{ "data": { "a": { "slug": "granite-guardian", "name": "Granite Guardian", "vendor": "IBM", "vendorUrl": "https://www.ibm.com/granite", "kind": "model", "category": "guardrails", "summary": "Granite Guardian is IBM's family of open-weight judge models. The current 8-billion-parameter release answers yes or no on whether a prompt, response, retrieved context or function call meets a built-in or custom criterion, and the owner runs it.", "url": "https://www.anchorterminal.com/tools/granite-guardian", "markdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/granite-guardian.json", "dns": "granite-guardian.grade.anchorterminal.com", "repo": "https://github.com/ibm-granite/granite-guardian", "license": "Apache 2.0 for the weights and the repository", "transports": [ "http" ], "packages": [], "auth": "none", "authNotes": "No account or key is needed to download or run the model. The Hugging Face repository is not gated. A vLLM or Ollama server has whatever authentication the owner adds.", "pricing": "free", "pricingNotes": "Free to download and run under the Apache 2.0 licence, with the owner's hardware as the cost. IBM's watsonx.ai lists only the earlier `ibm/granite-guardian-3-8b`, marked deprecated, at $0.0002 per 1,000 input or output tokens (checked 2026-10-08). Version 4.1 is not on that list.", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402. Granite Guardian is a model the owner runs, with no payment route (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 182, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.ibm.com/granite/docs/models/guardian", "capabilities": [ "guard.moderation", "guard.policy", "guard.injection", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "apache-2.0", "judge", "rag", "python", "ollama" ], "lastRelease": "2026-04-29", "graded": true, "anchor": { "graded": true, "score": 59.4, "grade": "C", "agentReady": false, "rank": 704, "ranked": true, "rankOf": 1510, "categoryRank": 12, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 38, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 71 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.", "bestFor": "A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate.", "strengths": [ "Weights are ungated on Hugging Face under the Apache 2.0 licence, with IBM's own GGUF builds and an Ollama library entry", "Built-in criteria cover harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour, three RAG checks and function-call hallucination", "A custom criterion is one natural-language sentence in the prompt, and the answer is `yes` or `no` inside `\u003cscore\u003e` tags", "The repository's `evaluation` folder reproduces the card's benchmark figures for versions 3.0 to 4.1", "Weights carry a sigstore signature in `model.sig`, and IBM documents how to verify it" ], "weaknesses": [ "Trained and tested on English only, per the model card", "Each call judges one criterion, so checking several risks takes several calls or a separate LoRA adapter built on the 3.2 model", "Version 4.1 moved the criterion into a `\u003cguardian\u003e` block in the last user message, where 3.x cookbooks pass `guardian_config`", "The repository has no CI, no tests and no `SECURITY.md`, and an issue asking for one was open from 9 February 2025", "The card's out-of-distribution safety F1 is 0.79 without thinking, below the 0.81 it reports for version 3.3", "IBM's watsonx.ai withdrew `ibm/granite-guardian-3-8b`, its only hosted Guardian model, on 8 August 2026, and no hosted 4.1 endpoint from IBM was found" ], "agentNotes": [ "Append the `\u003cguardian\u003e` block as the final user message, with the mode line, `### Criteria:` and `### Scoring Schema:`. Copy the strings from the model card, because no package builds them", "Use the no-think instruction for gating and parse `\u003cscore\u003e`. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens", "Treat `yes` as the criterion being met, which for built-in criteria means the risk is present. Treat a missing `\u003cscore\u003e` tag as a failed check", "Pass retrieved text through `documents=` and tool schemas through `available_tools=` in `apply_chat_template`, not inside the message text", "Under Ollama, set `num_ctx` in the request options. IBM's docs say the default context is short and long requests are truncated" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 59.4 } ], "editorialScores": { "ergonomics": 69, "maintenance": 38, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 67 }, "provenanceScore": 75, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install transformers torch vllm", "http": "curl http://localhost:11434/api/chat \\\n -d '{\"model\": \"granite4.1-guardian:8b\", \"messages\": [{\"role\": \"user\", \"content\": \"Hello!\"}]}'" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/granite-guardian" }, "sameCompany": [ "granite-embedding-small-english-r2", "ibm-watson-stt", "granite-switch", "granite-4-2-3b" ], "family": { "lab": "IBM (Granite)", "family": "Granite Guardian", "url": "https://www.anchorterminal.com/open-weights/#ibm", "others": [ { "name": "granite-guardian-4.0-3b-toxicity-ja", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.0-3b-toxicity-ja", "params": "3B (Hub safetensors count 3.40B)" }, { "name": "granite-guardian-3.2-8b-factuality-detection", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.2-8b-factuality-detection", "params": "8B (Hub safetensors count 8.17B)" }, { "name": "granite-guardian-3.3-8b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.3-8b", "params": "8B (Hub safetensors count 8.17B)" }, { "name": "granite-guardian-3.2-3b-a800m", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.2-3b-a800m", "params": "3B total, 800M active (MoE) (Hub safetensors count 3.30B)" }, { "name": "granite-guardian-3.2-5b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.2-5b", "params": "5B (Hub safetensors count 5.78B)" }, { "name": "granite-guardian-3.1-8b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.1-8b", "params": "8B (Hub safetensors count 8.17B)" }, { "name": "granite-guardian-3.1-2b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.1-2b", "params": "2B (Hub safetensors count 2.53B)" }, { "name": "granite-guardian-3.0-8b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.0-8b", "params": "8B (Hub safetensors count 8.17B)" }, { "name": "granite-guardian-3.0-2b", "url": "https://huggingface.co/ibm-granite/granite-guardian-3.0-2b", "params": "2B (Hub safetensors count 2.53B)" }, { "name": "granite-guardian-hap-38m", "url": "https://huggingface.co/ibm-granite/granite-guardian-hap-38m", "params": "38M (Hub safetensors count 38M)" }, { "name": "granite-guardian-hap-125m", "url": "https://huggingface.co/ibm-granite/granite-guardian-hap-125m", "params": "125M (Hub safetensors count 125M)" } ], "olderCount": 64 }, "area": "models", "provenance": { "legalEntity": "International Business Machines Corporation", "domain": "ibm.com", "domainRegistered": "1986-03-19", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-11-04", "notes": [ "IBM's naming guidance for Granite names International Business Machines Corporation as the developer and trademark owner.", "The Apache 2.0 licence in the repository is the document that governs use of the weights, so it is recorded as the terms. The Hugging Face repository declares the same licence in its metadata and has no licence file of its own.", "No privacy policy governs the model, because the owner runs it and no input reaches IBM. The privacy field is left out.", "www.ibm.com/.well-known/security.txt is present with PSIRT, HackerOne and email contacts and expires on 4 December 2026 (renewed, read on 4 November).", "RDAP gives 19 March 1986 as the registration date of ibm.com.", "IBM hosts no endpoint for version 4.1 that we found, so there is no status page. The repository has no changelog file. Dated notes sit in the README under What's New.", "Weights are on huggingface.co under the ibm-granite organisation and the code is at github.com/ibm-granite/granite-guardian, both off ibm.com." ], "score": 75 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/granite-guardian.json", "live": { "slug": "granite-guardian", "githubStars": 189, "securityTxt": { "url": "https://ibm.com/.well-known/security.txt", "state": "valid", "expires": "2026-12-07T00:00:00+00:00", "checkedAt": "2026-11-07T16:00:08.596796331Z" }, "domain": { "domain": "ibm.com", "registered": "1986-03-19", "source": "https://rdap.verisign.com/com/v1/domain/ibm.com", "checkedAt": "2026-11-01T14:15:47.742238816Z" }, "github": { "repo": "ibm-granite/granite-guardian", "checkedAt": "2026-11-02T08:55:36.144326991Z", "stars": 188, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-16T16:18:10Z", "openIssues": 13, "openPRs": 0, "issuesOpened90d": 10, "issuesClosed90d": 5, "prsMerged90d": 6, "replies": { "sampled": 18, "unanswered": 11, "medianDays": 39.6 } }, "updatedAt": "2026-11-07T16:00:08.596796331Z" } }, "answer": "Granite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 927, "ranked": true, "rankOf": 1510, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 17, "category": "transparency", "leads": "granite-guardian", "name": "Transparency \u0026 trust", "reasons": { "a": "Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai dates the deprecation and withdrawal of its hosted `granite-guardian-3-8b` (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20). 30 + 22 + 5 + 10 = 67.", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 71, "b": 54 } }, { "by": 10, "category": "reliability", "leads": "granite-guardian", "name": "Reliability", "reasons": { "a": "Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items were open on GitHub, per the 8 October check, not re-read on 4 November (GitHub's pages answer 403 in this session). Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with dated What's New notes (the repository answered with no Git tags on 4 November, where the 8 October note said each version had one), but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15). Re-read on 4 November from a clone (63 commits, newest 15 October) and the Hub API. The 4.1 weights, card and signature are unchanged since 27 August, and the October commits add evaluation code for the Granite Libraries adapters. 14 + 5 + 14 + 9 + 14 = 56.", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 56, "b": 46 } }, { "by": 8, "category": "payments", "leads": "granite-guardian", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 60, "b": 52 } }, { "by": 5, "category": "security", "leads": "granite-guardian", "name": "Security \u0026 auth", "reasons": { "a": "Read as a model the owner runs, on the model lines, with retention and training in place of the read-only line. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches IBM or trains a model, but no IBM page says so, where Kev's cards state it (15 of 20, level with Strands Decider). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid (renewed, now expiring 4 December 2026) and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and Mend dependency scanning was added to the repository on 19 August 2026. The repository still has no `SECURITY.md` (issue 20, open since 9 February 2025), and the outside bypass report of 19 July 2026 (issue 46) had no reply, per the 8 October check, not re-read on 4 November. No IBM security bulletin for Granite Guardian was found (15 of 20). 14 + 15 + 8 + 6 + 15 = 58.", "b": "Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53." }, "scores": { "a": 58, "b": 53 } } ], "facts": [ { "a": "Model API", "b": "Model API", "name": "Kind" }, { "a": "IBM", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache 2.0 for the weights and the repository", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-04-29", "b": "2025-04-04", "name": "Last release" }, { "a": "no document linked", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not read yet", "b": "yes", "name": "Customer content may train models" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not read yet", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not read yet", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "182 stars", "b": "none", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Granite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.", "question": "Which is better for AI agents, Granite Guardian or ShieldGemma?" }, { "answer": "Neither needs a key.", "question": "Do Granite Guardian and ShieldGemma need an API key?" }, { "answer": "No hosted endpoint is listed for Granite Guardian. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call Granite Guardian and ShieldGemma without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 56 against 46", "Security \u0026 auth, 58 against 53", "Payments \u0026 pricing, 60 against 52", "Transparency \u0026 trust, 71 against 54" ], "also": null, "goodFor": "A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate.", "slug": "granite-guardian", "watchFor": "Trained and tested on English only, per the model card" }, { "aheadOn": null, "also": null, "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "granite-guardian": [ { "causes": [ "time" ], "date": "2026-11-04", "delta": -0.7, "from": 60.1, "fromGrade": "C", "to": 59.4, "toGrade": "C" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0, "from": 60.1, "fromGrade": "C", "to": 60.1, "toGrade": "C" } ], "shieldgemma": null }, "job": { "capability": "guard.moderation", "name": "Content moderation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai.json", "title": "Granite Guardian vs Guardrails AI", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-lakera-guard.json", "title": "Granite Guardian vs Lakera Guard (Check Point AI Guardrails)", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-lakera-guard" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.json", "title": "Granite Guardian vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-mistral-moderation.json", "title": "Granite Guardian vs Mistral Moderation API", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-mistral-moderation" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-nemo-guardrails.json", "title": "Granite Guardian vs NVIDIA NeMo Guardrails", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-nemo-guardrails" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails.json", "title": "Granite Guardian vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-moderation.json", "title": "Granite Guardian vs OpenAI Moderation API", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-openai-moderation" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-prisma-airs.json", "title": "Granite Guardian vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "title": "Guardrails AI vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "title": "Llama Guard 4 vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "title": "OpenAI Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-granite-guardian.json", "title": "Amazon Bedrock Guardrails vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-granite-guardian.json", "title": "Azure AI Content Safety (Prompt Shields) vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-granite-guardian.json", "title": "Cisco AI Defense Inspection API vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-granite-guardian.json", "title": "Google Cloud Model Armor vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-llamafirewall.json", "title": "Granite Guardian vs LlamaFirewall", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-llamafirewall" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian.json", "title": "AgentGate vs Granite Guardian", "url": "https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "title": "AgentGate vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio.json", "title": "Granite Guardian vs Presidio", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "title": "Presidio vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" } ], "panel": null, "scores": [ { "by": 10, "edge": "granite-guardian", "granite-guardian": 56, "key": "reliability", "name": "Reliability", "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "granite-guardian", "granite-guardian": 60, "key": "schema", "name": "Schema \u0026 documentation", "shieldgemma": 56, "weight": 13 }, { "by": 3, "edge": "shieldgemma", "granite-guardian": 69, "key": "ergonomics", "name": "Agent ergonomics", "shieldgemma": 72, "weight": 13 }, { "by": 5, "edge": "granite-guardian", "granite-guardian": 58, "key": "security", "name": "Security \u0026 auth", "shieldgemma": 53, "weight": 14 }, { "by": 8, "edge": "granite-guardian", "granite-guardian": 60, "key": "payments", "name": "Payments \u0026 pricing", "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 2, "edge": "shieldgemma", "granite-guardian": 38, "key": "maintenance", "name": "Maintenance \u0026 community", "shieldgemma": 40, "weight": 7 }, { "by": 17, "edge": "granite-guardian", "granite-guardian": 71, "key": "transparency", "name": "Transparency \u0026 trust", "shieldgemma": 54, "weight": 7 } ], "summary": "Granite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do content moderation.", "tasks": null, "tutorials": [], "verdicts": { "granite-guardian": "One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.min.md" }, "markdown": "Granite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do content moderation.\n\n- Granite Guardian: grade C, 59.4/100, rank #704 of 1510. Markdown https://www.anchorterminal.com/tools/granite-guardian.md · JSON https://www.anchorterminal.com/api/v1/tools/granite-guardian.json\n- ShieldGemma: grade C, 54/100, rank #927 of 1510. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### Granite Guardian (C)\n\nGood for: A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate.\n\nAhead on:\n- Reliability, 56 against 46\n- Security \u0026 auth, 58 against 53\n- Payments \u0026 pricing, 60 against 52\n- Transparency \u0026 trust, 71 against 54\n\nWatch for: Trained and tested on English only, per the model card\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Transparency \u0026 trust: Granite Guardian +17\n\n- Granite Guardian (71): Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai dates the deprecation and withdrawal of its hosted `granite-guardian-3-8b` (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20). 30 + 22 + 5 + 10 = 67.\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n### Reliability: Granite Guardian +10\n\n- Granite Guardian (56): Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items were open on GitHub, per the 8 October check, not re-read on 4 November (GitHub's pages answer 403 in this session). Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with dated What's New notes (the repository answered with no Git tags on 4 November, where the 8 October note said each version had one), but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15). Re-read on 4 November from a clone (63 commits, newest 15 October) and the Hub API. The 4.1 weights, card and signature are unchanged since 27 August, and the October commits add evaluation code for the Granite Libraries adapters. 14 + 5 + 14 + 9 + 14 = 56.\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Payments \u0026 pricing: Granite Guardian +8\n\n- Granite Guardian (60): Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n### Security \u0026 auth: Granite Guardian +5\n\n- Granite Guardian (58): Read as a model the owner runs, on the model lines, with retention and training in place of the read-only line. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches IBM or trains a model, but no IBM page says so, where Kev's cards state it (15 of 20, level with Strands Decider). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid (renewed, now expiring 4 December 2026) and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and Mend dependency scanning was added to the repository on 19 August 2026. The repository still has no `SECURITY.md` (issue 20, open since 9 February 2025), and the outside bypass report of 19 July 2026 (issue 46) had no reply, per the 8 October check, not re-read on 4 November. No IBM security bulletin for Granite Guardian was found (15 of 20). 14 + 15 + 8 + 6 + 15 = 58.\n- ShieldGemma (53): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.\n\n## Score by category\n\n| Category | Weight | Granite Guardian | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 56 | 46 | Granite Guardian +10 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 60 | 56 | Granite Guardian +4 |\n| Agent ergonomics | 13% (16.2 this run) | 69 | 72 | ShieldGemma +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 58 | 53 | Granite Guardian +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 60 | 52 | Granite Guardian +8 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 38 | 40 | ShieldGemma +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 71 | 54 | Granite Guardian +17 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **59.4 · C** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | Granite Guardian | ShieldGemma |\n| --- | --- | --- |\n| Kind | Model API | Model API |\n| Vendor | IBM | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Apache 2.0 for the weights and the repository | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-04-29 | 2025-04-04 |\n| Terms last updated | no document linked | 2026-04-01 |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | not read yet | yes |\n| Terms restrict automated access | not read yet | not found in the text |\n| Terms restrict benchmarking | not read yet | not found in the text |\n| Terms or service can change without notice | not read yet | not found in the text |\n| Arbitration or class-action waiver | not read yet | not found in the text |\n| Popularity | 182 stars | none |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Granite Guardian\n\n- -0.7 on 4 November 2026: time\n- no change on 27 October 2026: new evidence\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Granite Guardian.** One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### Granite Guardian\n\n1. Append the `\u003cguardian\u003e` block as the final user message, with the mode line, `### Criteria:` and `### Scoring Schema:`. Copy the strings from the model card, because no package builds them\n2. Use the no-think instruction for gating and parse `\u003cscore\u003e`. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens\n3. Treat `yes` as the criterion being met, which for built-in criteria means the risk is present. Treat a missing `\u003cscore\u003e` tag as a failed check\n4. Pass retrieved text through `documents=` and tool schemas through `available_tools=` in `apply_chat_template`, not inside the message text\n5. Under Ollama, set `num_ctx` in the request options. IBM's docs say the default context is short and long requests are truncated\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, Granite Guardian or ShieldGemma?\n\nGranite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories.\n\n### Do Granite Guardian and ShieldGemma need an API key?\n\nNeither needs a key.\n\n### Can an agent call Granite Guardian and ShieldGemma without installing anything?\n\nNo hosted endpoint is listed for Granite Guardian. No hosted endpoint is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"granite-guardian\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare granite-guardian shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/granite-guardian.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with Granite Guardian or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs Guardrails AI](https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai.md)\n- [Granite Guardian vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/granite-guardian-vs-lakera-guard.md)\n- [Granite Guardian vs Llama Guard 4](https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.md)\n- [Granite Guardian vs Mistral Moderation API](https://www.anchorterminal.com/compare/granite-guardian-vs-mistral-moderation.md)\n- [Granite Guardian vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/granite-guardian-vs-nemo-guardrails.md)\n- [Granite Guardian vs OpenAI Guardrails](https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails.md)\n- [Granite Guardian vs OpenAI Moderation API](https://www.anchorterminal.com/compare/granite-guardian-vs-openai-moderation.md)\n- [Granite Guardian vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/granite-guardian-vs-prisma-airs.md)\n- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [Amazon Bedrock Guardrails vs Granite Guardian](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-granite-guardian.md)\n- [Azure AI Content Safety (Prompt Shields) vs Granite Guardian](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-granite-guardian.md)\n- [Cisco AI Defense Inspection API vs Granite Guardian](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-granite-guardian.md)\n- [Google Cloud Model Armor vs Granite Guardian](https://www.anchorterminal.com/compare/google-model-armor-vs-granite-guardian.md)\n- [Granite Guardian vs LlamaFirewall](https://www.anchorterminal.com/compare/granite-guardian-vs-llamafirewall.md)\n- [AgentGate vs Granite Guardian](https://www.anchorterminal.com/compare/agentgate-vs-granite-guardian.md)\n- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [Granite Guardian vs Presidio](https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio.md)\n- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Granite Guardian vs ShieldGemma", "url": "" } ], "description": "Granite Guardian scores 59.4 (C) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Granite Guardian C 59.4", "ShieldGemma C 54", "scores" ], "h1": "Granite Guardian vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/granite-guardian-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "Granite Guardian vs ShieldGemma for AI agents (2026) | Anchor Terminal", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, "tokens": { "markdown": 4800, "slim": 2580 }, "version": 1 }