# Llama Guard 4 vs ShieldGemma (slim)

> ShieldGemma scores 54 (C) to Llama Guard 4's 49.5 (D) for content moderation. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md (~5,100 tokens) · this version ~2,880 tokens · JSON https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.json · canonical https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

ShieldGemma scores 54 (C) on agent readiness against Llama Guard 4's 49.5 (D), and leads in 5 of 7 scored categories. Llama Guard 4 leads on transparency & trust. Both do content moderation.

- Llama Guard 4: D 49.5, rank #1082 of 1486 · https://www.anchorterminal.com/tools/llama-guard.min.md
- ShieldGemma: C 54, rank #921 of 1486 · https://www.anchorterminal.com/tools/shieldgemma.min.md
- Llama Guard 4, good for A team outside the EU with a GPU that wants content moderation of text and images on its own hardware, against a fixed 14-category policy it can edit in the prompt. Ahead on Transparency & trust, 59 against 54.
- ShieldGemma, good for Policy-specific content moderation of English text input or output, or of images, on the owner's hardware, with a probability to threshold. Ahead on Reliability, 46 against 38; Agent ergonomics, 72 against 67; Payments & pricing, 52 against 45; Maintenance & community, 40 against 28.

| Category | Llama Guard 4 | ShieldGemma |
| --- | --- | --- |
| Reliability (16%) | 38 | 46 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 52 | 56 |
| Agent ergonomics (13%) | 67 | 72 |
| Security & auth (14%) | 53 | 53 |
| Payments & pricing (10%) | 45 | 52 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 28 | 40 |
| Transparency & trust (7%) | 59 | 54 |

| Fact (where they differ) | Llama Guard 4 | ShieldGemma |
| --- | --- | --- |
| Vendor | Meta | Google DeepMind |
| Transports | HTTP |  |
| Licence | Llama 4 Community Licence (source-available weights, not an OSI licence), with the Llama 4 acceptable use policy | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence |
| llms.txt | no | yes |
| Last release | 2025-04-29 | 2025-04-04 |
| Terms last updated | 2025-04-05 | 2026-04-01 |
| Customer content may train models | not found in the text | yes |
| Popularity | 4.4k stars | none |

Why the edge:
- Maintenance & community, ShieldGemma +12: Llama Guard 4 28 (Read for an open-weight model. The weights and model card were last changed on 29 April 2025, more than 17 months ago (0 of 30). No model revision since, and no successor or retirement announced that we found. Stability earns part of the line under the model reading (8 of 20). Meta staff answered Hugging Face threads in April and May 2025. Threads opened since June 2025, including one of 20 October 2026, have no Meta reply on 4 November, two pull requests from January and August 2026 are still open, and GitHub issue 108 on missed threats in Italian was forwarded on 28 May 2025 with nothing after (6 of 25). `transformers`, vLLM and SGLang load it per the Hugging Face page on 8 October, and Meta's cookbook has a notebook (10 of 15). PurpleLlama had commits on 29 September, 12 October and 30 October 2026, all type-check or benchmark-dataset housekeeping, with tests passing and lint failing on 29 September per the 8 October check (4 of 10). 0 + 8 + 6 + 10 + 4 = 28. The 20-point line is read for a model (notice periods and churn), as for muse-spark-open.); ShieldGemma 40 (Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40.)
- Reliability, ShieldGemma +8: Llama Guard 4 38 (Scored on the local-software lines, since the owner runs the model. Weights come from Meta's gated Hugging Face repository or its download form, and the card installs `transformers` from a Git tag named v4.51.3-LlamaGuard-preview. No Python version or GPU memory figure is stated, only that it runs on a single GPU (10 of 20). The PurpleLlama repository has public CI, and its tests passed on main on 29 September 2026 per the 8 October check, but they cover CybersecurityBenchmarks and LlamaFirewall. Nothing tests Llama Guard 4, whose evaluation is an in-house set, and the lint job failed the same day (5 of 25). Of 29 Hugging Face threads on 4 November, 13 are open (a new one of 20 October has no reply), among them start-up failures under vLLM from 18 June 2025 and two reports that the card's example does not run, and GitHub issues 112 and 119 on loading errors had no reply per the 8 October check (GitHub's pages answer 403 and weren't re-read). Activity is low (8 of 25). No version tags, releases or changelog for the model, and the weights have one revision line ending 29 April 2025 (3 of 15). Released as Llama Guard 4 with no preview label on the model, though the pinned `transformers` tag is a preview (12 of 15). 10 + 5 + 8 + 3 + 12 = 38.); ShieldGemma 46 (Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46.)
- Payments & pricing, ShieldGemma +7: Llama Guard 4 45 (Self-hosted rule, with one departure. Nothing to buy from Meta, and the licence allows commercial use at no charge (20). Free to run with no card (20). The rule would give 20 for use without sign-up, but the weights sit behind a form reviewed by hand that asks for a legal name and date of birth, and two threads in May and June 2026 report rejections, so an agent cannot get access alone (5 of 20). No payment protocol (0). DeepInfra's hosted copy cost $0.18 per 1M tokens per the 8 October check and needs its own account; Hugging Face lists it as the one live provider on 4 November. 20 + 20 + 5 + 0 = 45.); ShieldGemma 52 (Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52.)
- Agent ergonomics, ShieldGemma +5: Llama Guard 4 67 (Read as a classifier an agent calls. The answer is `safe`, or `unsafe` and category codes, and the card's snippet caps it at 10 new tokens (23 of 25). The category list is part of the prompt, the template takes `categories` and `excluded_category_keys`, and the role checked follows from whether the last turn is the user's or the model's (14 of 20). The model has no error responses of its own and returns no score or confidence in the documented path, so a caller parses two lines of text (6 of 20). Calls are stateless, the snippet turns sampling off, and a check can be repeated safely (16 of 20). One `transformers` class or one `vllm serve` command once access is granted, but it needs a GPU for 12B parameters, manual approval and a pinned preview tag in the card (8 of 15). 23 + 14 + 6 + 16 + 8 = 67.); ShieldGemma 72 (Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72.)
- Transparency & trust, Llama Guard 4 +5: Llama Guard 4 59 (Weights are downloadable under the Llama 4 Community Licence, which is clear but not an OSI licence. It carries attribution and naming conditions, an acceptable use policy, and no grant for multimodal models to individuals or companies based in the European Union (17 of 30). Inputs stay on the owner's hardware. No privacy statement covers the model, the access form's details go to Meta under its general privacy policy, and training data is described only in outline (20 of 30). No deprecation policy or dates. The docs say Guard 4 replaces Guard 3 8B and 11B and that Guard 3 1B stays useful on edge devices (5 of 20). Weights carry no telemetry, but we found no statement either way and downloads go through Hugging Face (10 of 20). 17 + 20 + 5 + 10 = 52. Licence and use-policy text read in the PurpleLlama clone (Llama-Guard4/12B/LICENSE and USE_POLICY.md); the dev.meta.ai copies per the 8 October check.); ShieldGemma 54 (The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50.)