# Llama Guard 4 vs ShieldGemma

> ShieldGemma scores 54 (C) to Llama Guard 4's 49.5 (D) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma
- Markdown: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md (~5,100 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency & trust. Both do content moderation.

- Llama Guard 4: grade D, 49.5/100, rank #1082 of 1486. Markdown https://www.anchorterminal.com/tools/llama-guard.md · JSON https://www.anchorterminal.com/api/v1/tools/llama-guard.json
- ShieldGemma: grade C, 54/100, rank #921 of 1486. Markdown https://www.anchorterminal.com/tools/shieldgemma.md · JSON https://www.anchorterminal.com/api/v1/tools/shieldgemma.json
- Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md
- All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md

## Which one, for what

### Llama Guard 4 (D)

Good for: A team outside the EU with a GPU that wants content moderation of text and images on its own hardware, against a fixed 14-category policy it can edit in the prompt.

Ahead on:
- Transparency & trust, 59 against 54

Watch for: Weights last changed on 29 April 2025, with no changelog, version tags or stated deprecation policy

### ShieldGemma (C)

Good for: Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold.

Ahead on:
- Reliability, 46 against 38
- Agent ergonomics, 72 against 67
- Payments & pricing, 52 against 45
- Maintenance & community, 40 against 28

Watch for: No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy


## Why the edge

### Maintenance & community: ShieldGemma +12

- Llama Guard 4 (28): Read for an open-weight model. The weights and model card were last changed on 29 April 2025, more than 17 months ago (0 of 30). No model revision since, and no successor or retirement announced that we found. Stability earns part of the line under the model reading (8 of 20). Meta staff answered Hugging Face threads in April and May 2025. Threads opened since June 2025, including one of 20 October 2026, have no Meta reply on 4 November, two pull requests from January and August 2026 are still open, and GitHub issue 108 on missed threats in Italian was forwarded on 28 May 2025 with nothing after (6 of 25). `transformers`, vLLM and SGLang load it per the Hugging Face page on 8 October, and Meta's cookbook has a notebook (10 of 15). PurpleLlama had commits on 29 September, 12 October and 30 October 2026, all type-check or benchmark-dataset housekeeping, with tests passing and lint failing on 29 September per the 8 October check (4 of 10). 0 + 8 + 6 + 10 + 4 = 28. The 20-point line is read for a model (notice periods and churn), as for muse-spark-open.
- ShieldGemma (40): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.

### Reliability: ShieldGemma +8

- Llama Guard 4 (38): Scored on the local-software lines, since the owner runs the model. Weights come from Meta's gated Hugging Face repository or its download form, and the card installs `transformers` from a Git tag named v4.51.3-LlamaGuard-preview. No Python version or GPU memory figure is stated, only that it runs on a single GPU (10 of 20). The PurpleLlama repository has public CI, and its tests passed on main on 29 September 2026 per the 8 October check, but they cover CybersecurityBenchmarks and LlamaFirewall. Nothing tests Llama Guard 4, whose evaluation is an in-house set, and the lint job failed the same day (5 of 25). Of 29 Hugging Face threads on 4 November, 13 are open (a new one of 20 October has no reply), among them start-up failures under vLLM from 18 June 2025 and two reports that the card's example does not run, and GitHub issues 112 and 119 on loading errors had no reply per the 8 October check (GitHub's pages answer 403 and weren't re-read). Activity is low (8 of 25). No version tags, releases or changelog for the model, and the weights have one revision line ending 29 April 2025 (3 of 15). Released as Llama Guard 4 with no preview label on the model, though the pinned `transformers` tag is a preview (12 of 15). 10 + 5 + 8 + 3 + 12 = 38.
- ShieldGemma (46): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.

### Payments & pricing: ShieldGemma +7

- Llama Guard 4 (45): Self-hosted rule, with one departure. Nothing to buy from Meta, and the licence allows commercial use at no charge (20). Free to run with no card (20). The rule would give 20 for use without sign-up, but the weights sit behind a form reviewed by hand that asks for a legal name and date of birth, and two threads in May and June 2026 report rejections, so an agent cannot get access alone (5 of 20). No payment protocol (0). DeepInfra's hosted copy cost $0.18 per 1M tokens per the 8 October check and needs its own account; Hugging Face lists it as the one live provider on 4 November. 20 + 20 + 5 + 0 = 45.
- ShieldGemma (52): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.

### Agent ergonomics: ShieldGemma +5

- Llama Guard 4 (67): Read as a classifier an agent calls. The answer is `safe`, or `unsafe` and category codes, and the card's snippet caps it at 10 new tokens (23 of 25). The category list is part of the prompt, the template takes `categories` and `excluded_category_keys`, and the role checked follows from whether the last turn is the user's or the model's (14 of 20). The model has no error responses of its own and returns no score or confidence in the documented path, so a caller parses two lines of text (6 of 20). Calls are stateless, the snippet turns sampling off, and a check can be repeated safely (16 of 20). One `transformers` class or one `vllm serve` command once access is granted, but it needs a GPU for 12B parameters, manual approval and a pinned preview tag in the card (8 of 15). 23 + 14 + 6 + 16 + 8 = 67.
- ShieldGemma (72): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.

### Transparency & trust: Llama Guard 4 +5

- Llama Guard 4 (59): Weights are downloadable under the Llama 4 Community Licence, which is clear but not an OSI licence. It carries attribution and naming conditions, an acceptable use policy, and no grant for multimodal models to individuals or companies based in the European Union (17 of 30). Inputs stay on the owner's hardware. No privacy statement covers the model, the access form's details go to Meta under its general privacy policy, and training data is described only in outline (20 of 30). No deprecation policy or dates. The docs say Guard 4 replaces Guard 3 8B and 11B and that Guard 3 1B stays useful on edge devices (5 of 20). Weights carry no telemetry, but we found no statement either way and downloads go through Hugging Face (10 of 20). 17 + 20 + 5 + 10 = 52. Licence and use-policy text read in the PurpleLlama clone (Llama-Guard4/12B/LICENSE and USE_POLICY.md); the dev.meta.ai copies per the 8 October check.
- ShieldGemma (54): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.

## Score by category

| Category | Weight | Llama Guard 4 | ShieldGemma | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 38 | 46 | ShieldGemma +8 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 52 | 56 | ShieldGemma +4 |
| Agent ergonomics | 13% (16.2 this run) | 67 | 72 | ShieldGemma +5 |
| Security & auth | 14% (17.5 this run) | 53 | 53 | even |
| Payments & pricing | 10% (12.5 this run) | 45 | 52 | ShieldGemma +7 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 28 | 40 | ShieldGemma +12 |
| Transparency & trust | 7% (8.8 this run) | 59 | 54 | Llama Guard 4 +5 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **49.5 · D** | **54 · C** | |

## Facts side by side

| Fact | Llama Guard 4 | ShieldGemma |
| --- | --- | --- |
| Kind | Model API | Model API |
| Vendor | Meta | Google DeepMind |
| Hosted endpoint | no (local only) | no (local only) |
| Transports | HTTP |  |
| Auth | None | None |
| Pricing | Free | Free |
| x402 | no | no |
| Licence | Llama 4 Community Licence (source-available weights, not an OSI licence), with the Llama 4 acceptable use policy | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2025-04-29 | 2025-04-04 |
| Terms last updated | 2025-04-05 | 2026-04-01 |
| Privacy policy last updated | no document linked | no document linked |
| Customer content may train models | not found in the text | yes |
| Terms restrict automated access | not found in the text | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | not found in the text | not found in the text |
| Arbitration or class-action waiver | not found in the text | not found in the text |
| Popularity | 4.4k stars | none |

## How the scores have moved

### Llama Guard 4

- +0.4 on 27 October 2026: checklist

### ShieldGemma

No score change since it was listed.

## Verdicts

**Llama Guard 4.** A single self-hosted model classifies text and multi-image prompts against 14 MLCommons-aligned hazard categories and answers in a few tokens. The weights have not changed since 29 April 2025, download access needs Meta's manual approval, and the licence withholds the grant from individuals and companies based in the European Union.

**ShieldGemma.** Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.

## Before you call either

### Llama Guard 4

1. Request access on the Hugging Face page before anything else. Approval is manual, and the form cannot be edited after submission
2. Send only the user turn to check an input, and the user turn plus the model's answer to check an output. The template picks the role from the message count
3. Parse the first line for `safe` or `unsafe` and the second for category codes. Set `max_new_tokens` to about 10 and turn sampling off
4. Do not send an image with no text. Meta says the model is not an image-only classifier, and S14 is skipped when an image is present
5. Pair it with a prompt-attack detector. The card says the model can itself be moved by adversarial or injected text

### ShieldGemma

1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording
2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use
3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output
4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category
5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files

## Questions

### Which is better for AI agents, Llama Guard 4 or ShieldGemma?

ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency & trust.

### Do Llama Guard 4 and ShieldGemma need an API key?

Neither needs a key.

### Can an agent call Llama Guard 4 and ShieldGemma without installing anything?

No hosted endpoint is listed for Llama Guard 4. No hosted endpoint is listed for ShieldGemma.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json, and with the fewest tokens: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "llama-guard", "b": "shieldgemma"}`. From a terminal: `anchor compare llama-guard shieldgemma`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/llama-guard.json and https://www.anchorterminal.com/api/v1/tools/shieldgemma.json

## Other comparisons with Llama Guard 4 or ShieldGemma

- [Amazon Bedrock Guardrails vs Llama Guard 4](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-llama-guard.md)
- [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md)
- [Azure AI Content Safety (Prompt Shields) vs Llama Guard 4](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-llama-guard.md)
- [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md)
- [Cisco AI Defense Inspection API vs Llama Guard 4](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-llama-guard.md)
- [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md)
- [Google Cloud Model Armor vs Llama Guard 4](https://www.anchorterminal.com/compare/google-model-armor-vs-llama-guard.md)
- [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md)
- [Granite Guardian vs Llama Guard 4](https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.md)
- [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md)
- [Guardrails AI vs Llama Guard 4](https://www.anchorterminal.com/compare/guardrails-ai-vs-llama-guard.md)
- [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md)
- [Lakera Guard (Check Point AI Guardrails) vs Llama Guard 4](https://www.anchorterminal.com/compare/lakera-guard-vs-llama-guard.md)
- [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md)
- [Llama Guard 4 vs Mistral Moderation API](https://www.anchorterminal.com/compare/llama-guard-vs-mistral-moderation.md)
- [Llama Guard 4 vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/llama-guard-vs-nemo-guardrails.md)
- [Llama Guard 4 vs OpenAI Guardrails](https://www.anchorterminal.com/compare/llama-guard-vs-openai-guardrails.md)
- [Llama Guard 4 vs OpenAI Moderation API](https://www.anchorterminal.com/compare/llama-guard-vs-openai-moderation.md)
- [Llama Guard 4 vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/llama-guard-vs-prisma-airs.md)
- [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md)
- [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md)
- [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md)
- [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md)
- [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md)
- [AgentGate vs Llama Guard 4](https://www.anchorterminal.com/compare/agentgate-vs-llama-guard.md)
- [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md)
- [Llama Guard 4 vs LlamaFirewall](https://www.anchorterminal.com/compare/llama-guard-vs-llamafirewall.md)
- [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md)
- [Llama Guard 4 vs Presidio](https://www.anchorterminal.com/compare/llama-guard-vs-microsoft-presidio.md)
- [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp