{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/openai-guardrails.json", "name": "OpenAI Guardrails", "score": 69.5, "shared": [ "guard.injection", "guard.moderation", "guard.policy", "guard.self-host" ], "slug": "openai-guardrails" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/nemo-guardrails.json", "name": "NVIDIA NeMo Guardrails", "score": 68.4, "shared": [ "guard.injection", "guard.moderation", "guard.policy", "guard.self-host" ], "slug": "nemo-guardrails" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/lakera-guard.json", "name": "Lakera Guard (Check Point AI Guardrails)", "score": 59.6, "shared": [ "guard.injection", "guard.moderation", "guard.policy", "guard.self-host" ], "slug": "lakera-guard" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/guardrails-ai.json", "name": "Guardrails AI", "score": 49.6, "shared": [ "guard.injection", "guard.moderation", "guard.policy", "guard.self-host" ], "slug": "guardrails-ai" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/google-model-armor.json", "name": "Google Cloud Model Armor", "score": 77.9, "shared": [ "guard.injection", "guard.moderation", "guard.policy" ], "slug": "google-model-armor" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.json", "name": "Amazon Bedrock Guardrails", "score": 74.8, "shared": [ "guard.injection", "guard.moderation", "guard.policy" ], "slug": "amazon-bedrock-guardrails" } ], "tool": { "slug": "granite-guardian", "name": "Granite Guardian", "vendor": "IBM", "vendorUrl": "https://www.ibm.com/granite", "kind": "model", "category": "guardrails", "summary": "Granite Guardian is IBM's family of open-weight judge models. The current 8-billion-parameter release answers yes or no on whether a prompt, response, retrieved context or function call meets a built-in or custom criterion, and the owner runs it.", "url": "https://www.anchorterminal.com/tools/granite-guardian", "markdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/granite-guardian.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/granite-guardian.json", "repo": "https://github.com/ibm-granite/granite-guardian", "license": "Apache 2.0 for the weights and the repository", "transports": [ "http" ], "packages": [], "auth": "none", "authNotes": "No account or key is needed to download or run the model. The Hugging Face repository is not gated. A vLLM or Ollama server has whatever authentication the owner adds.", "pricing": "free", "pricingNotes": "Free to download and run under the Apache 2.0 licence, with the owner's hardware as the cost. IBM's watsonx.ai lists only the earlier `ibm/granite-guardian-3-8b`, marked deprecated, at $0.0002 per 1,000 input or output tokens (checked 2026-10-08). Version 4.1 is not on that list.", "priceSummary": "Free", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402. Granite Guardian is a model the owner runs, with no payment route (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 182, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://www.ibm.com/granite/docs/models/guardian", "capabilities": [ "guard.moderation", "guard.policy", "guard.injection", "guard.self-host" ], "tags": [ "model", "open-weights", "self-hosted", "local", "free", "apache-2.0", "judge", "rag", "python", "ollama" ], "lastRelease": "2026-04-29", "graded": true, "anchor": { "graded": true, "score": 60.1, "grade": "C", "agentReady": false, "rank": 478, "ranked": true, "rankOf": 842, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 69, "maintenance": 47, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 70 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 56, "points": 11.2, "reason": "Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items are open on GitHub. Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with a Git tag each and dated What's New notes, but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 60, "points": 9.75, "reason": "Read for a model the owner serves. There is no specification of its own. The contract is `chat_template.jinja`, the prompt strings in the card and a fixed `\u003cscore\u003e` answer, and vLLM or Ollama supply the HTTP route (8 of 25). www.ibm.com/granite/docs has no llms.txt (the path returns the docs home page). The model card and README are Markdown on Hugging Face and GitHub (5 of 10). The card states the intended use, eleven built-in criteria with definitions, English-only training, the need to test custom criteria, and points to the HAP-38M model for tighter latency (18 of 20). The answer is binary inside fixed tags, and documents and tool schemas have their own template arguments. The criterion is free text (10 of 15). Four code examples, two notebooks for 4.1 and an Ollama page. Nothing documents failure modes such as a missing score tag (10 of 15). Versioned model names, Git tags and dated What's New notes, with no changelog file (9 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 69, "points": 11.21, "reason": "Read as a classifier an agent calls. Without thinking the answer is a yes or no in tags. Think mode adds a reasoning trace, and the card's examples allow 2,048 output tokens. Each call judges one criterion (19 of 25). The caller chooses think or no-think, the criterion, whether the last user or assistant turn is judged, and passes documents and tool schemas separately (17 of 20). The model has no error responses of its own and the 4.1 card documents no confidence value, so a caller parses tags from text (7 of 20). Calls are stateless and the examples set temperature to 0, so a check can be repeated safely (16 of 20). No gate and one `ollama run` command, but the prompt strings and parser must be copied from the card because no package ships them, and vLLM needs a GPU (10 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 58, "points": 10.15, "reason": "Read as software the owner runs. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). A classifier with no write actions (15 of 20). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and dependency scanning was added to the repository on 19 August 2026. The repository has no `SECURITY.md` (issue 20, open since 9 February 2025), and five scanner alerts and an outside bypass report of 19 July 2026 (issue 46) have no reply (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 47, "points": 4.11, "reason": "Read for an open-weight model. The 4.1 weights date from 29 April 2026, 162 days before the check. The card and signature changed on 26 and 27 August 2026, which we do not count as a release (10 of 30). Main releases came in October and December 2024, February and August 2025 and April 2026. The last 90 days brought the evaluation code on 10 August and a cookbook refactor on 19 August, and no model (10 of 20). Maintainers merge their own pull requests within a day and closed the evaluation-code request (issue 26) on 10 August 2026 after 17 months. An outside pull request of 12 August, the bypass report of 19 July and the 4.2 question of 17 September have no reply (10 of 25). `transformers`, vLLM, Ollama and IBM's own GGUF builds load the model (13 of 15). Dependency scanning is on, its five alerts are open, and there is no CI (4 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 70, "points": 6.13, "note": "editorial 67, provenance 73", "reason": "Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai marks its hosted 3.0 model deprecated (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Read as a classifier an agent calls. Without thinking the answer is a yes or no in tags. Think mode adds a reasoning trace, and the card's examples allow 2,048 output tokens. Each call judges one criterion (19 of 25). The caller chooses think or no-think, the criterion, whether the last user or assistant turn is judged, and passes documents and tool schemas separately (17 of 20). The model has no error responses of its own and the 4.1 card documents no confidence value, so a caller parses tags from text (7 of 20). Calls are stateless and the examples set temperature to 0, so a check can be repeated safely (16 of 20). No gate and one `ollama run` command, but the prompt strings and parser must be copied from the card because no package ships them, and vLLM needs a GPU (10 of 15).", "maintenance": "Read for an open-weight model. The 4.1 weights date from 29 April 2026, 162 days before the check. The card and signature changed on 26 and 27 August 2026, which we do not count as a release (10 of 30). Main releases came in October and December 2024, February and August 2025 and April 2026. The last 90 days brought the evaluation code on 10 August and a cookbook refactor on 19 August, and no model (10 of 20). Maintainers merge their own pull requests within a day and closed the evaluation-code request (issue 26) on 10 August 2026 after 17 months. An outside pull request of 12 August, the bypass report of 19 July and the 4.2 question of 17 September have no reply (10 of 25). `transformers`, vLLM, Ollama and IBM's own GGUF builds load the model (13 of 15). Dependency scanning is on, its five alerts are open, and there is no CI (4 of 10).", "payments": "Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.", "reliability": "Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items are open on GitHub. Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with a Git tag each and dated What's New notes, but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15).", "schema": "Read for a model the owner serves. There is no specification of its own. The contract is `chat_template.jinja`, the prompt strings in the card and a fixed `\u003cscore\u003e` answer, and vLLM or Ollama supply the HTTP route (8 of 25). www.ibm.com/granite/docs has no llms.txt (the path returns the docs home page). The model card and README are Markdown on Hugging Face and GitHub (5 of 10). The card states the intended use, eleven built-in criteria with definitions, English-only training, the need to test custom criteria, and points to the HAP-38M model for tighter latency (18 of 20). The answer is binary inside fixed tags, and documents and tool schemas have their own template arguments. The criterion is free text (10 of 15). Four code examples, two notebooks for 4.1 and an Ollama page. Nothing documents failure modes such as a missing score tag (10 of 15). Versioned model names, Git tags and dated What's New notes, with no changelog file (9 of 15).", "security": "Read as software the owner runs. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). A classifier with no write actions (15 of 20). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and dependency scanning was added to the repository on 19 August 2026. The repository has no `SECURITY.md` (issue 20, open since 9 February 2025), and five scanner alerts and an outside bypass report of 19 July 2026 (issue 46) have no reply (15 of 20).", "transparency": "Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai marks its hosted 3.0 model deprecated (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20)." }, "sources": [ { "what": "Granite Guardian 4.1 8B model card", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b", "seen": "2026-10-08" }, { "what": "Hugging Face model metadata (gating, downloads, parameters, last change)", "url": "https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b", "seen": "2026-10-08" }, { "what": "Hugging Face commit history for the model", "url": "https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b/commits/main", "seen": "2026-10-08" }, { "what": "Hugging Face community threads for the model", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b/discussions", "seen": "2026-10-08" }, { "what": "chat template", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b/blob/main/chat_template.jinja", "seen": "2026-10-08" }, { "what": "list of Granite Guardian models on Hugging Face", "url": "https://huggingface.co/api/models?author=ibm-granite\u0026search=guardian", "seen": "2026-10-08" }, { "what": "IBM's GGUF builds", "url": "https://huggingface.co/ibm-granite/granite-guardian-4.1-8b-GGUF", "seen": "2026-10-08" }, { "what": "repository, README, tags, cookbooks and evaluation code (shallow clone at commit 9698a42)", "url": "https://github.com/ibm-granite/granite-guardian", "seen": "2026-10-08" }, { "what": "repository issues and pull requests", "url": "https://github.com/ibm-granite/granite-guardian/issues", "seen": "2026-10-08" }, { "what": "issue 46, outside report of bypasses on 3.0-2B", "url": "https://github.com/ibm-granite/granite-guardian/issues/46", "seen": "2026-10-08" }, { "what": "issue 20, no SECURITY.md", "url": "https://github.com/ibm-granite/granite-guardian/issues/20", "seen": "2026-10-08" }, { "what": "IBM Granite Guardian docs", "url": "https://www.ibm.com/granite/docs/models/guardian", "seen": "2026-10-08" }, { "what": "IBM docs on partners that run Granite", "url": "https://www.ibm.com/granite/docs/run/granite-on-partners", "seen": "2026-10-08" }, { "what": "IBM docs on signature verification", "url": "https://www.ibm.com/granite/docs/model-standards/signature-verification", "seen": "2026-10-08" }, { "what": "IBM naming guidance and licence statement", "url": "https://www.ibm.com/granite/docs/model-standards/naming-guidance", "seen": "2026-10-08" }, { "what": "Ollama library page", "url": "https://ollama.com/library/granite4.1-guardian", "seen": "2026-10-08" }, { "what": "watsonx.ai foundation model list and prices", "url": "https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx", "seen": "2026-10-08" }, { "what": "IBM security.txt", "url": "https://www.ibm.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "RDAP record for ibm.com", "url": "https://rdap.verisign.com/com/v1/domain/ibm.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead named version 3.3. Granite Guardian 4.1 8B (April 2026) is the current model, and the listing grades it. The lead's interface and licence were right.", "unchecked: we did not run the model, so the install lines, GPU memory and whether current `transformers` and vLLM releases load `GraniteForCausalLM` are from IBM's pages only.", "unchecked: who replied on issues 20, 28, 29 and 35 and when. The GitHub API allowance for this network ran out, so only comment counts were read.", "unchecked: the date watsonx.ai withdraws `ibm/granite-guardian-3-8b`, and whether 4.1 is on Azure AI Foundry or Replicate. www.ibm.com/docs answered 403 and the partner lists were not read.", "unchecked: IBM's Granite Trust portal, which the docs give as the home of its responsible AI material.", "Whether a Guardian model based on Granite 4.2 is planned. Issue 54 asks and has no reply.", "Issue 46 is an outside, unverified report against the 3.0-2B model prompted as a chat model, which is outside the scoring mode IBM prescribes. No deduction was taken.", "The 4.1 card lists sexual content in its scope of use but not in its list of built-in criteria. IBM's docs page and the Ollama page list it." ] }, "negative": 0, "verdict": "One ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.", "bestFor": "A team with a GPU that wants one English-language judge for harm, jailbreaks, RAG groundedness, function-call checks and house rules, under a permissive licence with no gate.", "strengths": [ "Weights are ungated on Hugging Face under the Apache 2.0 licence, with IBM's own GGUF builds and an Ollama library entry", "Built-in criteria cover harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour, three RAG checks and function-call hallucination", "A custom criterion is one natural-language sentence in the prompt, and the answer is `yes` or `no` inside `\u003cscore\u003e` tags", "The repository's `evaluation` folder reproduces the card's benchmark figures for versions 3.0 to 4.1", "Weights carry a sigstore signature in `model.sig`, and IBM documents how to verify it" ], "weaknesses": [ "Trained and tested on English only, per the model card", "Each call judges one criterion, so checking several risks takes several calls or a separate LoRA adapter built on the 3.2 model", "Version 4.1 moved the criterion into a `\u003cguardian\u003e` block in the last user message, where 3.x cookbooks pass `guardian_config`", "The repository has no CI, no tests and no `SECURITY.md`, and an issue asking for one has been open since 9 February 2025", "The card's out-of-distribution safety F1 is 0.79 without thinking, below the 0.81 it reports for version 3.3", "IBM's watsonx.ai model list has only `ibm/granite-guardian-3-8b`, marked deprecated, so 4.1 has no hosted endpoint from IBM that we found" ], "agentNotes": [ "Append the `\u003cguardian\u003e` block as the final user message, with the mode line, `### Criteria:` and `### Scoring Schema:`. Copy the strings from the model card, because no package builds them", "Use the no-think instruction for gating and parse `\u003cscore\u003e`. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens", "Treat `yes` as the criterion being met, which for built-in criteria means the risk is present. Treat a missing `\u003cscore\u003e` tag as a failed check", "Pass retrieved text through `documents=` and tool schemas through `available_tools=` in `apply_chat_template`, not inside the message text", "Under Ollama, set `num_ctx` in the request options. IBM's docs say the default context is short and long requests are truncated" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.1 } ], "editorialScores": { "ergonomics": 69, "maintenance": 47, "payments": 60, "reliability": 56, "schema": 60, "security": 58, "transparency": 67 }, "provenanceScore": 73 }, "connect": { "install": "pip install transformers torch vllm", "http": "curl http://localhost:11434/api/chat \\\n -d '{\"model\": \"granite4.1-guardian:8b\", \"messages\": [{\"role\": \"user\", \"content\": \"Hello!\"}]}'" }, "letme": { "capability": "https://letme.dev/guard.moderation", "tool": "https://letme.dev/granite-guardian" }, "notable": [ "Granite Guardian 4.1 8B is the newest main model, fine-tuned from `ibm-granite/granite-4.1-8b` with 8,380,551,168 BF16 parameters. The card gives April 2026 as the release date (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The Hugging Face repository is not gated and showed 55,359 downloads in the last month, 212,264 in total and 48 likes. Its weights date from 29 April 2026, and the card and signature were updated on 26 and 27 August 2026 (https://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b)", "IBM's own figures for 4.1 without thinking are F1 0.79 on out-of-distribution safety sets, balanced accuracy 0.760 on LLM-AggreFact and 0.79 on FC Reward Bench. The same card gives 0.81, 0.761 and 0.74 for version 3.3 (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The model card says the model is trained and tested on English only, that custom criteria need testing, and that reasoning traces may contain unsafe content and may not be faithful (https://huggingface.co/ibm-granite/granite-guardian-4.1-8b)", "The family on Hugging Face also has HAP classifiers of 38M and 125M parameters, 3.x models from 2B to 8B, LoRA adapters on 3.2 for harm categories, harm correction and factuality, and a Japanese toxicity model (https://huggingface.co/api/models?author=ibm-granite\u0026search=guardian)", "IBM publishes GGUF builds from Q2_K to bf16 in `ibm-granite/granite-guardian-4.1-8b-GGUF`, and Ollama's library has `granite4.1-guardian:8b` at 6.9GB with 31.2K downloads (https://ollama.com/library/granite4.1-guardian)", "IBM's watsonx.ai model list has `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens in and out (https://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx)", "The repository's `evaluation` folder, added on 10 August 2026, runs four benchmarks through vLLM and says an 8B model fits on a single 80 GB GPU (https://github.com/ibm-granite/granite-guardian/tree/main/evaluation)", "A GitHub issue of 17 September 2026 asks whether a Guardian model will follow `granite-4.2-8b`. It had no reply on 8 October 2026 (https://github.com/ibm-granite/granite-guardian/issues/54)" ], "area": "models", "details": [ { "label": "Model", "value": "`ibm-granite/granite-guardian-4.1-8b`, 8,380,551,168 parameters in BF16 safetensors, fine-tuned from `ibm-granite/granite-4.1-8b`. `config.json` gives 131,072 positions" }, { "label": "Licence", "value": "Apache 2.0. IBM asks that derivatives put the maker's name before Granite and says the name is a registered trademark (https://www.ibm.com/granite/docs/model-standards/naming-guidance)" }, { "label": "Access", "value": "Not gated on Hugging Face. Also `ollama run granite4.1-guardian:8b` and IBM's GGUF builds" }, { "label": "Built-in criteria", "value": "Harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour. Context relevance, groundedness and answer relevance for RAG. Function-calling hallucination for agents" }, { "label": "Custom criteria", "value": "Any rule in natural language in the `### Criteria:` section. IBM calls this bring your own criteria and says such criteria need testing" }, { "label": "Input", "value": "A conversation whose last user message is a `\u003cguardian\u003e` block with a think or no-think instruction, the criterion and a scoring schema. Documents go in `documents=` and tool schemas in `available_tools=`" }, { "label": "Output", "value": "`\u003cscore\u003eyes\u003c/score\u003e` or `\u003cscore\u003eno\u003c/score\u003e`. Think mode puts a reasoning trace in `\u003cthink\u003e` tags first" }, { "label": "Runtimes", "value": "`transformers` and vLLM in the card, Ollama and GGUF from IBM. The evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and says an 8B model fits on one 80 GB GPU" }, { "label": "IBM's figures", "value": "Version 4.1 without thinking. Safety F1 0.79 across ten sets, LLM-AggreFact balanced accuracy 0.760, FC Reward Bench 0.79, IFEval multi-constraint 0.844" }, { "label": "Languages", "value": "English only, per the model card" }, { "label": "Integrity", "value": "`model.sig` is a sigstore signature. IBM documents verification with `model-signing` and calls model signing experimental (https://www.ibm.com/granite/docs/model-standards/signature-verification)" }, { "label": "Hosted by IBM", "value": "watsonx.ai lists `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens. Version 4.1 is not listed" }, { "label": "Support", "value": "Issues at github.com/ibm-granite/granite-guardian and the Hugging Face community tab. Security reports go to IBM PSIRT" } ], "provenance": { "legalEntity": "International Business Machines Corporation", "domain": "ibm.com", "domainRegistered": "1986-03-19", "endpointOnVendorDomain": null, "terms": "", "privacy": "", "statusPage": "", "changelog": "", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "IBM's naming guidance for Granite names International Business Machines Corporation as the developer and trademark owner.", "The Apache 2.0 licence in the repository is the document that governs use of the weights, so it is recorded as the terms. The Hugging Face repository declares the same licence in its metadata and has no licence file of its own.", "No privacy policy governs the model, because the owner runs it and no input reaches IBM. The privacy field is left out.", "www.ibm.com/.well-known/security.txt is present with PSIRT, HackerOne and email contacts and expires on 8 November 2026.", "RDAP gives 19 March 1986 as the registration date of ibm.com.", "IBM hosts no endpoint for version 4.1 that we found, so there is no status page. The repository has no changelog file. Dated notes sit in the README under What's New.", "Weights are on huggingface.co under the ibm-granite organisation and the code is at github.com/ibm-granite/granite-guardian, both off ibm.com." ], "score": 73, "checks": [ { "check": "Legal entity named", "value": "International Business Machines Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "ibm.com, registered 1986-03-19 (40 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "nothing hosted, so the Apache 2.0 for the weights and the repository licence stands in", "points": 10, "max": 10, "state": "ok" }, { "check": "Privacy policy", "value": "nothing hosted, not scored", "points": 0, "max": 0, "state": "na" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/granite-guardian.json" }, "verify": { "accepts": "a page on ibm.com or one of its subdomains, or the README of github.com/ibm-granite/granite-guardian", "badgeUrl": "https://www.anchorterminal.com/badges/granite-guardian.svg", "body": { "slug": "granite-guardian", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/granite-guardian", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/granite-guardian\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/granite-guardian.svg\" alt=\"Granite Guardian on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Granite Guardian on Anchor Terminal](https://www.anchorterminal.com/badges/granite-guardian.svg)](https://www.anchorterminal.com/tools/granite-guardian)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/granite-guardian\"\u003eGranite Guardian on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/granite-guardian", "json": "https://www.anchorterminal.com/tools/granite-guardian.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/granite-guardian.md", "slim": "https://www.anchorterminal.com/tools/granite-guardian.min.md" }, "markdown": "## Overview\n\n**Grade C · 60.1/100 · rank #478 of 842 · #10 in Guardrails \u0026 safety filters · not agent-ready · confidence medium**\n\n\n## Assessment\n\nOne ungated Apache 2.0 model judges harm, jailbreaks, RAG groundedness, function-call errors and custom criteria, with signed weights and published evaluation code. It is trained and tested on English only, each call checks one criterion, the 4.1 prompt format differs from 3.x, and IBM's watsonx.ai lists only the deprecated 3.0 model.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | IBM (https://www.ibm.com/granite) |\n| Kind | Model API |\n| Category | Guardrails \u0026 safety filters (https://www.anchorterminal.com/categories/guardrails) |\n| Transport | HTTP |\n| Auth | None · No account or key is needed to download or run the model. The Hugging Face repository is not gated. A vLLM or Ollama server has whatever authentication the owner adds. |\n| Pricing | Free (Free) · Free to download and run under the Apache 2.0 licence, with the owner's hardware as the cost. IBM's watsonx.ai lists only the earlier `ibm/granite-guardian-3-8b`, marked deprecated, at $0.0002 per 1,000 input or output tokens (checked 2026-10-08). Version 4.1 is not on that list. |\n| x402 | No · No x402, MPP or L402. Granite Guardian is a model the owner runs, with no payment route (checked 2026-10-08). |\n| Licence | Apache 2.0 for the weights and the repository |\n| Source | https://github.com/ibm-granite/granite-guardian |\n| Docs | https://www.ibm.com/granite/docs/models/guardian |\n| llms.txt | not found |\n| Last release | 2026-04-29 |\n| GitHub stars | 182 (as of 2026-10-08) |\n| Model | `ibm-granite/granite-guardian-4.1-8b`, 8,380,551,168 parameters in BF16 safetensors, fine-tuned from `ibm-granite/granite-4.1-8b`. `config.json` gives 131,072 positions |\n| Licence | Apache 2.0. IBM asks that derivatives put the maker's name before Granite and says the name is a registered trademark (https://www.ibm.com/granite/docs/model-standards/naming-guidance) |\n| Access | Not gated on Hugging Face. Also `ollama run granite4.1-guardian:8b` and IBM's GGUF builds |\n| Built-in criteria | Harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour. Context relevance, groundedness and answer relevance for RAG. Function-calling hallucination for agents |\n| Custom criteria | Any rule in natural language in the `### Criteria:` section. IBM calls this bring your own criteria and says such criteria need testing |\n| Input | A conversation whose last user message is a `\u003cguardian\u003e` block with a think or no-think instruction, the criterion and a scoring schema. Documents go in `documents=` and tool schemas in `available_tools=` |\n| Output | `\u003cscore\u003eyes\u003c/score\u003e` or `\u003cscore\u003eno\u003c/score\u003e`. Think mode puts a reasoning trace in `\u003cthink\u003e` tags first |\n| Runtimes | `transformers` and vLLM in the card, Ollama and GGUF from IBM. The evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and says an 8B model fits on one 80 GB GPU |\n| IBM's figures | Version 4.1 without thinking. Safety F1 0.79 across ten sets, LLM-AggreFact balanced accuracy 0.760, FC Reward Bench 0.79, IFEval multi-constraint 0.844 |\n| Languages | English only, per the model card |\n| Integrity | `model.sig` is a sigstore signature. IBM documents verification with `model-signing` and calls model signing experimental (https://www.ibm.com/granite/docs/model-standards/signature-verification) |\n| Hosted by IBM | watsonx.ai lists `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens. Version 4.1 is not listed |\n| Support | Issues at github.com/ibm-granite/granite-guardian and the Hugging Face community tab. Security reports go to IBM PSIRT |\n| Capabilities | guard.moderation, guard.policy, guard.injection, guard.self-host |\n| Tags | model, open-weights, self-hosted, local, free, apache-2.0, judge, rag, python, ollama |\n| JSON | https://www.anchorterminal.com/api/v1/tools/granite-guardian.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 56 | 11.2 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 60 | 9.8 |\n| Agent ergonomics | 13% | 16.2 | 69 | 11.2 |\n| Security \u0026 auth | 14% | 17.5 | 58 | 10.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 60 | 7.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 47 | 4.1 |\n| Transparency \u0026 trust (editorial 67, provenance 73) | 7% | 8.8 | 70 | 6.1 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **60.1 → C** |\n\n### Why each score\n\n- Reliability 56: Scored on the local-software lines, since the owner runs the model. Weights are ungated on Hugging Face, IBM publishes GGUF builds and Ollama carries `granite4.1-guardian:8b`. The card's install line is `pip install transformers torch vllm` with no versions, and the evaluation code asks for `vllm\u003e=0.15.1` and `transformers\u003e=4.52` and names an 80 GB GPU. No Python version is stated (14 of 20). The repository has no CI workflow and no tests. Its `evaluation` folder reproduces the card's benchmark figures, which is public but is not run automatically (5 of 25). Fourteen items are open on GitHub. Five are automated dependency alerts, one is an outside pull request, and three usage problems from May to September 2025 (issues 28, 29 and 35, on a 3.2 error and on Ollama) are open with three to seven comments each. The 4.1 Hugging Face page has no open thread (14 of 25). Versions are named 3.0 to 4.1 with a Git tag each and dated What's New notes, but there is no changelog file, and 4.1 changed the prompt format from the `guardian_config` argument of the 3.x cookbooks to a `\u003cguardian\u003e` block without a migration note (9 of 15). Released as 4.1 with no preview label. IBM calls model signing experimental (14 of 15).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 60: Read for a model the owner serves. There is no specification of its own. The contract is `chat_template.jinja`, the prompt strings in the card and a fixed `\u003cscore\u003e` answer, and vLLM or Ollama supply the HTTP route (8 of 25). www.ibm.com/granite/docs has no llms.txt (the path returns the docs home page). The model card and README are Markdown on Hugging Face and GitHub (5 of 10). The card states the intended use, eleven built-in criteria with definitions, English-only training, the need to test custom criteria, and points to the HAP-38M model for tighter latency (18 of 20). The answer is binary inside fixed tags, and documents and tool schemas have their own template arguments. The criterion is free text (10 of 15). Four code examples, two notebooks for 4.1 and an Ollama page. Nothing documents failure modes such as a missing score tag (10 of 15). Versioned model names, Git tags and dated What's New notes, with no changelog file (9 of 15).\n- Agent ergonomics 69: Read as a classifier an agent calls. Without thinking the answer is a yes or no in tags. Think mode adds a reasoning trace, and the card's examples allow 2,048 output tokens. Each call judges one criterion (19 of 25). The caller chooses think or no-think, the criterion, whether the last user or assistant turn is judged, and passes documents and tool schemas separately (17 of 20). The model has no error responses of its own and the 4.1 card documents no confidence value, so a caller parses tags from text (7 of 20). Calls are stateless and the examples set temperature to 0, so a check can be repeated safely (16 of 20). No gate and one `ollama run` command, but the prompt strings and parser must be copied from the card because no package ships them, and vLLM needs a GPU (10 of 15).\n- Security \u0026 auth 58: Read as software the owner runs. No account, key or token is needed to get or run the weights, so there is no secret to leak, and any server authentication is the owner's to add (14 of 30). A classifier with no write actions (15 of 20). It reads untrusted text by design and has a built-in jailbreaking criterion. The card says the model may be prone to adversarial attacks and that reasoning traces may contain unsafe content, with no mitigation guidance beyond keeping to the scoring mode (8 of 15). No call log of its own. Think mode gives a reason for each judgement (6 of 15). IBM's security.txt is valid and names PSIRT and HackerOne, the weights are safetensors with a sigstore signature and published verification steps, and dependency scanning was added to the repository on 19 August 2026. The repository has no `SECURITY.md` (issue 20, open since 9 February 2025), and five scanner alerts and an outside bypass report of 19 July 2026 (issue 46) have no reply (15 of 20).\n- Payments \u0026 pricing 60: Self-hosted rule. Nothing to buy for the model, and the Apache 2.0 licence allows commercial use at no charge (20). Free to run with no card (20). The weights are not gated, so an agent can fetch and run them with no sign-up (20). No payment protocol (0). IBM's watsonx.ai sells only the deprecated `ibm/granite-guardian-3-8b` at $0.0002 per 1,000 tokens, which is not the model graded here.\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 47: Read for an open-weight model. The 4.1 weights date from 29 April 2026, 162 days before the check. The card and signature changed on 26 and 27 August 2026, which we do not count as a release (10 of 30). Main releases came in October and December 2024, February and August 2025 and April 2026. The last 90 days brought the evaluation code on 10 August and a cookbook refactor on 19 August, and no model (10 of 20). Maintainers merge their own pull requests within a day and closed the evaluation-code request (issue 26) on 10 August 2026 after 17 months. An outside pull request of 12 August, the bypass report of 19 July and the 4.2 question of 17 September have no reply (10 of 25). `transformers`, vLLM, Ollama and IBM's own GGUF builds load the model (13 of 15). Dependency scanning is on, its five alerts are open, and there is no CI (4 of 10).\n- Transparency \u0026 trust 70: Weights and repository are under the Apache 2.0 licence with no gate and no use policy attached (30 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. Training data is described as hh-rlhf samples annotated at DataForce plus synthetic data, and the datasets are not released (issue 27, open since 28 March 2025) (22 of 30). No deprecation policy for the open weights. Older versions stay downloadable, and watsonx.ai marks its hosted 3.0 model deprecated (5 of 20). The weights carry no telemetry of their own, but we found no statement either way and downloads go through Hugging Face or Ollama (10 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (17 items): https://www.anchorterminal.com/fixes/granite-guardian.md (JSON https://www.anchorterminal.com/fixes/granite-guardian.json)\n\n### What we couldn't check\n\n- The lead named version 3.3. Granite Guardian 4.1 8B (April 2026) is the current model, and the listing grades it. The lead's interface and licence were right.\n- unchecked: we did not run the model, so the install lines, GPU memory and whether current `transformers` and vLLM releases load `GraniteForCausalLM` are from IBM's pages only.\n- unchecked: who replied on issues 20, 28, 29 and 35 and when. The GitHub API allowance for this network ran out, so only comment counts were read.\n- unchecked: the date watsonx.ai withdraws `ibm/granite-guardian-3-8b`, and whether 4.1 is on Azure AI Foundry or Replicate. www.ibm.com/docs answered 403 and the partner lists were not read.\n- unchecked: IBM's Granite Trust portal, which the docs give as the home of its responsible AI material.\n- Whether a Guardian model based on Granite 4.2 is planned. Issue 54 asks and has no reply.\n- Issue 46 is an outside, unverified report against the 3.0-2B model prompted as a chat model, which is outside the scoring mode IBM prescribes. No deduction was taken.\n- The 4.1 card lists sexual content in its scope of use but not in its list of built-in criteria. IBM's docs page and the Ollama page list it.\n\n### Sources\n\n- Granite Guardian 4.1 8B model card: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b\u003e (seen 2026-10-08)\n- Hugging Face model metadata (gating, downloads, parameters, last change): \u003chttps://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b\u003e (seen 2026-10-08)\n- Hugging Face commit history for the model: \u003chttps://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b/commits/main\u003e (seen 2026-10-08)\n- Hugging Face community threads for the model: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b/discussions\u003e (seen 2026-10-08)\n- chat template: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b/blob/main/chat_template.jinja\u003e (seen 2026-10-08)\n- list of Granite Guardian models on Hugging Face: \u003chttps://huggingface.co/api/models?author=ibm-granite\u0026search=guardian\u003e (seen 2026-10-08)\n- IBM's GGUF builds: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b-GGUF\u003e (seen 2026-10-08)\n- repository, README, tags, cookbooks and evaluation code (shallow clone at commit 9698a42): \u003chttps://github.com/ibm-granite/granite-guardian\u003e (seen 2026-10-08)\n- repository issues and pull requests: \u003chttps://github.com/ibm-granite/granite-guardian/issues\u003e (seen 2026-10-08)\n- issue 46, outside report of bypasses on 3.0-2B: \u003chttps://github.com/ibm-granite/granite-guardian/issues/46\u003e (seen 2026-10-08)\n- issue 20, no SECURITY.md: \u003chttps://github.com/ibm-granite/granite-guardian/issues/20\u003e (seen 2026-10-08)\n- IBM Granite Guardian docs: \u003chttps://www.ibm.com/granite/docs/models/guardian\u003e (seen 2026-10-08)\n- IBM docs on partners that run Granite: \u003chttps://www.ibm.com/granite/docs/run/granite-on-partners\u003e (seen 2026-10-08)\n- IBM docs on signature verification: \u003chttps://www.ibm.com/granite/docs/model-standards/signature-verification\u003e (seen 2026-10-08)\n- IBM naming guidance and licence statement: \u003chttps://www.ibm.com/granite/docs/model-standards/naming-guidance\u003e (seen 2026-10-08)\n- Ollama library page: \u003chttps://ollama.com/library/granite4.1-guardian\u003e (seen 2026-10-08)\n- watsonx.ai foundation model list and prices: \u003chttps://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx\u003e (seen 2026-10-08)\n- IBM security.txt: \u003chttps://www.ibm.com/.well-known/security.txt\u003e (seen 2026-10-08)\n- RDAP record for ibm.com: \u003chttps://rdap.verisign.com/com/v1/domain/ibm.com\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 73/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | International Business Machines Corporation | 20/20 |\n| Domain age | ibm.com, registered 1986-03-19 (40 years) | 15/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | nothing hosted, so the Apache 2.0 for the weights and the repository licence stands in | 10/10 |\n| Privacy policy | nothing hosted, not scored | n/a |\n| Status page | not found | 0/10 |\n| Changelog | not found | 0/10 |\n| security.txt | valid | 10/10 |\n\nIBM's naming guidance for Granite names International Business Machines Corporation as the developer and trademark owner.\n\nThe Apache 2.0 licence in the repository is the document that governs use of the weights, so it is recorded as the terms. The Hugging Face repository declares the same licence in its metadata and has no licence file of its own.\n\nNo privacy policy governs the model, because the owner runs it and no input reaches IBM. The privacy field is left out.\n\nwww.ibm.com/.well-known/security.txt is present with PSIRT, HackerOne and email contacts and expires on 8 November 2026.\n\nRDAP gives 19 March 1986 as the registration date of ibm.com.\n\nIBM hosts no endpoint for version 4.1 that we found, so there is no status page. The repository has no changelog file. Dated notes sit in the README under What's New.\n\nWeights are on huggingface.co under the ibm-granite organisation and the code is at github.com/ibm-granite/granite-guardian, both off ibm.com.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service**. Nothing is hosted by the vendor, so there are no terms of service to read. The Apache 2.0 for the weights and the repository licence stands in and the check scores in full.\n\n\n**Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored.\n\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Weights are ungated on Hugging Face under the Apache 2.0 licence, with IBM's own GGUF builds and an Ollama library entry\n- Built-in criteria cover harm, social bias, jailbreaking, violence, profanity, sexual content, unethical behaviour, three RAG checks and function-call hallucination\n- A custom criterion is one natural-language sentence in the prompt, and the answer is `yes` or `no` inside `\u003cscore\u003e` tags\n- The repository's `evaluation` folder reproduces the card's benchmark figures for versions 3.0 to 4.1\n- Weights carry a sigstore signature in `model.sig`, and IBM documents how to verify it\n\n## Weaknesses\n\n- Trained and tested on English only, per the model card\n- Each call judges one criterion, so checking several risks takes several calls or a separate LoRA adapter built on the 3.2 model\n- Version 4.1 moved the criterion into a `\u003cguardian\u003e` block in the last user message, where 3.x cookbooks pass `guardian_config`\n- The repository has no CI, no tests and no `SECURITY.md`, and an issue asking for one has been open since 9 February 2025\n- The card's out-of-distribution safety F1 is 0.79 without thinking, below the 0.81 it reports for version 3.3\n- IBM's watsonx.ai model list has only `ibm/granite-guardian-3-8b`, marked deprecated, so 4.1 has no hosted endpoint from IBM that we found\n\n## Before you call it (notes for agents)\n\n1. Append the `\u003cguardian\u003e` block as the final user message, with the mode line, `### Criteria:` and `### Scoring Schema:`. Copy the strings from the model card, because no package builds them\n2. Use the no-think instruction for gating and parse `\u003cscore\u003e`. Think mode writes a reasoning trace first, and the card's examples allow up to 2,048 output tokens\n3. Treat `yes` as the criterion being met, which for built-in criteria means the risk is present. Treat a missing `\u003cscore\u003e` tag as a failed check\n4. Pass retrieved text through `documents=` and tool schemas through `available_tools=` in `apply_chat_template`, not inside the message text\n5. Under Ollama, set `num_ctx` in the request options. IBM's docs say the default context is short and long requests are truncated\n\n## Connect\n\nInstall:\n\n```bash\npip install transformers torch vllm\n```\n\nFirst request:\n\n```bash\ncurl http://localhost:11434/api/chat \\\n -d '{\"model\": \"granite4.1-guardian:8b\", \"messages\": [{\"role\": \"user\", \"content\": \"Hello!\"}]}'\n```\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| OpenAI Guardrails | B | 69.5 | 175 | guard.injection, guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/openai-guardrails.md |\n| NVIDIA NeMo Guardrails | B | 68.4 | 202 | guard.injection, guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/nemo-guardrails.md |\n| Lakera Guard (Check Point AI Guardrails) | C | 59.6 | 492 | guard.injection, guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/lakera-guard.md |\n| Guardrails AI | D | 49.6 | 701 | guard.injection, guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/guardrails-ai.md |\n| Google Cloud Model Armor | BB | 77.9 | 16 | guard.injection, guard.moderation, guard.policy | no | https://www.anchorterminal.com/tools/google-model-armor.md |\n| Amazon Bedrock Guardrails | BB | 74.8 | 62 | guard.injection, guard.moderation, guard.policy | no | https://www.anchorterminal.com/tools/amazon-bedrock-guardrails.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Granite Guardian 4.1 8B is the newest main model, fine-tuned from `ibm-granite/granite-4.1-8b` with 8,380,551,168 BF16 parameters. The card gives April 2026 as the release date (source: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b\u003e)\n- The Hugging Face repository is not gated and showed 55,359 downloads in the last month, 212,264 in total and 48 likes. Its weights date from 29 April 2026, and the card and signature were updated on 26 and 27 August 2026 (source: \u003chttps://huggingface.co/api/models/ibm-granite/granite-guardian-4.1-8b\u003e)\n- IBM's own figures for 4.1 without thinking are F1 0.79 on out-of-distribution safety sets, balanced accuracy 0.760 on LLM-AggreFact and 0.79 on FC Reward Bench. The same card gives 0.81, 0.761 and 0.74 for version 3.3 (source: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b\u003e)\n- The model card says the model is trained and tested on English only, that custom criteria need testing, and that reasoning traces may contain unsafe content and may not be faithful (source: \u003chttps://huggingface.co/ibm-granite/granite-guardian-4.1-8b\u003e)\n- The family on Hugging Face also has HAP classifiers of 38M and 125M parameters, 3.x models from 2B to 8B, LoRA adapters on 3.2 for harm categories, harm correction and factuality, and a Japanese toxicity model (source: \u003chttps://huggingface.co/api/models?author=ibm-granite\u0026search=guardian\u003e)\n- IBM publishes GGUF builds from Q2_K to bf16 in `ibm-granite/granite-guardian-4.1-8b-GGUF`, and Ollama's library has `granite4.1-guardian:8b` at 6.9GB with 31.2K downloads (source: \u003chttps://ollama.com/library/granite4.1-guardian\u003e)\n- IBM's watsonx.ai model list has `ibm/granite-guardian-3-8b` only, marked deprecated, at $0.0002 per 1,000 tokens in and out (source: \u003chttps://dataplatform.cloud.ibm.com/docs/content/wsj/analyze-data/fm-models.html?context=wx\u003e)\n- The repository's `evaluation` folder, added on 10 August 2026, runs four benchmarks through vLLM and says an 8B model fits on a single 80 GB GPU (source: \u003chttps://github.com/ibm-granite/granite-guardian/tree/main/evaluation\u003e)\n- A GitHub issue of 17 September 2026 asks whether a Guardian model will follow `granite-4.2-8b`. It had no reply on 8 October 2026 (source: \u003chttps://github.com/ibm-granite/granite-guardian/issues/54\u003e)\n\n## Compare\n\n- [Amazon Bedrock Guardrails vs Granite Guardian](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-granite-guardian.md): BB 74.8 vs C 60.1\n- [Azure AI Content Safety (Prompt Shields) vs Granite Guardian](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-granite-guardian.md): C 60.7 vs C 60.1\n- [Cisco AI Defense Inspection API vs Granite Guardian](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-granite-guardian.md): C 61.3 vs C 60.1\n- [Google Cloud Model Armor vs Granite Guardian](https://www.anchorterminal.com/compare/google-model-armor-vs-granite-guardian.md): BB 77.9 vs C 60.1\n- [Granite Guardian vs LlamaFirewall](https://www.anchorterminal.com/compare/granite-guardian-vs-llamafirewall.md): C 60.1 vs D 50.8\n- [Granite Guardian vs Guardrails AI](https://www.anchorterminal.com/compare/granite-guardian-vs-guardrails-ai.md): C 60.1 vs D 49.6\n- [Granite Guardian vs Lakera Guard (Check Point AI Guardrails)](https://www.anchorterminal.com/compare/granite-guardian-vs-lakera-guard.md): C 60.1 vs C 59.6\n- [Granite Guardian vs Llama Guard 4](https://www.anchorterminal.com/compare/granite-guardian-vs-llama-guard.md): C 60.1 vs D 49.1\n- [Granite Guardian vs Mistral Moderation API](https://www.anchorterminal.com/compare/granite-guardian-vs-mistral-moderation.md): C 60.1 vs C 58.4\n- [Granite Guardian vs NVIDIA NeMo Guardrails](https://www.anchorterminal.com/compare/granite-guardian-vs-nemo-guardrails.md): C 60.1 vs B 68.4\n- [Granite Guardian vs OpenAI Guardrails](https://www.anchorterminal.com/compare/granite-guardian-vs-openai-guardrails.md): C 60.1 vs B 69.5\n- [Granite Guardian vs OpenAI Moderation API](https://www.anchorterminal.com/compare/granite-guardian-vs-openai-moderation.md): C 60.1 vs BB 71.3\n- [Granite Guardian vs Prisma AIRS AI Runtime Security API](https://www.anchorterminal.com/compare/granite-guardian-vs-prisma-airs.md): C 60.1 vs B 62.8\n- [Granite Guardian vs Presidio](https://www.anchorterminal.com/compare/granite-guardian-vs-microsoft-presidio.md): C 60.1 vs B 66\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on ibm.com or one of its subdomains, or the README of github.com/ibm-granite/granite-guardian. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"granite-guardian\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/granite-guardian\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/granite-guardian.svg\" alt=\"Granite Guardian on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Granite Guardian on Anchor Terminal](https://www.anchorterminal.com/badges/granite-guardian.svg)](https://www.anchorterminal.com/tools/granite-guardian)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/granite-guardian\"\u003eGranite Guardian on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Granite Guardian is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/granite-guardian-dark.png\n- Light: https://www.anchorterminal.com/assets/share/granite-guardian-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Guardrails \u0026 safety filters", "url": "https://www.anchorterminal.com/categories/guardrails" }, { "name": "Granite Guardian", "url": "" } ], "description": "Granite Guardian is IBM's family of open-weight judge models. The current 8-billion-parameter release answers yes or no on whether a prompt, response, retrieved context or function call meets a built-in or custom criterion, and the owner runs it.", "facts": [ "rank #478 of 842", "None auth", "0 desk reviews" ], "h1": "Granite Guardian", "image": "https://www.anchorterminal.com/assets/og/tools-granite-guardian.png", "path": "/tools/granite-guardian", "published": "2026-10-01", "section": "tools", "title": "Granite Guardian review for AI agents, grade C (60.1/100)", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/tools/granite-guardian" }, "tokens": { "markdown": 7150, "slim": 1680 }, "version": 1 }