Shieldstral

Abstract: We introduce Shieldstral, a 3B-parameter policy-adaptive multimodal safety classifier that matches or outperforms models nearly 7$\times$ its size on text safety benchmarks and sets a new state of the art on multimodal safety classification. Shieldstral formulates content moderation as a binary question-answering task. This simple formulation unifies diverse moderation tasks into a single yes/no problem, enabling heterogeneous safety datasets with divergent taxonomies to be consolidated under one training framework. We present the data construction recipe, covering curation and generation of approximately 54.1M samples and a fine-grained evaluation set to evaluate policy adaptability. Together, these enable a small adaptive model to match or outperform much larger models.

• The paper introduces a unified content moderation framework that reframes safety moderation as a binary question-answering task adaptable to diverse, policy-driven requirements.
• It employs a structured prompting approach with extensive, heterogeneous training data and LoRA-based fine-tuning to optimize efficiency and adaptivity.
• The model achieves state-of-the-art performance on both textual and multimodal benchmarks, matching larger models while reducing computational overhead.

Shieldstral: A 3B Adaptive Multimodal Safety Classifier for Unified Content Moderation

Problem Statement and Motivation

Content moderation for large foundation models has historically relied on classifiers built around fixed safety taxonomies, leading to misalignment with real-world deployment needs and fragmented benchmarking. As user and context requirements vary (e.g., between a cybersecurity tool and a mental health assistant), fixed-category models are insufficiently adaptive. Furthermore, available safety datasets employ heterogeneous taxonomies with divergent annotation conventions, posing data unification and generalization challenges for both model training and subsequent evaluation.

Shieldstral addresses these problems by reframing moderation as a binary question-answering (QA) task, enabling arbitrary deployment-specific policy queries and compositional, multilingual, and multimodal moderation from a single compact model.

Unified Adaptive Moderation via Structured Prompting

Shieldstral, a 3B-parameter model based on Ministral-3B, accepts as input a system instruction (establishing the moderation policy and framing), a specific user-defined natural language query (encoding the moderation criterion), and the content to evaluate (text and/or image). Moderation is reduced to a binary QA: the model predicts "yes" or "no" to the query, using the softmax-normalized logits over these tokens as a continuous safety score, thresholding at 0.5 for binary classification.

Figure 1: The Shieldstral architecture, showing structured input formulation and binary scoring.

This unified formulation enables seamless adaptation to both content type and policy—all in a single inference pass—without retraining or maintaining parallel classifiers for each taxonomy, language, or modality.

Large-Scale Heterogeneous Data Engineering

A central technical achievement is the construction and unification of diverse training data at unprecedented scale (54.1M samples), combining open-source, synthetic (contrastive), and multimodal (image+text) sources. Heterogeneous datasets with various formats and taxonomies are templated into an instruction–query–document format, rephrased for linguistic robustness, and extensively paraphrased. Multiple template families for document formatting and diverse category-specific, binary, and refusal-detection queries are generated to maximize coverage and regularization.

Figure 2: Examples of unified training samples for text-only and multimodal (image+text) cases.

Contrastive Sample Generation and Policy Adaptivity

A major innovation is the use of systematic contrastive data—both by pairing content with queries for present and absent categories, and by LLM-based rewriting of safe samples into targeted unsafe variants across a fine-grained, hierarchical taxonomy. This trains the model not just to recognize general unsafety but to make fine-grained policy-driven distinctions, forming the basis of high adaptability to novel or user-specific moderation policies at inference.

Additional LLM reranking and cross-validation steps filter erroneous labels and refine the training signal. For image data, label mapping, query mutation, and hard-negative generation address the scarcity and noise of visual safety data.

Model Architecture and Training Recipe

Shieldstral builds on Ministral-3B with Pixtral as its vision encoder. Training employs LoRA-based parameter-efficient fine-tuning. To maximize both public-benchmark calibration and fine-grained policy discrimination, two model regimes are fine-tuned: one on public safety data, the other also including contrastive synthetic taxonomy data. The final checkpoint is obtained via triple SLERP (spherical linear interpolation) merging—allowing different competencies (public benchmark calibration, policy adaptability, generic instruction following) to synergize without further end-to-end retraining.

Evaluation Methodology

Shieldstral is benchmarked against 10 baselines (3–20B, both adaptive and fixed-taxonomy) on 16 established text and multimodal safety tasks, with special attention to multilingual and multimodal generalization. Adaptability is rigorously tested on a held-out, LLM-generated taxonomy distinct from the training set in structure, naming, and granularity—ensuring results are not explained by memorization.

Textual Safety and Policy Adaptivity

Despite being the smallest in the comparison, Shieldstral achieves an average F1 of 84.9% on textual moderation benchmarks, matching the performance of the 20B GPT-OSS-Safeguard model.

Figure 4: F1 scores on safety classification benchmarks, demonstrating strong performance for Shieldstral despite its smaller size.

It shows robust multilingual performance but underperforms on Arabic and Indonesian prompt classification, consistent with other compact models’ weaknesses on certain low-resource languages.

On fine-grained policy-adaptivity benchmarks, Shieldstral attains 91.3% F1—trailing only the 20B GPT-OSS-Safeguard—but with vastly superior inference efficiency as it outputs a single token versus multi-step reasoning.

Figure 6: Adaptability evaluation scores, highlighting Shieldstral's competitive F1 among adaptive models.

Multimodal Safety

Shieldstral establishes a new state of the art on multimodal benchmarks, achieving an average F1 of 83.8% and significantly outperforming baselines including larger vision-LLMs.

Figure 3: F1 scores on multimodal safety datasets, with Shieldstral leading overall.

Notably, Shieldstral’s design enables it to effectively moderate multimodal content with substantially fewer parameters than any comparable model.

Ablation and Model Fusion Analysis

Ablations confirm that the combination of public and synthetic taxonomy data is essential for generalizing to unseen policies (yielding a +23.3% F1 boost on taxonomy validation), and that LoRA matches the performance of full SFT at reduced compute.

Three-way SLERP merging recovers any performance tradeoff between benchmark calibration and adaptivity, with the final model exhibiting decisive gains on both axes.

Implications and Future Directions

Shieldstral's reframing of moderation as a unified binary QA task, supported by a scalable, contrastive data pipeline and parameter-efficient adaptation protocol, demonstrates that policy-adaptive, context-specific safety moderation is achievable in a compact model. This has significant implications for deployment, enabling context-specific, multilingual, and multimodal content regulation with low computational overhead, and without the need to retrain or redesign classifiers for each emergent policy.

Practically, this approach facilitates the tailoring of content guardrails to site/app-specific needs and regulatory environments with minimal engineering effort. Theoretically, it encourages a research agenda around adaptability, prompt-driven safety control, and compositional moderation that is robust to taxonomy and distribution shift.

Future developments could include extension to streaming and continual learning regimes, further cross-lingual capability enhancement, and end-user-facing tooling for interactive policy design using natural language prompts.

Conclusion

Shieldstral presents a unified framework for adaptive, efficient, and multimodal content moderation by casting moderation as binary QA, powered by large-scale heterogeneous data unification and a compact, adaptable model architecture. Its empirical results demonstrate SOTA performance on both textual and visual safety benchmarks—matching or outperforming models up to 7× its size—while providing high policy adaptivity and efficiency. This work substantiates the feasibility and value of adaptive guardrails and points towards scalable, prompt-driven moderation as a core component of future safe AI deployments (2607.25857).