with no significant overall difference, so the authors adopt LoRA for training efficiency.Source: §7.4 · p. 12, Table 6 · p. 13
  • 88.7% taxonomy F1 results from merging 0.6 PG, 0.3 P, and 0.1 I, recovering most of the Aegis v2 drop while combining complementary data regimes.Adding I at weight 0.1 generally improves recall and F1; PG alone slightly degrades Aegis v2 performance versus P but raises taxonomy F1 from 61.1% to 84.4%.Source: §7.4 · pp. 12–13, Table 7 · p. 13

8 Conclusion

Shieldstral is a 3B-parameter policy-adaptive safety classifier that casts content moderation as binary question answering. Its training pipeline unifies heterogeneous data and enables strong performance on text and multimodal safety classification.

8 Conclusion

  • By consolidating divergent training datasets, Shieldstral can match or outperform much larger fixed-taxonomy models while providing policy-adaptive moderation.The conclusion presents this as evidence for unified adaptive moderation.Source: §8 · p. 13
  • Shieldstral formulates content moderation as binary question answering and unifies heterogeneous sources through template-based unification and contrastive sample generation.The resulting 3B-parameter classifier targets both text and multimodal safety classification.Source: §8 · p. 13

A Multilingual Evaluation Results · B Full Evaluation Taxonomy

Shieldstral performs strongly overall in multilingual evaluation but struggles with prompt classification in Arabic, Indonesian, and other low-resource languages. The evaluation taxonomy spans 12 super classes, 26 subcategories, and 52 leaf categories.

A Multilingual Evaluation Results

  • Prompt classification is a weakness for Arabic and Indonesian, as well as other low-resource languages, despite strong overall multilingual performance.The multilingual results are reported in Table 8.Source: A Multilingual Evaluation Results · p. 17

B Full Evaluation Taxonomy

  • The evaluation taxonomy comprises 12 super classes, 26 subcategories, and 52 leaf categories.Table 9 presents the complete taxonomy.Source: B Full Evaluation Taxonomy · p. 17, Table 9 · p. 17
  • The taxonomy covers physical-property, financial, identity, system, and account attacks, including theft, fraud, hacking, malware, and phishing.It also lists vandalism, corporate crime, counterfeiting, and account takeover.Source: B Full Evaluation Taxonomy · p. 18
  • Other listed classes include personal-data exposure, confidential data, and self-harm, with leaves such as doxxing, trade secrets, suicide promotion, and health risks.Source: B Full Evaluation Taxonomy · p. 18
  • The taxonomy also includes child safety, manipulation, reputation harm, and election integrity, with leaves including child abuse, emotional blackmail, defamation, and voter suppression.Source: B Full Evaluation Taxonomy · p. 18
  • Further classes cover state security, media theft, and commercial theft, with leaves including espionage, piracy, technology theft, and brand abuse.Source: B Full Evaluation Taxonomy · p. 18
  • The remaining listed classes include ecosystem damage, animal harm, and drug crimes, with leaves such as pollution, poaching, drug distribution, and drug manufacturing.Source: B Full Evaluation Taxonomy · p. 18

C Training vs. Evaluation Taxonomy Comparison

The training taxonomy consolidates heterogeneous source categories into a broad, uneven structure, while the evaluation taxonomy is compact and symmetric to support contrastive hard-negative evaluation. Training uses varied queries; evaluation fixes queries for reproducibility.

Structural differences

  • The training taxonomy consolidates categories into 11 super classes and 73 leaves, with uneven granularity reflecting differences among source datasets.SC3 has 15 categories across 5 subcategories, while SC5 has 2 categories.Source: C Training vs. Evaluation Taxonomy… · p. 18
  • The evaluation taxonomy has 12 super classes and 52 leaves, with exactly 2 leaves per subcategory to ensure sibling disjointness and contrastive partners for hard-negative evaluation.Each super class has 2–3 subcategories.Source: C Training vs. Evaluation Taxonomy… · p. 19

Query strategy

  • Training randomly samples 5 prompt-based and 5 response-based templates per super class, while an LLM rewriter generates a fresh query for each rewritten sample.Across 11 training super classes, the templates total 110; random sampling varies phrasing across epochs.Source: C Training vs. Evaluation Taxonomy… · p. 19
  • Evaluation assigns one fixed prompt and one fixed response query to each leaf, subcategory, and super class, making runs deterministic and reproducible.The taxonomy includes 52 leaves, 26 subcategories, and 12 super classes.Source: C Training vs. Evaluation Taxonomy… · p. 19

Shared super-class alignment

  • Ten of 12 evaluation super classes have training counterparts, but evaluation splits training SC4 into three classes and excludes training-only SC10 because dedicated external benchmarks cover it.SC4 is divided into Property Crime, Cybercrime, and Drug Crimes; SC10 covers jailbreak and prompt injection.Source: C Training vs. Evaluation Taxonomy… · p. 20

D Complete Category-Level Results · E LLM Prompts for Taxonomy Data Generation

The appendix reports fine-grained taxonomy F1 scores and describes three prompting strategies for generating unsafe data. Training prompts target a category while excluding a sibling; evaluation prompts create matched positive-negative versions, and binary prompts generate coarse-grained unsafe content.

D Complete Category-Level Results

E LLM Prompts for Taxonomy Data Generation

E.1 Category-Specific Rewriting (Training)

  • Training rewrites target a specified unsafe category while explicitly avoiding a negative sibling category, for standalone text or prompt–response pairs.For response variants, the original prompt is prepended as context and only the response is rewritten.Source: §E.1 · p. 23
  • Training outputs include a rewritten text and diverse English positive and negative yes/no queries about the target and negative categories.The rewritten text remains in the original language.Source: §E.1 · p. 23

E.2 Dual-Version Rewriting (Evaluation)

  • Evaluation uses one API call to create positive and negative unsafe versions of the same source text, paired with a shared category-based yes/no query.The positive version excludes negative-category content; the negative version excludes terms related to the target category.Source: §E.2 · p. 23

E.3 Binary Rewriting

  • Binary rewriting makes safe text unsafe through any naturally fitting violation, without targeting a specific category, and generates a diverse safety or harmfulness query.LLM calls use a safety-data-generation system message and temperature 0.7.Source: §E.3 · p. 24

Related papers

Loading 2607.25857v2…