{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "tool": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 921, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 46, "points": 9.2, "reason": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.", "checked": "2026-11-06" }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 56, "points": 9.1, "reason": "Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.", "checked": "2026-11-06" }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 72, "points": 11.7, "reason": "Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.", "checked": "2026-11-06" }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 53, "points": 9.28, "reason": "Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.", "checked": "2026-11-06" }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 52, "points": 6.5, "reason": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.", "checked": "2026-11-06" }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 40, "points": 3.5, "reason": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.", "checked": "2026-11-06" }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 54, "points": 4.72, "note": "editorial 50, provenance 58", "reason": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.", "checked": "2026-11-06" } ], "assessment": { "date": "2026-11-06", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.", "maintenance": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.", "payments": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.", "reliability": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.", "schema": "Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.", "security": "Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.", "transparency": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "sources": [ { "what": "ShieldGemma page", "url": "https://gemma.ai/models/shieldgemma.md", "seen": "2026-11-06" }, { "what": "ShieldGemma 1 model card", "url": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "seen": "2026-11-06" }, { "what": "ShieldGemma 2 model card", "url": "https://gemma.ai/models/shieldgemma/model-card-v2.md", "seen": "2026-11-06" }, { "what": "Gemma docs index for agents", "url": "https://gemma.ai/llms.txt", "seen": "2026-11-06" }, { "what": "Gemma Terms of Use", "url": "https://gemma.ai/resources/terms.md", "seen": "2026-11-06" }, { "what": "Gemma Prohibited Use Policy", "url": "https://gemma.ai/resources/prohibited-use.md", "seen": "2026-11-06" }, { "what": "deprecated ai.google.dev ShieldGemma page", "url": "https://ai.google.dev/gemma/docs/shieldgemma", "seen": "2026-11-06" }, { "what": "Hub page with gate notice and usage snippet", "url": "https://huggingface.co/google/shieldgemma-2b", "seen": "2026-11-06" }, { "what": "Hub model API, files and downloads", "url": "https://huggingface.co/api/models/google/shieldgemma-9b", "seen": "2026-11-06" }, { "what": "Hub model API, ShieldGemma 2", "url": "https://huggingface.co/api/models/google/shieldgemma-2-4b-it", "seen": "2026-11-06" }, { "what": "Hub discussions, authors and dates counted by script", "url": "https://huggingface.co/api/models/google/shieldgemma-2-4b-it/discussions", "seen": "2026-11-06" }, { "what": "Ollama library tags", "url": "https://ollama.com/library/shieldgemma/tags", "seen": "2026-11-06" }, { "what": "Transformers ShieldGemma 2 page", "url": "https://huggingface.co/docs/transformers/model_doc/shieldgemma2", "seen": "2026-11-06" }, { "what": "Google security.txt", "url": "https://www.google.com/.well-known/security.txt", "seen": "2026-11-06" }, { "what": "RDAP record for gemma.ai", "url": "https://rdap.org/domain/gemma.ai", "seen": "2026-11-06" } ], "openQuestions": [ "Graded as `kind: model` on the seven-category reading, as its guardrail peers llama-guard and granite-guardian were (rechecked 4 November 2026), so the three compare in one head-to-head. research/BRIEF.md says open-weight files take `kind: weights` and the v0.6 open-weight checklist in any category; a person should decide whether all three move together", "unchecked: whether current vLLM and llama.cpp releases load ShieldGemma 1 and 2. We did not read the runtimes' code and did not run the model", "unchecked: memory needed. Google states no figure; the BF16 file sizes are about 5.2 GB (2B), 18.5 GB (9B), 54 GB (27B) and 8.6 GB (ShieldGemma 2)", "unchecked: Kaggle pages and discussions, and the Keras notebook in google-gemini/gemma-cookbook, which were not read", "The Hugging Face README files sit behind the gate, so the Hub card text was read from the public model page and the cards from gemma.ai", "Whether Google plans a ShieldGemma built on Gemma 4. No first-hand page mentions one", "The Hub API reports `gated: manual` for all four repositories while the model page says requests are approved immediately" ] }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 }, "scoreHistory": [ { "date": "2026-11-06", "grade": "C", "kind": "listed", "method": "0.7", "score": 54 } ] }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "notable": [ "ShieldGemma 1 is text-to-text, English only, in 2B, 9B and 27B sizes built on Gemma 2, for four harm types (sexually explicit, dangerous content, hate, harassment), with separate guideline wording for prompt-only and prompt-response checks (https://gemma.ai/models/shieldgemma/model-card-v1.md)", "The models are meant to run in scoring mode. The caller reads the probability of the `Yes` and `No` tokens at the last position and applies softmax, and the Hub example prints a score of 0.73 (https://gemma.ai/models/shieldgemma/model-card-v1.md, https://huggingface.co/google/shieldgemma-2b)", "ShieldGemma 2 is a 4B image classifier trained from Gemma 3 4B IT for sexually explicit, dangerous and violent content, returning Yes and No probabilities per policy (https://gemma.ai/models/shieldgemma/model-card-v2.md)", "Hugging Face downloads in the last 30 days on 6 November 2026, from the Hub's API: shieldgemma-9b 255,858, shieldgemma-2-4b-it 7,016, shieldgemma-2b 3,345, shieldgemma-27b 123 (https://huggingface.co/api/models/google/shieldgemma-9b)", "Files were last changed on 28 August 2024 (2B), 6 September 2024 (9B and 27B) and 4 April 2025 (ShieldGemma 2), per the Hub's API on 6 November 2026 (https://huggingface.co/api/models/google/shieldgemma-2-4b-it)", "Ollama's library carries `shieldgemma` in 2b, 9b and 27b tags with quantised builds, 992.6K downloads and last updated 2 years ago on 6 November 2026. There is no ShieldGemma 2 tag (https://ollama.com/library/shieldgemma/tags)", "The ai.google.dev ShieldGemma page, last updated 15 January 2026, says it is deprecated and points to gemma.ai (https://ai.google.dev/gemma/docs/shieldgemma)", "The Gemma Terms of Use let Google restrict usage remotely or otherwise where it believes the terms are breached, and incorporate the Prohibited Use Policy of 21 February 2024 (https://gemma.ai/resources/terms.md, https://gemma.ai/resources/prohibited-use.md)" ], "area": "models", "details": [ { "label": "Surface listed", "value": "The four ShieldGemma checkpoints Google publishes, run by the owner through Transformers, Keras or Ollama. Read from gemma.ai, ai.google.dev, the Hugging Face pages and API, and Ollama's library on 6 November 2026. No weights were downloaded and no terms were accepted" }, { "label": "Same vendor, other listings", "value": "Google Cloud Model Armor (google-model-armor) is Google's hosted screening API and a separate listing. The Gemma 4 and EmbeddingGemma listings are other Gemma models" }, { "label": "Models", "value": "google/shieldgemma-2b (2,614,341,888 parameters), shieldgemma-9b (9,241,705,984), shieldgemma-27b (27,227,128,320), all BF16 safetensors on Gemma 2, and google/shieldgemma-2-4b-it (4,300,079,472) on Gemma 3" }, { "label": "Harm types", "value": "ShieldGemma 1, sexually explicit information, dangerous content, hate speech and harassment. ShieldGemma 2, sexually explicit, dangerous and violence or gore content in images" }, { "label": "Input", "value": "A preamble, the text or image to classify, one policy description and an epilogue, in a fixed pattern from the card. The Transformers chat template takes the policy as a `guideline` argument or a system message" }, { "label": "Output", "value": "The probability that the next token is `Yes` (violates the policy) or `No`, read from the logits. A caller that only gets text, such as an Ollama chat call, reads the first word" }, { "label": "Licence", "value": "Gemma Terms of Use, last modified 1 April 2026, with dated earlier versions in an archive. Commercial use allowed, distribution must carry the use restrictions, and the Prohibited Use Policy applies" }, { "label": "Access", "value": "Gated on Hugging Face (log in and accept the licence, approved immediately) and on Kaggle. Ollama's library copies of ShieldGemma 1 need no account" }, { "label": "Runtimes", "value": "Transformers (Gemma 2 classes for ShieldGemma 1, a `ShieldGemma2` model page in the Transformers docs), Keras through Google's Colab notebook, and Ollama for ShieldGemma 1. vLLM and llama.cpp support was not checked first-hand" }, { "label": "Google's figures", "value": "Optimal F1 and AU-PRC on Google's SG prompt and response sets, the OpenAI Moderation set and ToxicChat, for example 0.828/0.894 on SG Prompt for the 9B. These are the publisher's own results" }, { "label": "Support", "value": "Community tabs on each Hugging Face repository, where Google accounts answered every thread we sampled, and Kaggle discussions" } ], "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58, "checks": [ { "check": "Legal entity named", "value": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "gemma.ai, registered 2017-12-16 (8 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "People named", "value": "6 named with their role, 1 with a public profile", "points": 10, "max": 10, "state": "ok" }, { "check": "Support route", "value": "help pages, a community", "points": 5, "max": 5, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://gemma.ai/resources/terms.md", "state": "read", "readAt": "2026-10-30", "statedDate": "2026-04-01", "words": 1437, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last modified: April 1, 2026", "says": "Last updated 2026-04-01" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "This Agreement will be governed by the laws of the State of California without regard to choice of law principles.", "says": "The law of the State of California" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT AND UNDER NO LEGAL THEORY, WHETHER IN TORT (INCLUDING NEGLIGENCE), PRODUCT LIABILITY, CONTRACT, OR OTHERWISE, UNLESS REQUIRED BY APPLICABLE LAW, SHALL GOOGLE OR ITS AFFILIATES BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY DIRECT, INDIRECT, SPECIAL, INCIDENTA…", "says": "Rules out indirect and consequential losses, with no cap named in this sentence" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "…Distribution, reproduction, performance or display of any portion or element of the Gemma Services) and will continue in full force and effect until terminated in accordance with the terms of this Agreement." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "You must not use any of the Gemma Services:" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "…model in order to cause that model to perform similarly to Gemma, including distillation methods that use intermediate data representations or methods based on the generation of synthetic data Outputs by Gemma for training that model.", "costsPoints": true } ] }, { "kind": "privacy", "url": "", "state": "none-found", "points": 0, "max": 10 } ] }, "humans": { "slug": "shieldgemma", "checked": "2026-11-06", "company": "Google DeepMind", "people": [ { "name": "Demis Hassabis", "role": "Co-founder and CEO, Google DeepMind", "founder": true, "bio": "Demis Hassabis co-founded DeepMind in 2010 with Shane Legg and Mustafa Suleyman and leads Google DeepMind. He is also chief scientist of Alphabet and co-founder and CEO of Isomorphic Labs. In 2024 he shared the Nobel Prize in Chemistry with John Jumper for AI work on protein structure prediction.", "bioSources": [ "https://deepmind.google/about/", "https://en.wikipedia.org/wiki/Demis_Hassabis", "https://en.wikipedia.org/wiki/Google_DeepMind" ], "page": "/people/demis-hassabis/" }, { "name": "Shane Legg", "role": "Co-founder and Chief AGI Scientist, Google DeepMind", "founder": true, "bio": "Shane Legg co-founded DeepMind with Demis Hassabis and Mustafa Suleyman and works at Google DeepMind as chief AGI scientist. In the early 2000s he helped bring the term artificial general intelligence into use with Ben Goertzel, and his doctoral thesis was supervised by Marcus Hutter.", "bioSources": [ "https://en.wikipedia.org/wiki/Shane_Legg", "https://en.wikipedia.org/wiki/Google_DeepMind" ], "page": "/people/shane-legg/" }, { "name": "Mustafa Suleyman", "role": "Co-founder and former head of applied AI, DeepMind", "founder": true, "bio": "Mustafa Suleyman co-founded DeepMind and was its head of applied AI. After leaving DeepMind he co-founded Inflection AI in 2022, and he is now CEO of Microsoft AI.", "bioSources": [ "https://en.wikipedia.org/wiki/Mustafa_Suleyman", "https://en.wikipedia.org/wiki/Google_DeepMind" ], "page": "/people/mustafa-suleyman/" }, { "name": "Gus Martins", "role": "Gemma Product Manager", "linkedin": "https://uk.linkedin.com/in/lgusmartins", "x": "https://x.com/gusthema", "page": "/people/gus-martins/" }, { "name": "Wenjun Zeng", "role": "Lead author, ShieldGemma and ShieldGemma 2 technical reports", "page": "/people/wenjun-zeng/" }, { "name": "Ryan Mullins", "role": "Author, ShieldGemma and ShieldGemma 2 technical reports", "page": "/people/ryan-mullins/" } ], "peopleNote": "Google DeepMind's about page, read on 28 October 2026, names Demis Hassabis as Co-founder and CEO and no other leaders. The other two founders and their roles come from Wikipedia's articles on Shane Legg and Mustafa Suleyman. Google's Cloud Next 2026 speaker page calls Gus Martins a Product Manager at Google DeepMind driving the roadmap of the Gemma model family. The DiffusionGemma launch post of 10 June 2026 names Brendan O'Donoghue and Sebastian Flennerhag as Research Scientists, and the EmbeddingGemma launch post of 4 September 2025 names Min Choi (Product Manager) and Sahil Dua (Lead Research Engineer); they stay on those listings only. For this listing, the ShieldGemma and ShieldGemma 2 model cards on gemma.ai (read 6 November 2026) cite technical reports with Wenjun Zeng as first author and Ryan Mullins among the authors; Ryan Mullins also answered on the ShieldGemma 2 Hugging Face page in March 2025 from an account in Google's organisation. Ownership is carried from the Gemma listings.", "companySocial": { "linkedin": "https://www.linkedin.com/company/googledeepmind/", "x": "https://x.com/googlegemma" }, "support": { "urls": [ "https://gemma.ai/models/shieldgemma.md", "https://www.kaggle.com/models/google/shieldgemma" ], "community": [ { "label": "ShieldGemma 2 discussions on Hugging Face", "url": "https://huggingface.co/google/shieldgemma-2-4b-it/discussions", "kind": "forum" }, { "label": "ShieldGemma 9B discussions on Hugging Face", "url": "https://huggingface.co/google/shieldgemma-9b/discussions", "kind": "forum" } ] }, "sources": [ "https://uk.linkedin.com/in/lgusmartins", "https://x.com/gusthema", "https://gemma.ai/", "https://x.com/Google", "https://deepmind.google/", "https://en.wikipedia.org/wiki/Google_DeepMind", "https://deepmind.google/about/", "https://en.wikipedia.org/wiki/Demis_Hassabis", "https://en.wikipedia.org/wiki/Shane_Legg", "https://en.wikipedia.org/wiki/Mustafa_Suleyman", "https://gemma.ai/models/shieldgemma/model-card-v1.md", "https://gemma.ai/models/shieldgemma/model-card-v2.md" ], "ownership": { "status": "subsidiary", "parent": "Alphabet Inc.", "checked": "2026-10-28", "sources": [ "https://deepmind.google/about/", "https://en.wikipedia.org/wiki/Google_DeepMind" ] } }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } } }