Granite Guardian vs ShieldGemma

Granite Guardian 71

Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai dates the deprecation and withdrawal of its hosted granite-guardian-3-8b (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20). 30 + 22 + 5 + 10 = 67.

ShieldGemma 54

The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.

Granite Guardian 56

Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries granite4.1-guardian:8b. The card's install line is pip install transformers torch vllm with no versions, and the evaluation code asks for vllm>=0.15.1 and transformers>=4.52 and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its evaluation folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items were open on GitHub, per the 8 October check, not re-read on 4 November (GitHub's pages answer 403 in this session). Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with dated What's New notes (the repository answered with no Git tags on 4 November, where the 8 October note said each version had one), but there is no changelog file, and 4.1 changed the prompt format from the guardian_config argument of the 3.x cookbooks to a <guardian> block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15). Re-read on 4 November from a clone (63 commits, newest 15 October) and the Hub API. The 4.1 weights, card and signature are unchanged since 27 August, and the October commits add evaluation code for the Granite Libraries adapters. 14 + 5 + 14 + 9 + 14 = 56.

ShieldGemma 46

Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is pip install -U transformers[accelerate] with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

Granite Guardian 60

Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated ibm/granite-guardian-3-8b at $0.0002 per 1,000 tokens, which is not the model graded here.

ShieldGemma 52

Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

Granite Guardian 58

Read as a model the owner runs, on the model lines, with retention and training in place of the read-only line. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches IBM or trains a model, but no IBM page says so, where Kev's cards state it (15 of 20, level with Strands Decider). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid (renewed, now expiring 4 December 2026) and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and Mend dependency scanning was added to the repository on 19 August 2026. The repository still has no SECURITY.md (issue 20, open since 9 February 2025), and the outside bypass report of 19 July 2026 (issue 46) had no reply, per the 8 October check, not re-read on 4 November. No IBM security bulletin for Granite Guardian was found (15 of 20). 14 + 15 + 8 + 6 + 15 = 58.

ShieldGemma 53

Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.