{ "data": { "a": { "slug": "llama-guard", "name": "Llama Guard 4", "vendor": "Meta", "vendorUrl": "https://dev.meta.ai/llama", "kind": "model", "category": "guardrails", "summary": "Llama Guard 4 is Meta's 12-billion-parameter open-weight safety classifier for text and images. It labels a prompt or a model response safe or unsafe against 14 hazard categories, and the owner runs it on a GPU.", "url": "https://www.anchorterminal.com/tools/llama-guard", "markdownUrl": "https://www.anchorterminal.com/tools/llama-guard.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/llama-guard.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/llama-guard.json", "dns": "llama-guard.grade.anchorterminal.com", "repo": "https://github.com/meta-llama/PurpleLlama", "license": "Llama 4 Community Licence (source-available weights, not an OSI licence), with the Llama 4 acceptable use policy", "transports": [ "http" ], "packages": [], "auth": "none", "authNotes": "Running the model needs no account or key. Getting the weights does. The Hugging Face repository is gated with manual review by Meta and asks for a legal name, date of birth and organisation, and downloads then use a Hugging Face access token. Meta's own download form emails a signed link after the licence is accepted. A vLLM or SGLang server has whatever authentication the owner adds.", "pricing": "free", "pricingNotes": "Free to download and run under the Llama 4 Community Licence, with the owner's GPU as the cost. Meta sells no hosted version that we found. Third parties do, with DeepInfra at $0.18 per 1M tokens (checked 2026-10-08).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402. Llama Guard 4 is a model the owner runs, with no payment route (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 4423, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://dev.meta.ai/llama/docs/model-cards-and-prompt-formats/llama-guard-4", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "openai-compatible" ], "lastRelease": "2025-04-29", "graded": true, "anchor": { "graded": true, "score": 49.5, "grade": "D", "agentReady": false, "rank": 1082, "ranked": true, "rankOf": 1486, "categoryRank": 15, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 28, "payments": 45, "reliability": 38, "schema": 52, "security": 53, "transparency": 59 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": 0, "verdict": "A single self-hosted model classifies text and multi-image prompts against 14 MLCommons-aligned hazard categories and answers in a few tokens. The weights have not changed since 29 April 2025, download access needs Meta's manual approval, and the licence withholds the grant from individuals and companies based in the European Union.", "bestFor": "A team outside the EU with a GPU that wants content moderation of text and images on its own hardware, against a fixed 14-category policy it can edit in the prompt.", "strengths": [ "One 12B model covers text and multi-image prompts, replacing Llama Guard 3-8B and 3-11B-vision per Meta's docs", "The answer is `safe`, or `unsafe` and a comma-separated list of category codes such as S1,S2, so output stays under ten tokens", "The category list sits in the prompt, and the chat template takes `excluded_category_keys` to drop categories per call", "The model card publishes recall and false positive rates on Meta's in-house set and names the categories it handles poorly", "Weights are safetensors loaded by a class inside `transformers`, with ready commands for vLLM and SGLang on the Hugging Face page" ], "weaknesses": [ "Weights last changed on 29 April 2025, with no changelog, version tags or stated deprecation policy", "The Hugging Face repository is gated with manual review, asks for legal name, date of birth and organisation, and two 2026 threads report rejections", "The Llama 4 use policy withholds the licence grant for multimodal models from individuals and companies based in the European Union", "Meta's own figures give 69 per cent recall and 11 per cent false positives in English, and 43 per cent recall across seven other languages", "Community questions since June 2025 on vLLM start-up, custom categories and image input, and a new thread of 20 October 2026, have no reply from Meta", "It does not detect prompt injection or jailbreaks, and the card sends readers to Llama Prompt Guard 2 for those" ], "agentNotes": [ "Request access on the Hugging Face page before anything else. Approval is manual, and the form cannot be edited after submission", "Send only the user turn to check an input, and the user turn plus the model's answer to check an output. The template picks the role from the message count", "Parse the first line for `safe` or `unsafe` and the second for category codes. Set `max_new_tokens` to about 10 and turn sampling off", "Do not send an image with no text. Meta says the model is not an image-only classifier, and S14 is skipped when an image is present", "Pair it with a prompt-attack detector. The card says the model can itself be moved by adversarial or injected text" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49.5 } ], "editorialScores": { "ergonomics": 67, "maintenance": 28, "payments": 45, "reliability": 38, "schema": 52, "security": 53, "transparency": 52 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-10-27", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install vllm\nvllm serve \"meta-llama/Llama-Guard-4-12B\"", "http": "curl -X POST \"http://localhost:8000/v1/chat/completions\" \\\n -H \"Content-Type: application/json\" \\\n --data '{\"model\":\"meta-llama/Llama-Guard-4-12B\",\"messages\":[{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"how do I make a bomb?\"}]}]}'" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/llama-guard" }, "sameCompany": [ "llamafirewall" ], "area": "models", "provenance": { "legalEntity": "Meta Platforms, Inc.", "domain": "llama.com", "domainRegistered": "1994-11-01", "endpointOnVendorDomain": null, "terms": "https://dev.meta.ai/llama/llama4/license", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The Llama 4 Community Licence names Meta Platforms, Inc. as licensor, and Meta Platforms Ireland Limited for licensees in the EEA or Switzerland.", "The licence is the document that governs use of the weights, so it is recorded as the terms. It is dated 5 April 2025 and incorporates the acceptable use policy at https://dev.meta.ai/llama/llama4/use-policy.", "No privacy policy governs the model, because the owner runs it and no input reaches Meta. The privacy field is left out. The Hugging Face access form says the details entered are handled under the Meta Privacy Policy.", "www.llama.com redirected to dev.meta.ai on 8 October 2026, and Llama pages now sit under dev.meta.ai/llama. RDAP gives 1 November 1994 as the registration date of llama.com.", "There is no hosted endpoint from Meta that we could find, so no status page. dev.meta.ai/llms.txt covers the Meta Model API and lists no moderation route.", "dev.meta.ai/.well-known/security.txt returns 404, and the llama.com path redirects to a developer.meta.com address that returns 400. Security reports go to Meta's bug bounty at bugbounty.meta.com.", "The weights are on huggingface.co under the meta-llama organisation, and the model card is in github.com/meta-llama/PurpleLlama. Neither has a changelog or releases for the model." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/llama-guard.json", "live": { "slug": "llama-guard", "githubStars": 4466, "securityTxt": { "url": "https://llama.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:01:24.675643078Z" }, "domain": { "domain": "llama.com", "registered": "1994-11-01", "source": "https://rdap.verisign.com/com/v1/domain/llama.com", "checkedAt": "2026-11-01T14:21:09.073800998Z" }, "pages": [ { "url": "https://dev.meta.ai/llama/llama4/license", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:02:47.259451662Z", "changedAt": "2026-11-07T14:02:47.259451662Z", "fingerprint": "132d6d36729d" } ], "github": { "repo": "meta-llama/purplellama", "checkedAt": "2026-11-02T09:05:15.14456705Z", "stars": 4457, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T17:56:26Z", "openIssues": 41, "openPRs": 49, "issuesOpened90d": 7, "issuesClosed90d": 1, "prsMerged90d": 0, "ci": { "branch": "main", "runs": 50, "success": 16, "failure": 34, "other": 0, "latest": "failure", "latestAt": "2026-10-30T18:03:38Z" }, "replies": { "sampled": 25, "unanswered": 21, "medianDays": 44.9 } }, "updatedAt": "2026-11-07T16:01:24.675643078Z" } }, "answer": "ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency \u0026 trust.", "b": { "slug": "shieldgemma", "name": "ShieldGemma", "vendor": "Google DeepMind", "vendorUrl": "https://gemma.ai/models/shieldgemma.md", "kind": "model", "category": "guardrails", "summary": "ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.", "url": "https://www.anchorterminal.com/tools/shieldgemma", "markdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/shieldgemma.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/shieldgemma.json", "dns": "shieldgemma.grade.anchorterminal.com", "repo": "https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789", "license": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "transports": [], "packages": [ { "registry": "huggingface", "name": "google/shieldgemma-2b" }, { "registry": "huggingface", "name": "google/shieldgemma-9b" }, { "registry": "huggingface", "name": "google/shieldgemma-27b" }, { "registry": "huggingface", "name": "google/shieldgemma-2-4b-it" }, { "registry": "ollama", "name": "shieldgemma" } ], "auth": "none", "authNotes": "No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06).", "pricing": "free", "pricingNotes": "Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06).", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://gemma.ai/models/shieldgemma/model-card-v1.md", "llmsTxt": "https://gemma.ai/llms.txt", "capabilities": [ "guard.moderation", "guard.policy", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "gated", "multimodal", "python", "ollama" ], "lastRelease": "2025-04-04", "graded": true, "anchor": { "graded": true, "score": 54, "grade": "C", "agentReady": false, "rank": 921, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 54 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.", "bestFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "strengths": [ "Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold", "Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images", "Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt", "Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026", "Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1" ], "weaknesses": [ "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy", "ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category", "Each call checks one policy, so screening all four text harm types takes four passes", "Google's files need a Hugging Face or Kaggle login and licence acceptance before download", "The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely" ], "agentNotes": [ "Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording", "Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use", "Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output", "Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category", "Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 54 } ], "editorialScores": { "ergonomics": 72, "maintenance": 40, "payments": 52, "reliability": 46, "schema": 56, "security": 53, "transparency": 50 }, "provenanceScore": 58, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install -U transformers[accelerate]" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/shieldgemma" }, "sameCompany": [ "embeddinggemma-2", "embeddinggemma-300m", "diffusiongemma-26b-a4b-it", "gemma-4-12b-it", "gemma-4-26b-a4b-it", "gemma-4-31b-it", "gemma-4-e2b-it", "gemma-4-e4b-it" ], "area": "models", "provenance": { "legalEntity": "Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author)", "domain": "gemma.ai", "domainRegistered": "2017-12-16", "endpointOnVendorDomain": null, "terms": "https://gemma.ai/resources/terms.md", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored.", "RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar.", "gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme.", "gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only.", "The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages." ], "score": 58 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/shieldgemma.json", "live": { "slug": "shieldgemma", "securityTxt": { "url": "https://gemma.ai/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.210945228Z" }, "llmsTxt": { "url": "https://gemma.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:33:54.388179097Z" }, "updatedAt": "2026-11-07T16:00:22.210945228Z" } }, "edges": [ { "by": 12, "category": "maintenance", "leads": "shieldgemma", "name": "Maintenance \u0026 community", "reasons": { "a": "Read for an open-weight model. The weights and model card were last changed on 29 April 2025, more than 17 months ago (0 of 30). No model revision since, and no successor or retirement announced that we found. Stability earns part of the line under the model reading (8 of 20). Meta staff answered Hugging Face threads in April and May 2025. Threads opened since June 2025, including one of 20 October 2026, have no Meta reply on 4 November, two pull requests from January and August 2026 are still open, and GitHub issue 108 on missed threats in Italian was forwarded on 28 May 2025 with nothing after (6 of 25). `transformers`, vLLM and SGLang load it per the Hugging Face page on 8 October, and Meta's cookbook has a notebook (10 of 15). PurpleLlama had commits on 29 September, 12 October and 30 October 2026, all type-check or benchmark-dataset housekeeping, with tests passing and lint failing on 29 September per the 8 October check (4 of 10). 0 + 8 + 6 + 10 + 4 = 28. The 20-point line is read for a model (notice periods and churn), as for muse-spark-open.", "b": "Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40." }, "scores": { "a": 28, "b": 40 } }, { "by": 8, "category": "reliability", "leads": "shieldgemma", "name": "Reliability", "reasons": { "a": "Scored on the local-software lines, since the owner runs the model. Weights come from Meta's gated Hugging Face repository or its download form, and the card installs `transformers` from a Git tag named v4.51.3-LlamaGuard-preview. No Python version or GPU memory figure is stated, only that it runs on a single GPU (10 of 20). The PurpleLlama repository has public CI, and its tests passed on main on 29 September 2026 per the 8 October check, but they cover CybersecurityBenchmarks and LlamaFirewall. Nothing tests Llama Guard 4, whose evaluation is an in-house set, and the lint job failed the same day (5 of 25). Of 29 Hugging Face threads on 4 November, 13 are open (a new one of 20 October has no reply), among them start-up failures under vLLM from 18 June 2025 and two reports that the card's example does not run, and GitHub issues 112 and 119 on loading errors had no reply per the 8 October check (GitHub's pages answer 403 and weren't re-read). Activity is low (8 of 25). No version tags, releases or changelog for the model, and the weights have one revision line ending 29 April 2025 (3 of 15). Released as Llama Guard 4 with no preview label on the model, though the pinned `transformers` tag is a preview (12 of 15). 10 + 5 + 8 + 3 + 12 = 38.", "b": "Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46." }, "scores": { "a": 38, "b": 46 } }, { "by": 7, "category": "payments", "leads": "shieldgemma", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule, with one departure. Nothing to buy from Meta, and the licence allows commercial use at no charge (20). Free to run with no card (20). The rule would give 20 for use without sign-up, but the weights sit behind a form reviewed by hand that asks for a legal name and date of birth, and two threads in May and June 2026 report rejections, so an agent cannot get access alone (5 of 20). No payment protocol (0). DeepInfra's hosted copy cost $0.18 per 1M tokens per the 8 October check and needs its own account; Hugging Face lists it as the one live provider on 4 November. 20 + 20 + 5 + 0 = 45.", "b": "Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52." }, "scores": { "a": 45, "b": 52 } }, { "by": 5, "category": "ergonomics", "leads": "shieldgemma", "name": "Agent ergonomics", "reasons": { "a": "Read as a classifier an agent calls. The answer is `safe`, or `unsafe` and category codes, and the card's snippet caps it at 10 new tokens (23 of 25). The category list is part of the prompt, the template takes `categories` and `excluded_category_keys`, and the role checked follows from whether the last turn is the user's or the model's (14 of 20). The model has no error responses of its own and returns no score or confidence in the documented path, so a caller parses two lines of text (6 of 20). Calls are stateless, the snippet turns sampling off, and a check can be repeated safely (16 of 20). One `transformers` class or one `vllm serve` command once access is granted, but it needs a GPU for 12B parameters, manual approval and a pinned preview tag in the card (8 of 15). 23 + 14 + 6 + 16 + 8 = 67.", "b": "Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72." }, "scores": { "a": 67, "b": 72 } }, { "by": 5, "category": "transparency", "leads": "llama-guard", "name": "Transparency \u0026 trust", "reasons": { "a": "Weights are downloadable under the Llama 4 Community Licence, which is clear but not an OSI licence. It carries attribution and naming conditions, an acceptable use policy, and no grant for multimodal models to individuals or companies based in the European Union (17 of 30). Inputs stay on the owner's hardware. No privacy statement covers the model, the access form's details go to Meta under its general privacy policy, and training data is described only in outline (20 of 30). No deprecation policy or dates. The docs say Guard 4 replaces Guard 3 8B and 11B and that Guard 3 1B stays useful on edge devices (5 of 20). Weights carry no telemetry, but we found no statement either way and downloads go through Hugging Face (10 of 20). 17 + 20 + 5 + 10 = 52. Licence and use-policy text read in the PurpleLlama clone (Llama-Guard4/12B/LICENSE and USE_POLICY.md); the dev.meta.ai copies per the 8 October check.", "b": "The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50." }, "scores": { "a": 59, "b": 54 } } ], "facts": [ { "a": "Model API", "b": "Model API", "name": "Kind" }, { "a": "Meta", "b": "Google DeepMind", "name": "Vendor" }, { "a": "no (local only)", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "None", "b": "None", "name": "Auth" }, { "a": "Free", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Llama 4 Community Licence (source-available weights, not an OSI licence), with the Llama 4 acceptable use policy", "b": "Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2025-04-29", "b": "2025-04-04", "name": "Last release" }, { "a": "2025-04-05", "b": "2026-04-01", "name": "Terms last updated" }, { "a": "no document linked", "b": "no document linked", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "yes", "name": "Customer content may train models" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "4.4k stars", "b": "none", "name": "Popularity" } ], "faq": [ { "answer": "ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Llama Guard 4 or ShieldGemma?" }, { "answer": "Neither needs a key.", "question": "Do Llama Guard 4 and ShieldGemma need an API key?" }, { "answer": "No hosted endpoint is listed for Llama Guard 4. No hosted endpoint is listed for ShieldGemma.", "question": "Can an agent call Llama Guard 4 and ShieldGemma without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Transparency \u0026 trust, 59 against 54" ], "also": null, "goodFor": "A team outside the EU with a GPU that wants content moderation of text and images on its own hardware, against a fixed 14-category policy it can edit in the prompt.", "slug": "llama-guard", "watchFor": "Weights last changed on 29 April 2025, with no changelog, version tags or stated deprecation policy" }, { "aheadOn": [ "Reliability, 46 against 38", "Agent ergonomics, 72 against 67", "Payments \u0026 pricing, 52 against 45", "Maintenance \u0026 community, 40 against 28" ], "also": null, "goodFor": "Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.", "slug": "shieldgemma", "watchFor": "No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy" } ], "history": { "llama-guard": [ { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.4, "from": 49.1, "fromGrade": "D", "to": 49.5, "toGrade": "D" } ], "shieldgemma": null }, "job": { "capability": "guard.moderation", "name": "Content moderation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llama-guard.json", "title": "Amazon Bedrock Guardrails vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.json", "title": "Amazon Bedrock Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-llama-guard.json", "title": "Azure AI Content Safety (Prompt Shields) vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.json", "title": "Azure AI Content Safety (Prompt Shields) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-llama-guard.json", "title": "Cisco AI Defense Inspection API vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.json", "title": "Cisco AI Defense Inspection API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-llama-guard.json", "title": "Google Cloud Model Armor vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.json", "title": "Google Cloud Model Armor vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.json", "title": "Granite Guardian vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.json", "title": "Granite Guardian vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard.json", "title": "Guardrails AI vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.json", "title": "Guardrails AI vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-llama-guard.json", "title": "Lakera Guard (Check Point AI Guardrails) vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.json", "title": "Lakera Guard (Check Point AI Guardrails) vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-mistral-moderation.json", "title": "Llama Guard 4 vs Mistral Moderation API", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-mistral-moderation" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-nemo-guardrails.json", "title": "Llama Guard 4 vs NVIDIA NeMo Guardrails", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-nemo-guardrails" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails.json", "title": "Llama Guard 4 vs OpenAI Guardrails", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-moderation.json", "title": "Llama Guard 4 vs OpenAI Moderation API", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-openai-moderation" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-prisma-airs.json", "title": "Llama Guard 4 vs Prisma AIRS AI Runtime Security API", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-prisma-airs" }, { "json": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.json", "title": "Mistral Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.json", "title": "NVIDIA NeMo Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.json", "title": "OpenAI Guardrails vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.json", "title": "OpenAI Moderation API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.json", "title": "Prisma AIRS AI Runtime Security API vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.json", "title": "AgentGate vs Llama Guard 4", "url": "https://www.anchorterminal.com/compare/agentgate-vs-llama-guard" }, { "json": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.json", "title": "AgentGate vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-llamafirewall.json", "title": "Llama Guard 4 vs LlamaFirewall", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-llamafirewall" }, { "json": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.json", "title": "LlamaFirewall vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma" }, { "json": "https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio.json", "title": "Llama Guard 4 vs Presidio", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio" }, { "json": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.json", "title": "Presidio vs ShieldGemma", "url": "https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma" } ], "panel": null, "scores": [ { "by": 8, "edge": "shieldgemma", "key": "reliability", "llama-guard": 38, "name": "Reliability", "shieldgemma": 46, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 4, "edge": "shieldgemma", "key": "schema", "llama-guard": 52, "name": "Schema \u0026 documentation", "shieldgemma": 56, "weight": 13 }, { "by": 5, "edge": "shieldgemma", "key": "ergonomics", "llama-guard": 67, "name": "Agent ergonomics", "shieldgemma": 72, "weight": 13 }, { "by": 0, "edge": "", "key": "security", "llama-guard": 53, "name": "Security \u0026 auth", "shieldgemma": 53, "weight": 14 }, { "by": 7, "edge": "shieldgemma", "key": "payments", "llama-guard": 45, "name": "Payments \u0026 pricing", "shieldgemma": 52, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 12, "edge": "shieldgemma", "key": "maintenance", "llama-guard": 28, "name": "Maintenance \u0026 community", "shieldgemma": 40, "weight": 7 }, { "by": 5, "edge": "llama-guard", "key": "transparency", "llama-guard": 59, "name": "Transparency \u0026 trust", "shieldgemma": 54, "weight": 7 } ], "summary": "ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency \u0026 trust. Both do content moderation.", "tasks": null, "tutorials": [], "verdicts": { "llama-guard": "A single self-hosted model classifies text and multi-image prompts against 14 MLCommons-aligned hazard categories and answers in a few tokens. The weights have not changed since 29 April 2025, download access needs Meta's manual approval, and the licence withholds the grant from individuals and companies based in the European Union.", "shieldgemma": "Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma", "json": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.min.md" }, "markdown": "ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency \u0026 trust. Both do content moderation.\n\n- Llama Guard 4: grade D, 49.5/100, rank #1082 of 1486. Markdown https://www.anchorterminal.com/tools/llama-guard.md · JSON https://www.anchorterminal.com/api/v1/tools/llama-guard.json\n- ShieldGemma: grade C, 54/100, rank #921 of 1486. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md\n- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md\n\n## Which one, for what\n\n### Llama Guard 4 (D)\n\nGood for: A team outside the EU with a GPU that wants content moderation of text and images on its own hardware, against a fixed 14-category policy it can edit in the prompt.\n\nAhead on:\n- Transparency \u0026 trust, 59 against 54\n\nWatch for: Weights last changed on 29 April 2025, with no changelog, version tags or stated deprecation policy\n\n### ShieldGemma (C)\n\nGood for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.\n\nAhead on:\n- Reliability, 46 against 38\n- Agent ergonomics, 72 against 67\n- Payments \u0026 pricing, 52 against 45\n- Maintenance \u0026 community, 40 against 28\n\nWatch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy\n\n\n## Why the edge\n\n### Maintenance \u0026 community: ShieldGemma +12\n\n- Llama Guard 4 (28): Read for an open-weight model. The weights and model card were last changed on 29 April 2025, more than 17 months ago (0 of 30). No model revision since, and no successor or retirement announced that we found. Stability earns part of the line under the model reading (8 of 20). Meta staff answered Hugging Face threads in April and May 2025. Threads opened since June 2025, including one of 20 October 2026, have no Meta reply on 4 November, two pull requests from January and August 2026 are still open, and GitHub issue 108 on missed threats in Italian was forwarded on 28 May 2025 with nothing after (6 of 25). `transformers`, vLLM and SGLang load it per the Hugging Face page on 8 October, and Meta's cookbook has a notebook (10 of 15). PurpleLlama had commits on 29 September, 12 October and 30 October 2026, all type-check or benchmark-dataset housekeeping, with tests passing and lint failing on 29 September per the 8 October check (4 of 10). 0 + 8 + 6 + 10 + 4 = 28. The 20-point line is read for a model (notice periods and churn), as for muse-spark-open.\n- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.\n\n### Reliability: ShieldGemma +8\n\n- Llama Guard 4 (38): Scored on the local-software lines, since the owner runs the model. Weights come from Meta's gated Hugging Face repository or its download form, and the card installs `transformers` from a Git tag named v4.51.3-LlamaGuard-preview. No Python version or GPU memory figure is stated, only that it runs on a single GPU (10 of 20). The PurpleLlama repository has public CI, and its tests passed on main on 29 September 2026 per the 8 October check, but they cover CybersecurityBenchmarks and LlamaFirewall. Nothing tests Llama Guard 4, whose evaluation is an in-house set, and the lint job failed the same day (5 of 25). Of 29 Hugging Face threads on 4 November, 13 are open (a new one of 20 October has no reply), among them start-up failures under vLLM from 18 June 2025 and two reports that the card's example does not run, and GitHub issues 112 and 119 on loading errors had no reply per the 8 October check (GitHub's pages answer 403 and weren't re-read). Activity is low (8 of 25). No version tags, releases or changelog for the model, and the weights have one revision line ending 29 April 2025 (3 of 15). Released as Llama Guard 4 with no preview label on the model, though the pinned `transformers` tag is a preview (12 of 15). 10 + 5 + 8 + 3 + 12 = 38.\n- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.\n\n### Payments \u0026 pricing: ShieldGemma +7\n\n- Llama Guard 4 (45): Self-hosted rule, with one departure. Nothing to buy from Meta, and the licence allows commercial use at no charge (20). Free to run with no card (20). The rule would give 20 for use without sign-up, but the weights sit behind a form reviewed by hand that asks for a legal name and date of birth, and two threads in May and June 2026 report rejections, so an agent cannot get access alone (5 of 20). No payment protocol (0). DeepInfra's hosted copy cost $0.18 per 1M tokens per the 8 October check and needs its own account; Hugging Face lists it as the one live provider on 4 November. 20 + 20 + 5 + 0 = 45.\n- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.\n\n### Agent ergonomics: ShieldGemma +5\n\n- Llama Guard 4 (67): Read as a classifier an agent calls. The answer is `safe`, or `unsafe` and category codes, and the card's snippet caps it at 10 new tokens (23 of 25). The category list is part of the prompt, the template takes `categories` and `excluded_category_keys`, and the role checked follows from whether the last turn is the user's or the model's (14 of 20). The model has no error responses of its own and returns no score or confidence in the documented path, so a caller parses two lines of text (6 of 20). Calls are stateless, the snippet turns sampling off, and a check can be repeated safely (16 of 20). One `transformers` class or one `vllm serve` command once access is granted, but it needs a GPU for 12B parameters, manual approval and a pinned preview tag in the card (8 of 15). 23 + 14 + 6 + 16 + 8 = 67.\n- ShieldGemma (72): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.\n\n### Transparency \u0026 trust: Llama Guard 4 +5\n\n- Llama Guard 4 (59): Weights are downloadable under the Llama 4 Community Licence, which is clear but not an OSI licence. It carries attribution and naming conditions, an acceptable use policy, and no grant for multimodal models to individuals or companies based in the European Union (17 of 30). Inputs stay on the owner's hardware. No privacy statement covers the model, the access form's details go to Meta under its general privacy policy, and training data is described only in outline (20 of 30). No deprecation policy or dates. The docs say Guard 4 replaces Guard 3 8B and 11B and that Guard 3 1B stays useful on edge devices (5 of 20). Weights carry no telemetry, but we found no statement either way and downloads go through Hugging Face (10 of 20). 17 + 20 + 5 + 10 = 52. Licence and use-policy text read in the PurpleLlama clone (Llama-Guard4/12B/LICENSE and USE_POLICY.md); the dev.meta.ai copies per the 8 October check.\n- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.\n\n## Score by category\n\n| Category | Weight | Llama Guard 4 | ShieldGemma | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 38 | 46 | ShieldGemma +8 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 52 | 56 | ShieldGemma +4 |\n| Agent ergonomics | 13% (16.2 this run) | 67 | 72 | ShieldGemma +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 53 | 53 | even |\n| Payments \u0026 pricing | 10% (12.5 this run) | 45 | 52 | ShieldGemma +7 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 28 | 40 | ShieldGemma +12 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 59 | 54 | Llama Guard 4 +5 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **49.5 · D** | **54 · C** | |\n\n## Facts side by side\n\n| Fact | Llama Guard 4 | ShieldGemma |\n| --- | --- | --- |\n| Kind | Model API | Model API |\n| Vendor | Meta | Google DeepMind |\n| Hosted endpoint | no (local only) | no (local only) |\n| Transports | HTTP | |\n| Auth | None | None |\n| Pricing | Free | Free |\n| x402 | no | no |\n| Licence | Llama 4 Community Licence (source-available weights, not an OSI licence), with the Llama 4 acceptable use policy | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2025-04-29 | 2025-04-04 |\n| Terms last updated | 2025-04-05 | 2026-04-01 |\n| Privacy policy last updated | no document linked | no document linked |\n| Customer content may train models | not found in the text | yes |\n| Terms restrict automated access | not found in the text | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | not found in the text | not found in the text |\n| Arbitration or class-action waiver | not found in the text | not found in the text |\n| Popularity | 4.4k stars | none |\n\n## How the scores have moved\n\n### Llama Guard 4\n\n- +0.4 on 27 October 2026: checklist\n\n### ShieldGemma\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Llama Guard 4.** A single self-hosted model classifies text and multi-image prompts against 14 MLCommons-aligned hazard categories and answers in a few tokens. The weights have not changed since 29 April 2025, download access needs Meta's manual approval, and the licence withholds the grant from individuals and companies based in the European Union.\n\n**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.\n\n## Before you call either\n\n### Llama Guard 4\n\n1. Request access on the Hugging Face page before anything else. Approval is manual, and the form cannot be edited after submission\n2. Send only the user turn to check an input, and the user turn plus the model's answer to check an output. The template picks the role from the message count\n3. Parse the first line for `safe` or `unsafe` and the second for category codes. Set `max_new_tokens` to about 10 and turn sampling off\n4. Do not send an image with no text. Meta says the model is not an image-only classifier, and S14 is skipped when an image is present\n5. Pair it with a prompt-attack detector. The card says the model can itself be moved by adversarial or injected text\n\n### ShieldGemma\n\n1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording\n2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use\n3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output\n4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category\n5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files\n\n## Questions\n\n### Which is better for AI agents, Llama Guard 4 or ShieldGemma?\n\nShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency \u0026 trust.\n\n### Do Llama Guard 4 and ShieldGemma need an API key?\n\nNeither needs a key.\n\n### Can an agent call Llama Guard 4 and ShieldGemma without installing anything?\n\nNo hosted endpoint is listed for Llama Guard 4. No hosted endpoint is listed for ShieldGemma.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"llama-guard\", \"b\": \"shieldgemma\"}`. From a terminal: `anchor compare llama-guard shieldgemma`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/llama-guard.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json\n\n## Other comparisons with Llama Guard 4 or ShieldGemma\n\n- [Amazon Bedrock Guardrails vs Llama Guard 4](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llama-guard.md)\n- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)\n- [Azure AI Content Safety (Prompt Shields) vs Llama Guard 4](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-llama-guard.md)\n- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)\n- [Cisco AI Defense Inspection API vs Llama Guard 4](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-llama-guard.md)\n- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)\n- [Google Cloud Model Armor vs Llama Guard 4](https://www.anchorterminal.com/compare/google-model-armor-vs-llama-guard.md)\n- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)\n- [Granite Guardian vs Llama Guard 4](https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.md)\n- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)\n- [Guardrails AI vs Llama Guard 4](https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard.md)\n- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)\n- [Lakera Guard (Check Point AI Guardrails) vs Llama Guard 4](https://www.anchorterminal.com/compare/lakera-guard-vs-llama-guard.md)\n- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)\n- [Llama Guard 4 vs Mistral Moderation API](https://www.anchorterminal.com/compare/llama-guard-vs-mistral-moderation.md)\n- [Llama Guard 4 vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/llama-guard-vs-nemo-guardrails.md)\n- [Llama Guard 4 vs OpenAI Guardrails](https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails.md)\n- [Llama Guard 4 vs OpenAI Moderation API](https://www.anchorterminal.com/compare/llama-guard-vs-openai-moderation.md)\n- [Llama Guard 4 vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/llama-guard-vs-prisma-airs.md)\n- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)\n- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)\n- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)\n- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)\n- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)\n- [AgentGate vs Llama Guard 4](https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.md)\n- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)\n- [Llama Guard 4 vs LlamaFirewall](https://www.anchorterminal.com/compare/llama-guard-vs-llamafirewall.md)\n- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)\n- [Llama Guard 4 vs Presidio](https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio.md)\n- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Llama Guard 4 vs ShieldGemma", "url": "" } ], "description": "ShieldGemma scores 54 (C) to Llama Guard 4's 49.5 (D) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Llama Guard 4 D 49.5", "ShieldGemma C 54", "scores" ], "h1": "Llama Guard 4 vs ShieldGemma", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/llama-guard-vs-shieldgemma", "published": "2026-10-01", "section": "tools", "title": "Llama Guard 4 vs ShieldGemma for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma" }, "tokens": { "markdown": 5100, "slim": 2880 }, "version": 1 }