{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "granite-guardian", "name": "Granite Guardian", "vendor": "IBM", "vendorUrl": "https://www.ibm.com/granite", "kind": "model", "category": "guardrails", "summary": "Granite Guardian is IBM's family of open-weight judge models. The current 8-billion-parameter release answers yes or no on whether a prompt, response, retrieved context or function call meets a built-in or custom criterion, and the owner runs it.", "url": "https://www.anchorterminal.com/tools/granite-guardian", "markdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/granite-guardian.json", "repo": "https://github.com/ibm-granite/granite-guardian", "license": "Apache 2.0 for the weights and the repository", "transports": [ "http" ], "packages": [], "auth": "none", "authNotes": "No account or key is needed to download or run the model. The Hugging Face repository is not gated. A vLLM or Ollama server has whatever authentication the owner adds.", "pricing": "free", "pricingNotes": "Free to download and run under the Apache 2.0 licence, with the owner's hardware as the cost. IBM's watsonx.ai lists only the earlier `ibm/granite-guardian-3-8b`, marked deprecated, at $0.0002 per 1,000 input or output tokens (checked 2026-10-08). Version 4.1 is not on that list.", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402. Granite Guardian is a model the owner runs, with no payment route (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 182, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.ibm.com/granite/docs/models/guardian", "capabilities": [ "guard.moderation", "guard.policy", "guard.injection", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "apache-2.0", "judge", "rag", "python", "ollama" ], "lastRelease": "2026-04-29", "graded": true, "anchor": { "graded": true, "score": 60.1, "grade": "C", "agentReady": false, "rank": 478, "ranked": true, "rankOf": 842, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 47, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 70 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 56, "points": 11.2, "reason": "Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items are open on GitHub. Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with a Git tag each and dated What's New notes, but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 60, "points": 9.75, "reason": "Read for a model the owner serves. There is no specification of its own. The contract is `chat_template.jinja`, the prompt strings in the card and a fixed `\u003cscore\u003e` answer, and vLLM or Ollama supply the HTTP route (8 of 25). www.ibm.com/granite/docs has no llms.txt (the path returns the docs home page). The model card and README are Markdown on Hugging Face and GitHub (5 of 10). The card states the intended use, eleven built-in criteria with definitions, English-only training, the need to test custom criteria, and points to the HAP-38M model for tighter latency (18 of 20). The answer is binary inside fixed tags, and documents and tool schemas have their own template arguments. The criterion is free text (10 of 15). Four code examples, two notebooks for 4.1 and an Ollama page. Nothing documents failure modes such as a missing score tag (10 of 15). Versioned model names, Git tags and dated What's New notes, with no changelog file (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "Read as a classifier an agent calls. Without thinking the answer is a yes or no in tags. Think mode adds a reasoning trace, and the card's examples allow 2,048 output tokens. Each call judges one criterion (19 of 25). The caller chooses think or no-think, the criterion, whether the last user or assistant turn is judged, and passes documents and tool schemas separately (17 of 20). The model has no error responses of its own and the 4.1 card documents no confidence value, so a caller parses tags from text (7 of 20). Calls are stateless and the examples set temperature to 0, so a check can be repeated safely (16 of 20). No gate and one `ollama run` command, but the prompt strings and parser must be copied from the card because no package ships them, and vLLM needs a GPU (10 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 58, "points": 10.15, "reason": "Read as software the owner runs. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). A classifier with no write actions (15 of 20). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and dependency scanning was added to the repository on 19 August 2026. The repository has no `SECURITY.md` (issue 20, open since 9 February 2025), and five scanner alerts and an outside bypass report of 19 July 2026 (issue 46) have no reply (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "reason": "Read for an open-weight model. The 4.1 weights date from 29 April 2026, 162 days before the check. The card and signature changed on 26 and 27 August 2026, which we do not count as a release (10 of 30). Main releases came in October and December 2024, February and August 2025 and April 2026. The last 90 days brought the evaluation code on 10 August and a cookbook refactor on 19 August, and no model (10 of 20). Maintainers merge their own pull requests within a day and closed the evaluation-code request (issue 26) on 10 August 2026 after 17 months. An outside pull request of 12 August, the bypass report of 19 July and the 4.2 question of 17 September have no reply (10 of 25). `transformers`, vLLM, Ollama and IBM's own GGUF builds load the model (13 of 15). Dependency scanning is on, its five alerts are open, and there is no CI (4 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "note": "editorial 67, provenance 73", "reason": "Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai marks its hosted 3.0 model deprecated (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read as a classifier an agent calls. Without thinking the answer is a yes or no in tags. Think mode adds a reasoning trace, and the card's examples allow 2,048 output tokens. Each call judges one criterion (19 of 25). The caller chooses think or no-think, the criterion, whether the last user or assistant turn is judged, and passes documents and tool schemas separately (17 of 20). The model has no error responses of its own and the 4.1 card documents no confidence value, so a caller parses tags from text (7 of 20). Calls are stateless and the examples set temperature to 0, so a check can be repeated safely (16 of 20). No gate and one `ollama run` command, but the prompt strings and parser must be copied from the card because no package ships them, and vLLM needs a GPU (10 of 15).", "maintenance": "Read for an open-weight model. The 4.1 weights date from 29 April 2026, 162 days before the check. The card and signature changed on 26 and 27 August 2026, which we do not count as a release (10 of 30). Main releases came in October and December 2024, February and August 2025 and April 2026. The last 90 days brought the evaluation code on 10 August and a cookbook refactor on 19 August, and no model (10 of 20). Maintainers merge their own pull requests within a day and closed the evaluation-code request (issue 26) on 10 August 2026 after 17 months. An outside pull request of 12 August, the bypass report of 19 July and the 4.2 question of 17 September have no reply (10 of 25). `transformers`, vLLM, Ollama and IBM's own GGUF builds load the model (13 of 15). Dependency scanning is on, its five alerts are open, and there is no CI (4 of 10).", "payments": "Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.", "reliability": "Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items are open on GitHub. Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with a Git tag each and dated What's New notes, but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15).", "schema": "Read for a model the owner serves. There is no specification of its own. The contract is `chat_template.jinja`, the prompt strings in the card and a fixed `\u003cscore\u003e` answer, and vLLM or Ollama supply the HTTP route (8 of 25). www.ibm.com/granite/docs has no llms.txt (the path returns the docs home page). The model card and README are Markdown on Hugging Face and GitHub (5 of 10). The card states the intended use, eleven built-in criteria with definitions, English-only training, the need to test custom criteria, and points to the HAP-38M model for tighter latency (18 of 20). The answer is binary inside fixed tags, and documents and tool schemas have their own template arguments. The criterion is free text (10 of 15). Four code examples, two notebooks for 4.1 and an Ollama page. Nothing documents failure modes such as a missing score tag (10 of 15). Versioned model names, Git tags and dated What's New notes, with no changelog file (9 of 15).", "security": "Read as software the owner runs. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). A classifier with no write actions (15 of 20). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and dependency scanning was added to the repository on 19 August 2026. The repository has no `SECURITY.md` (issue 20, open since 9 February 2025), and five scanner alerts and an outside bypass report of 19 July 2026 (issue 46) have no reply (15 of 20).", "transparency": "Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai marks its hosted 3.0 model deprecated (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20)." }, "sources": [ { "what": "Granite Guardian 4.1 8B model card", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b", "seen": "2026-10-08" }, { "what": "Hugging Face model metadata (gating, downloads, parameters, last change)", "url": "https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b", "seen": "2026-10-08" }, { "what": "Hugging Face commit history for the model", "url": "https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b/commits/main", "seen": "2026-10-08" }, { "what": "Hugging Face community threads for the model", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b/discussions", "seen": "2026-10-08" }, { "what": "chat template", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b/blob/main/chat_template.jinja", "seen": "2026-10-08" }, { "what": "list of Granite Guardian models on Hugging Face", "url": "https://huggingface.co/api/models?author=ibm-granite\u0026search=guardian", "seen": "2026-10-08" }, { "what": "IBM's GGUF builds", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b-GGUF", "seen": "2026-10-08" }, { "what": "repository, README, tags, cookbooks and evaluation code (shallow clone at commit 9698a42)", "url": "https://github.com/ibm-granite/granite-guardian", "seen": "2026-10-08" }, { "what": "repository issues and pull requests", "url": "https://github.com/ibm-granite/granite-guardian/issues", "seen": "2026-10-08" }, { "what": "issue 46, outside report of bypasses on 3.0-2B", "url": "https://github.com/ibm-granite/granite-guardian/issues/46", "seen": "2026-10-08" }, { "what": "issue 20, no SECURITY.md", "url": "https://github.com/ibm-granite/granite-guardian/issues/20", "seen": "2026-10-08" }, { "what": "IBM Granite Guardian docs", "url": "https://www.ibm.com/granite/docs/models/guardian", "seen": "2026-10-08" }, { "what": "IBM docs on partners that run Granite", "url": "https://www.ibm.com/granite/docs/run/granite-on-partners", "seen": "2026-10-08" }, { "what": "IBM docs on signature verification", "url": "https://www.ibm.com/granite/docs/model-standards/signature-verification", "seen": "2026-10-08" }, { "what": "IBM naming guidance and licence statement", "url": "https://www.ibm.com/granite/docs/model-standards/naming-guidance", "seen": "2026-10-08" }, { "what": "Ollama library page", "url": "https://ollama.com/library/granite4.1-guardian", "seen": "2026-10-08" }, { "what": "watsonx.ai foundation model list and prices", "url": "https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx", "seen": "2026-10-08" }, { "what": "IBM security.txt", "url": "https://www.ibm.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "RDAP record for ibm.com", "url": "https://rdap.verisign.com/com/v1/domain/ibm.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead named version 3.3. Granite Guardian 4.1 8B (April 2026) is the current model, and the listing grades it. The lead's interface and licence were right.", "unchecked: we did not run the model, so the install lines, GPU memory and whether current `transformers` and vLLM releases load `GraniteForCausalLM` are from IBM's pages only.", "unchecked: who replied on issues 20, 28, 29 and 35 and when. The GitHub API allowance for this network ran out, so only comment counts were read.", "unchecked: the date watsonx.ai withdraws `ibm/granite-guardian-3-8b`, and whether 4.1 is on Azure AI Foundry or Replicate. www.ibm.com/docs answered 403 and the partner lists were not read.", "unchecked: IBM's Granite Trust portal, which the docs give as the home of its responsible AI material.", "Whether a Guardian model based on Granite 4.2 is planned. Issue 54 asks and has no reply.", "Issue 46 is an outside, unverified report against the 3.0-2B model prompted as a chat model, which is outside the scoring mode IBM prescribes. No deduction was taken.", "The 4.1 card lists sexual content in its scope of use but not in its list of built-in criteria. IBM's docs page and the Ollama page list it." ] }, "negative": 0, "verdict": "One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.", "bestFor": "A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate.", "strengths": [ "Weights are ungated on Hugging Face under the Apache 2.0 licence, with IBM's own GGUF builds and an Ollama library entry", "Built-in criteria cover harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour, three RAG checks and function-call hallucination", "A custom criterion is one natural-language sentence in the prompt, and the answer is `yes` or `no` inside `\u003cscore\u003e` tags", "The repository's `evaluation` folder reproduces the card's benchmark figures for versions 3.0 to 4.1", "Weights carry a sigstore signature in `model.sig`, and IBM documents how to verify it" ], "weaknesses": [ "Trained and tested on English only, per the model card", "Each call judges one criterion, so checking several risks takes several calls or a separate LoRA adapter built on the 3.2 model", "Version 4.1 moved the criterion into a `\u003cguardian\u003e` block in the last user message, where 3.x cookbooks pass `guardian_config`", "The repository has no CI, no tests and no `SECURITY.md`, and an issue asking for one has been open since 9 February 2025", "The card's out-of-distribution safety F1 is 0.79 without thinking, below the 0.81 it reports for version 3.3", "IBM's watsonx.ai model list has only `ibm/granite-guardian-3-8b`, marked deprecated, so 4.1 has no hosted endpoint from IBM that we found" ], "agentNotes": [ "Append the `\u003cguardian\u003e` block as the final user message, with the mode line, `### Criteria:` and `### Scoring Schema:`. Copy the strings from the model card, because no package builds them", "Use the no-think instruction for gating and parse `\u003cscore\u003e`. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens", "Treat `yes` as the criterion being met, which for built-in criteria means the risk is present. Treat a missing `\u003cscore\u003e` tag as a failed check", "Pass retrieved text through `documents=` and tool schemas through `available_tools=` in `apply_chat_template`, not inside the message text", "Under Ollama, set `num_ctx` in the request options. IBM's docs say the default context is short and long requests are truncated" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.1 } ], "editorialScores": { "ergonomics": 69, "maintenance": 47, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 67 }, "provenanceScore": 73 }, "connect": { "install": "pip install transformers torch vllm", "http": "curl http://localhost:11434/api/chat \\\n -d '{\"model\": \"granite4.1-guardian:8b\", \"messages\": [{\"role\": \"user\", \"content\": \"Hello!\"}]}'" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/granite-guardian" }, "notable": [ "Granite Guardian 4.1 8B is the newest main model, fine-tuned from `ibm-granite/granite-4.1-8b` with 8,380,551,168 BF16 parameters. The card gives April 2026 as the release date (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The Hugging Face repository is not gated and showed 55,359 downloads in the last month, 212,264 in total and 48 likes. Its weights date from 29 April 2026, and the card and signature were updated on 26 and 27 August 2026 (https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b)", "IBM's own figures for 4.1 without thinking are F1 0.79 on out-of-distribution safety sets, balanced accuracy 0.760 on LLM-AggreFact and 0.79 on FC Reward Bench. The same card gives 0.81, 0.761 and 0.74 for version 3.3 (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The model card says the model is trained and tested on English only, that custom criteria need testing, and that reasoning traces may contain unsafe content and may not be faithful (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The family on Hugging Face also has HAP classifiers of 38M and 125M parameters, 3.x models from 2B to 8B, LoRA adapters on 3.2 for harm categories, harm correction and factuality, and a Japanese toxicity model (https://huggingface.co/api/models?author=ibm-granite\u0026search=guardian)", "IBM publishes GGUF builds from Q2_K to bf16 in `ibm-granite/granite-guardian-4.1-8b-GGUF`, and Ollama's library has `granite4.1-guardian:8b` at 6.9GB with 31.2K downloads (https://ollama.com/library/granite4.1-guardian)", "IBM's watsonx.ai model list has `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens in and out (https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx)", "The repository's `evaluation` folder, added on 10 August 2026, runs four benchmarks through vLLM and says an 8B model fits on a single 80 GB GPU (https://github.com/ibm-granite/granite-guardian/tree/main/evaluation)", "A GitHub issue of 17 September 2026 asks whether a Guardian model will follow `granite-4.2-8b`. It had no reply on 8 October 2026 (https://github.com/ibm-granite/granite-guardian/issues/54)" ], "area": "models", "details": [ { "label": "Model", "value": "`ibm-granite/granite-guardian-4.1-8b`, 8,380,551,168 parameters in BF16 safetensors, fine-tuned from `ibm-granite/granite-4.1-8b`. `config.json` gives 131,072 positions" }, { "label": "Licence", "value": "Apache 2.0. IBM asks that derivatives put the maker's name before Granite and says the name is a registered trademark (https://www.ibm.com/granite/docs/model-standards/naming-guidance)" }, { "label": "Access", "value": "Not gated on Hugging Face. Also `ollama run granite4.1-guardian:8b` and IBM's GGUF builds" }, { "label": "Built-in criteria", "value": "Harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour. Context relevance, groundedness and answer relevance for RAG. Function-calling hallucination for agents" }, { "label": "Custom criteria", "value": "Any rule in natural language in the `### Criteria:` section. IBM calls this bring your own criteria and says such criteria need testing" }, { "label": "Input", "value": "A conversation whose last user message is a `\u003cguardian\u003e` block with a think or no-think instruction, the criterion and a scoring schema. Documents go in `documents=` and tool schemas in `available_tools=`" }, { "label": "Output", "value": "`\u003cscore\u003eyes\u003c/score\u003e` or `\u003cscore\u003eno\u003c/score\u003e`. Think mode puts a reasoning trace in `\u003cthink\u003e` tags first" }, { "label": "Runtimes", "value": "`transformers` and vLLM in the card, Ollama and GGUF from IBM. The evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and says an 8B model fits on one 80 GB GPU" }, { "label": "IBM's figures", "value": "Version 4.1 without thinking. Safety F1 0.79 across ten sets, LLM-AggreFact balanced accuracy 0.760, FC Reward Bench 0.79, IFEval multi-constraint 0.844" }, { "label": "Languages", "value": "English only, per the model card" }, { "label": "Integrity", "value": "`model.sig` is a sigstore signature. IBM documents verification with `model-signing` and calls model signing experimental (https://www.ibm.com/granite/docs/model-standards/signature-verification)" }, { "label": "Hosted by IBM", "value": "watsonx.ai lists `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens. Version 4.1 is not listed" }, { "label": "Support", "value": "Issues at github.com/ibm-granite/granite-guardian and the Hugging Face community tab. Security reports go to IBM PSIRT" } ], "provenance": { "legalEntity": "International Business Machines Corporation", "domain": "ibm.com", "domainRegistered": "1986-03-19", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "IBM's naming guidance for Granite names International Business Machines Corporation as the developer and trademark owner.", "The Apache 2.0 licence in the repository is the document that governs use of the weights, so it is recorded as the terms. The Hugging Face repository declares the same licence in its metadata and has no licence file of its own.", "No privacy policy governs the model, because the owner runs it and no input reaches IBM. The privacy field is left out.", "www.ibm.com/.well-known/security.txt is present with PSIRT, HackerOne and email contacts and expires on 8 November 2026.", "RDAP gives 19 March 1986 as the registration date of ibm.com.", "IBM hosts no endpoint for version 4.1 that we found, so there is no status page. The repository has no changelog file. Dated notes sit in the README under What's New.", "Weights are on huggingface.co under the ibm-granite organisation and the code is at github.com/ibm-granite/granite-guardian, both off ibm.com." ], "score": 73, "checks": [ { "check": "Legal entity named", "value": "International Business Machines Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ibm.com, registered 1986-03-19 (40 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache 2.0 for the weights and the repository licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/granite-guardian.json" } }