Azure AI Content Safety (Prompt Shields) vs ShieldGemma

Azure AI Content Safety (Prompt Shields) 15

No x402, MPP or L402 (0). Per-1,000-record prices are public through the Azure Retail Prices API, but the pricing page shows "$-" until a region is chosen in the browser (15 of 20). F0 gives 5,000 free text records and 5,000 images a month, but it needs an Azure subscription and an Azure account needs a card (0). A person signs up and creates the resource in a browser (0).

ShieldGemma 52

Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

Azure AI Content Safety (Prompt Shields) 86

Microsoft Entra ID tokens with RBAC, or two resource keys that can be regenerated in turn (30). RBAC can limit a caller, but a resource key also reaches the blocklist write and delete operations, with no confirmation step (15 of 20). Prompt Shields detects user-prompt and document attacks, and the docs describe Spotlighting for third-party content, in preview (15). The Foundry Tools diagnostic logging page describes Audit and RequestResponse logs through Azure Monitor for Cognitive Services resources once the owner adds a diagnostic setting, as the Document Intelligence listing reads it. We didn't confirm the fields for Content Safety (12, was 0). Coordinated disclosure policy and MSRC bounty programmes linked from security.txt, but microsoft.com's security.txt passed its Expires date on 23 September 2026 and still carries it on 3 November (4 of 5), bounty (5), SOC or ISO coverage for Content Safety by name not confirmed (0), MSRC publishes advisories (5), so 14 of 20. An MSRC affected-product search on 3 November finds no CVE naming Content Safety. The 2026 Azure AI Foundry CVEs name Foundry, not this service, so no deduction, as on the Speech, Translator and Document Intelligence listings. 30 + 15 + 15 + 12 + 14 = 86.

ShieldGemma 53

Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.

Azure AI Content Safety (Prompt Shields) 75

Azure status page with a post-incident review history (20). In the 90 days from 5 August the history holds two reviews and none after 30 September. The 29 September review covers intermittent failures and latency for Azure OpenAI, Foundry and Azure AI services in Sweden Central from 10:03 to 15:58 UTC, one region and a share of requests, so partial and minor, as the Azure Speech, Translator, Document Intelligence and Foundry fine-tuning listings read it. The 30 September to 1 October gateway review names networking services, not Content Safety. The 23 July West US review counted on 1 October has left the window. Minor only (20, was 10). Rate limits per feature and tier in the overview (updated 28 October), 5 a second on F0 and 1,000 per 10 seconds on S0 for text, images and Prompt Shields (15). No 429 or backoff guidance in the Content Safety docs (0). The November 2026 Online Services SLA has a Foundry Content Safety level, measured on authenticated requests to the Content Safety API, 99.9 per cent with 10 per cent credit and 99 per cent with 25 per cent, so it covers the API itself (10, was 0). Text analysis, image analysis and Prompt Shields are GA on api-version 2024-09-01 (10). 20 + 20 + 15 + 0 + 10 + 10 = 75.

ShieldGemma 46

Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is pip install -U transformers[accelerate] with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

Azure AI Content Safety (Prompt Shields) 83

Closed service under Microsoft's product terms (15). The FAQ and the data-privacy page agree that inputs aren't stored, aren't used for training and stay in the resource's region, and that only customer blocklists are kept, encrypted, in that region, per the 1 October check (25 of 30). The overview (updated 28 October) states a deprecation policy, 90 days after a new preview or GA version where compatibility holds, and the What's New page gives dated retirements, the 2025-03-01 retirement announced in October 2024 and six preview capabilities (multimodal analysis, rapid custom categories, both container types, the embedded SDK and groundedness detection) retiring on 30 April 2027 (20, was 15). Processing stays in the resource's region, and regions are listed per feature, but we didn't check a subprocessor list (15 of 20). 15 + 25 + 20 + 15 = 75.

ShieldGemma 54

The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.

Azure AI Content Safety (Prompt Shields) 74

Public OpenAPI (Swagger) documents in Azure/azure-rest-api-specs, with stable 2024-09-01 and previews up to 2026-09-01-preview, error schemas and examples on all 15 operations (25). learn.microsoft.com has no llms.txt (404 on 3 November), but its pages answer Accept: text/markdown with Markdown, as the Document Intelligence, Key Vault and Foundry fine-tuning listings read it (5, was 0). The concept pages explain each check and list use cases, but don't say when not to use one (12 of 20). Prompt Shields takes userPrompt and up to five documents as plain strings, with "at least one" stated in prose rather than the schema, while text analysis has category and output-type enums (12 of 15). Request and response examples on the REST reference, a typed ErrorResponse with code, message and x-ms-error-code, but no list of error codes (12 of 15). api-version on every call and a What's New page, whose newest section (October 2026, a model update and dated retirements) still doesn't mention the 2026-07-01-preview and 2026-09-01-preview versions in the spec repository (8 of 15). 25 + 5 + 12 + 12 + 12 + 8 = 74.

ShieldGemma 56

Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a guideline argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56.

Azure AI Content Safety (Prompt Shields) 78

Prompt Shields answers one boolean per prompt and per document, and text analysis returns four or eight severity levels by choice (20 of 25). Categories, output type and haltOnBlocklistHit are set per request (20). Errors carry a code and message in a standard Azure shape, but the codes aren't documented per operation (15 of 20). Checks have no side effects, but there's no retry guidance (15 of 20). Few required fields, but the Python SDK is 1.0.0 from 12 December 2023 with no Prompt Shields method, and the JavaScript package is a generic REST client, 1.0.1 from January 2025 (8 of 15).

ShieldGemma 72

Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or ollama run shieldgemma, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.