# Granite Guardian vs ShieldGemma (slim)

> Granite Guardian scores 59.4 (C) to ShieldGemma's 54 (C) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md (~4,800 tokens) · this version ~2,580 tokens · JSON https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Granite Guardian scores 59.4 (C) on agent readiness against ShieldGemma's 54 (C), and leads in 5 of 7 scored categories. Both do content moderation.

- Granite Guardian: C 59.4, rank #704 of 1510 · https://www.anchorterminal.com/tools/granite-guardian.min.md
- ShieldGemma: C 54, rank #927 of 1510 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- Granite Guardian, good for A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate. Ahead on Reliability, 56 against 46; Security & auth, 58 against 53; Payments & pricing, 60 against 52; Transparency & trust, 71 against 54.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.

| Category | Granite Guardian | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 56 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 60 | 56 |
| Agent ergonomics (13%) | 69 | 72 |
| Security & auth (14%) | 58 | 53 |
| Payments & pricing (10%) | 60 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 38 | 40 |
| Transparency & trust (7%) | 71 | 54 |

| Fact (where they differ) | Granite Guardian | ShieldGemma |
| --- | --- | --- |
| Vendor | IBM | Google DeepMind |
| Transports | HTTP |  |
| Licence | Apache 2.0 for the weights and the repository | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| llms.txt | no | yes |
| Last release | 2026-04-29 | 2025-04-04 |
| Terms last updated | no document linked | 2026-04-01 |
| Customer content may train models | not read yet | yes |
| Terms restrict automated access | not read yet | not found in the text |
| Terms restrict benchmarking | not read yet | not found in the text |
| Terms or service can change without notice | not read yet | not found in the text |
| Arbitration or class-action waiver | not read yet | not found in the text |
| Popularity | 182 stars | none |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Transparency & trust, Granite Guardian +17: Granite Guardian 71 (Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai dates the deprecation and withdrawal of its hosted `granite-guardian-3-8b` (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20). 30 + 22 + 5 + 10 = 67.); ShieldGemma 54 (The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.)
- Reliability, Granite Guardian +10: Granite Guardian 56 (Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm>=0.15.1` and `transformers>=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items were open on GitHub, per the 8 October check, not re-read on 4 November (GitHub's pages answer 403 in this session). Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with dated What's New notes (the repository answered with no Git tags on 4 November, where the 8 October note said each version had one), but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `<guardian>` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15). Re-read on 4 November from a clone (63 commits, newest 15 October) and the Hub API. The 4.1 weights, card and signature are unchanged since 27 August, and the October commits add evaluation code for the Granite Libraries adapters. 14 + 5 + 14 + 9 + 14 = 56.); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Payments & pricing, Granite Guardian +8: Granite Guardian 60 (Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)
- Security & auth, Granite Guardian +5: Granite Guardian 58 (Read as a model the owner runs, on the model lines, with retention and training in place of the read-only line. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches IBM or trains a model, but no IBM page says so, where Kev's cards state it (15 of 20, level with Strands Decider). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid (renewed, now expiring 4 December 2026) and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and Mend dependency scanning was added to the repository on 19 August 2026. The repository still has no `SECURITY.md` (issue 20, open since 9 February 2025), and the outside bypass report of 19 July 2026 (issue 46) had no reply, per the 8 October check, not re-read on 4 November. No IBM security bulletin for Granite Guardian was found (15 of 20). 14 + 15 + 8 + 6 + 15 = 58.); ShieldGemma 53 (Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53.)