Guard models: safety as an open-weights product

Organisations deploying large language models (LLMs) face a growing need for effective safety mechanisms that can moderate content in real time. Guard models act as classifiers that inspect prompts and responses to prevent harmful outputs. These systems are evolving rapidly, especially in open ecosystems such as Hugging Face, where multiple implementations are available for different use cases.

Guard model architectures and capabilities

Guard models can be deployed either in front of or behind the main model to assess inputs and outputs. Meta’s Llama Guard 4 (12B, 2026) is a multimodal guard that processes text and multiple images within a single checkpoint. It supports 14 hazard categories and shows a 20 percent recall improvement over its vision predecessor in multi-image scenarios. This performance gain is measured in the model’s ability to correctly identify safety issues in complex image-text combinations.

Google’s ShieldGemma line offers a scalable approach with models at 2B, 9B, and 27B parameters for text moderation. ShieldGemma 2 (4B), built on Gemma 3, extends this capability to image moderation, covering both synthetic and natural images. The 4B parameter size allows for a balance between performance and deployment efficiency, making it suitable for edge and cloud settings.

Language and modality coverage

Qwen3Guard demonstrates broad language support, spanning from 0.6B to 8B parameters. It is trained on 1.19 million labelled prompts and responses, categorising outputs into Safe, Controversial, and Unsafe across 9 categories. The model supports 119 languages, making it suitable for global deployments. A Stream variant of Qwen3Guard performs token-by-token classification during generation, enabling real-time moderation.

IBM’s Granite Guardian 3.3 aligns with the IBM AI Risk Atlas taxonomy, ensuring consistency with industry standards. The model family includes a 38-million-parameter variant specifically designed for detecting hate, abuse, and profanity. This low-parameter model is ideal for edge deployment, where computational resources are limited.

Emerging trends in guard model design

The frontier of guard model development is shifting towards reasoning-aware systems. NVIDIA’s Nemotron 3.5 Content Safety, released in 2026, allows custom policies to be specified in natural language at inference time. It generates reasoning traces that are auditable, enabling compliance in regulated environments. This approach moves beyond static moderation to support domain-specific and adaptive safety protocols.

Selection criteria for deployment

When choosing a guard model, the selection process should begin with the modality it supports, text only, images, or both. Next, language coverage must align with the deployment’s target regions. Latency constraints will then determine whether a 38-million-parameter or 12-billion-parameter model is suitable, as the compute range spans 300 times. Finally, sectors requiring compliance or auditability may benefit from reasoning-aware models like Nemotron 3.5.

What to take away

Organisations should evaluate guard models based on modality, language, and computational constraints. Emerging models like Nemotron 3.5 are shifting the focus from static to policy-aware moderation. The right guard model depends on deployment-specific requirements such as latency, multilingual support, and explainability.

Reference

Sources and further reading

• Llama Guard 4 model card
• Qwen3Guard collection
• Nemotron reasoning guardrails