# ShieldGemma > ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them. - Canonical: https://www.anchorterminal.com/tools/shieldgemma - Pricing: https://www.anchorterminal.com/tools/shieldgemma#pricing - Reviews: https://www.anchorterminal.com/tools/shieldgemma#reviews - Markdown: https://www.anchorterminal.com/tools/shieldgemma.md (~8,150 tokens) - Slim: https://www.anchorterminal.com/tools/shieldgemma.min.md (~1,780 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/shieldgemma.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT shieldgemma.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 ## Overview **Grade C · 54/100 · rank #921 of 1486 · #13 in Guardrails & safety filters · not agent-ready · confidence medium** More from Google DeepMind, listed separately because each is its own product: [EmbeddingGemma 2](https://www.anchorterminal.com/tools/embeddinggemma-2.md) (Embeddings & rerankers), [EmbeddingGemma 300M](https://www.anchorterminal.com/tools/embeddinggemma-300m.md) (Embeddings & rerankers), [DiffusionGemma 26B A4B IT](https://www.anchorterminal.com/tools/diffusiongemma-26b-a4b-it.md) (Open-weight models), [Gemma 4 12B IT](https://www.anchorterminal.com/tools/gemma-4-12b-it.md) (Open-weight models), [Gemma 4 26B A4B IT](https://www.anchorterminal.com/tools/gemma-4-26b-a4b-it.md) (Open-weight models), [Gemma 4 31B IT](https://www.anchorterminal.com/tools/gemma-4-31b-it.md) (Open-weight models), [Gemma 4 E2B IT](https://www.anchorterminal.com/tools/gemma-4-e2b-it.md) (Open-weight models), [Gemma 4 E4B IT](https://www.anchorterminal.com/tools/gemma-4-e4b-it.md) (Open-weight models). ## Assessment Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance. ## Facts | Field | Value | | --- | --- | | Vendor | Google DeepMind (https://gemma.ai/models/shieldgemma.md) | | Kind | Model API | | Category | Guardrails & safety filters (https://www.anchorterminal.com/categories/guardrails) | | Auth | None · No key is needed to run the model. Google's files on Hugging Face are gated, so a person logs in, reviews the Gemma licence and accepts it, and the Hub page says requests are approved immediately. Kaggle also needs an account. Ollama's library copies of ShieldGemma 1 pull with no account. Any authentication on the server is the owner's to add (checked 2026-11-06). | | Pricing | Free (Free) · Free to download and run under the Gemma Terms of Use, with the owner's hardware as the cost. Google sells no hosted ShieldGemma that we found, and the Hub's API lists no inference provider for any of the four repositories (checked 2026-11-06). | | x402 | No · Weights the owner downloads and runs, so there is nothing to pay per call and no payment protocol (checked 2026-11-06). | | Licence | Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence | | Packages | huggingface: `google/shieldgemma-2b`; huggingface: `google/shieldgemma-9b`; huggingface: `google/shieldgemma-27b`; huggingface: `google/shieldgemma-2-4b-it`; ollama: `shieldgemma` | | Source | https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789 | | Docs | https://gemma.ai/models/shieldgemma/model-card-v1.md | | llms.txt | https://gemma.ai/llms.txt | | Last release | 2025-04-04 | | Surface listed | The four ShieldGemma checkpoints Google publishes, run by the owner through Transformers, Keras or Ollama. Read from gemma.ai, ai.google.dev, the Hugging Face pages and API, and Ollama's library on 6 November 2026. No weights were downloaded and no terms were accepted | | Same vendor, other listings | Google Cloud Model Armor (google-model-armor) is Google's hosted screening API and a separate listing. The Gemma 4 and EmbeddingGemma listings are other Gemma models | | Models | google/shieldgemma-2b (2,614,341,888 parameters), shieldgemma-9b (9,241,705,984), shieldgemma-27b (27,227,128,320), all BF16 safetensors on Gemma 2, and google/shieldgemma-2-4b-it (4,300,079,472) on Gemma 3 | | Harm types | ShieldGemma 1, sexually explicit information, dangerous content, hate speech and harassment. ShieldGemma 2, sexually explicit, dangerous and violence or gore content in images | | Input | A preamble, the text or image to classify, one policy description and an epilogue, in a fixed pattern from the card. The Transformers chat template takes the policy as a `guideline` argument or a system message | | Output | The probability that the next token is `Yes` (violates the policy) or `No`, read from the logits. A caller that only gets text, such as an Ollama chat call, reads the first word | | Licence | Gemma Terms of Use, last modified 1 April 2026, with dated earlier versions in an archive. Commercial use allowed, distribution must carry the use restrictions, and the Prohibited Use Policy applies | | Access | Gated on Hugging Face (log in and accept the licence, approved immediately) and on Kaggle. Ollama's library copies of ShieldGemma 1 need no account | | Runtimes | Transformers (Gemma 2 classes for ShieldGemma 1, a `ShieldGemma2` model page in the Transformers docs), Keras through Google's Colab notebook, and Ollama for ShieldGemma 1. vLLM and llama.cpp support was not checked first-hand | | Google's figures | Optimal F1 and AU-PRC on Google's SG prompt and response sets, the OpenAI Moderation set and ToxicChat, for example 0.828/0.894 on SG Prompt for the 9B. These are the publisher's own results | | Support | Community tabs on each Hugging Face repository, where Google accounts answered every thread we sampled, and Kaggle discussions | | Capabilities | guard.moderation, guard.policy, guard.self-host | | Tags | model, open-weights, self-hosted, local, free, gated, multimodal, python, ollama | | JSON | https://www.anchorterminal.com/api/v1/tools/shieldgemma.json | ## Score breakdown (methodology v0.7, October 2026 research run) Assessed 2026-11-06 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 46 | 9.2 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 56 | 9.1 | | Agent ergonomics | 13% | 16.2 | 72 | 11.7 | | Security & auth | 14% | 17.5 | 53 | 9.3 | | Payments & pricing | 10% | 12.5 | 52 | 6.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 40 | 3.5 | | Transparency & trust (editorial 50, provenance 58) | 7% | 8.8 | 54 | 4.7 | | Negative events | up to −15 | up to −15 | none recorded | 0 | | **Total** | | | | **54 → C** | ### Why each score - Reliability 46 (checked 2026-11-06): Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. Google's install line is `pip install -U transformers[accelerate]` with no versions, a Keras Colab notebook covers ShieldGemma 1, and Ollama's own library carries ShieldGemma 1. No Python version or memory figure is stated, and the publisher's files sit behind a login and licence click-through (12 of 20). No CI, tests or evaluation code for the models were found. The technical reports describe the evaluation and nothing reruns it (0 of 25). On the Hub, 8 of 23 threads on the 2B, 2 of 10 on the 9B, none of 8 on the 27B and 9 of 10 on ShieldGemma 2 are open, but every open thread we sampled has a reply from a Google account, the newest on 22 March 2026 (15 of 25). No changelog or version tags. The two generations are named and sit in their own repositories (4 of 15). Released with no preview label (15 of 15). 12 + 0 + 15 + 4 + 15 = 46. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 56 (checked 2026-11-06): Read for a model the owner serves. There is no specification of its own. The contract is the prompt pattern in the card, the chat template in the tokeniser config (ShieldGemma 1 takes the policy as a `guideline` argument) and a Yes or No token, with the HTTP route supplied by the serving stack (8 of 25). gemma.ai/llms.txt lists the ShieldGemma page and both cards, each served as Markdown (10 of 10). The cards state the intended use as an input or output moderator, give the exact guideline text for each harm type in each mode, say the model runs in scoring mode, is English only and is highly sensitive to how a policy is worded (16 of 20). Fixed harm types and a binary answer, with the policy as free text (10 of 15). A Transformers snippet for each generation and a Keras notebook. No failure modes or error cases are documented (8 of 15). Two named generations with no changelog, and the ai.google.dev page is marked deprecated in favour of gemma.ai (4 of 15). 8 + 10 + 16 + 10 + 8 + 4 = 56. - Agent ergonomics 72 (checked 2026-11-06): Read as a classifier an agent calls. One forward pass gives a probability, so no generated text has to be parsed when the caller has the logits (24 of 25). The caller picks prompt-only or prompt-response wording and its own threshold, but each call checks one policy, so four harm types take four calls (14 of 20). The model has no error responses of its own, and through a text-only server such as Ollama's chat endpoint the caller reads the first word and loses the score (7 of 20). Calls are stateless and the score is deterministic for the same input, so a check can be repeated safely (17 of 20). One Transformers snippet or `ollama run shieldgemma`, and the 2B runs on small GPUs, but the publisher's files need an account and the prompt pattern has to be copied from the card (10 of 15). 24 + 14 + 7 + 17 + 10 = 72. - Security & auth 53 (checked 2026-11-06): Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. No key is needed to run it. Google's files need a Hugging Face login and licence acceptance, approved immediately, so there is a token to download but no secret at run time (13 of 30). Self-hosted, so inputs stay on the owner's hardware and nothing reaches Google, though no Google page says so (15 of 20). It reads untrusted text by design. The card says the model is highly sensitive to the policy wording and may behave unpredictably with ambiguous language, and gives no prompt-injection guidance (6 of 15). No call log of its own, though each call returns a score (5 of 15). Weights are safetensors only and load through Transformers classes with no remote code. Google's security.txt is valid and points to its reward programme, and there is no model-specific security page or advisory record (14 of 20). 13 + 15 + 6 + 5 + 14 = 53. - Payments & pricing 52 (checked 2026-11-06): Self-hosted rule. Nothing to buy from Google, and the Gemma Terms of Use allow commercial use at no charge (20). Free to run with no card (20). Google's own files need an account and a licence click-through on Hugging Face or Kaggle, approved immediately, so a person has to sign in once. Ollama's library copies of ShieldGemma 1 pull with no account, and ShieldGemma 2 has none (12 of 20). No payment protocol (0). No hosted ShieldGemma from Google or an inference provider was found. 20 + 20 + 12 + 0 = 52. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 40 (checked 2026-11-06): Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). The newest file change is ShieldGemma 2 on 4 April 2025, 19 months before the check, and ShieldGemma 1 last changed in September 2024 (0 of 30). No deprecation policy. Both generations stay downloadable, and the ai.google.dev page was marked deprecated with a pointer to gemma.ai without dates for the models (3 of 12). Two generations in 2024 and 2025, each in its own repository, none replaced in place (6 of 8). Google accounts (members of Google's Gemma organisations on the Hub) answered every thread we sampled on the 2B, 9B and ShieldGemma 2 pages, from August 2024 to 22 March 2026, but leave most threads open (16 of 25). Transformers, Keras and Ollama's library load it (12 of 15). No CI, and Ollama's library build was last updated 2 years ago (3 of 10). 0 + 3 + 6 + 16 + 12 + 3 = 40. - Transparency & trust 54 (checked 2026-11-06): The weights are under the Gemma Terms of Use, not an OSI licence. They carry distribution conditions, the Prohibited Use Policy and a clause that lets Google restrict usage remotely where it believes the terms are breached. The terms are dated (1 April 2026) with earlier versions archived (15 of 30). Inputs stay on the owner's hardware, so no privacy statement applies. ShieldGemma 1 was fine-tuned on synthetic internal data and public datasets described in a technical report, and ShieldGemma 2 on a WebLI subset and synthetic images with CSAM filtering. No data is released (20 of 30). No deprecation policy or dated model retirements (5 of 20). The weights carry no telemetry of their own, with no statement either way, and downloads go through Hugging Face, Kaggle or Ollama (10 of 20). 15 + 20 + 5 + 10 = 50. Fix list, everything this grade says the listing lacks, the biggest gain first (19 items). What it covers is at https://www.anchorterminal.com/fixes/shieldgemma.md (JSON https://www.anchorterminal.com/fixes/shieldgemma.json). The whole list for a coding agent comes from `POST https://www.anchorterminal.com/api/v1/fix-list` with `{"listing": "shieldgemma", "plan": "read"}`, free while the beta runs ### What we couldn't check - Graded as `kind: model` on the seven-category reading, as its guardrail peers llama-guard and granite-guardian were (rechecked 4 November 2026), so the three compare in one head-to-head. research/BRIEF.md says open-weight files take `kind: weights` and the v0.6 open-weight checklist in any category; a person should decide whether all three move together - unchecked: whether current vLLM and llama.cpp releases load ShieldGemma 1 and 2. We did not read the runtimes' code and did not run the model - unchecked: memory needed. Google states no figure; the BF16 file sizes are about 5.2 GB (2B), 18.5 GB (9B), 54 GB (27B) and 8.6 GB (ShieldGemma 2) - unchecked: Kaggle pages and discussions, and the Keras notebook in google-gemini/gemma-cookbook, which were not read - The Hugging Face README files sit behind the gate, so the Hub card text was read from the public model page and the cards from gemma.ai - Whether Google plans a ShieldGemma built on Gemma 4. No first-hand page mentions one - The Hub API reports `gated: manual` for all four repositories while the model page says requests are approved immediately ### Sources - ShieldGemma page: (seen 2026-11-06) - ShieldGemma 1 model card: (seen 2026-11-06) - ShieldGemma 2 model card: (seen 2026-11-06) - Gemma docs index for agents: (seen 2026-11-06) - Gemma Terms of Use: (seen 2026-11-06) - Gemma Prohibited Use Policy: (seen 2026-11-06) - deprecated ai.google.dev ShieldGemma page: (seen 2026-11-06) - Hub page with gate notice and usage snippet: (seen 2026-11-06) - Hub model API, files and downloads: (seen 2026-11-06) - Hub model API, ShieldGemma 2: (seen 2026-11-06) - Hub discussions, authors and dates counted by script: (seen 2026-11-06) - Ollama library tags: (seen 2026-11-06) - Transformers ShieldGemma 2 page: (seen 2026-11-06) - Google security.txt: (seen 2026-11-06) - RDAP record for gemma.ai: (seen 2026-11-06) ## Score history Every move of a score since the listing was graded, newest first, with its cause. A score can't move without an entry here. JSON: https://www.anchorterminal.com/api/v1/tools/shieldgemma/history.json - 2026-11-06: graded 54 C (methodology 0.7) ## Who's behind it (provenance 58/100, checked 2026-11-06) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author) | 20/20 | | Domain age | gemma.ai, registered 2017-12-16 (8 years) | 11/15 | | Endpoint on the vendor's domain | no hosted endpoint | n/a | | Terms of service | read, states 5 of the 7 things a reader expects, and has 1 clause that costs points | 6.3/10 | | Privacy policy | nothing hosted, not scored | n/a | | Status page | not found | 0/10 | | Changelog | not found | 0/10 | | security.txt | not found | 0/10 | | People named | 6 named with their role, 1 with a public profile | 10/10 | | Support route | help pages, a community | 5/5 | Nothing is hosted, so the Gemma Terms of Use stand in for terms of service and no privacy policy is scored. RDAP for gemma.ai, read on 6 November 2026, gives a registration date of 16 December 2017 and Google LLC as registrant, with MarkMonitor as registrar. gemma.ai/.well-known/security.txt answered with the site's HTML page, not a security.txt, on 6 November 2026. Google's company-wide security.txt at www.google.com is valid until 1 April 2030 and points to its vulnerability reward programme. gemma.ai/robots.txt and ai.google.dev/robots.txt allow our reader. huggingface.co/robots.txt allows all paths, and the Hub's model API was used for file metadata and discussion authors only. The Hugging Face README files sit behind the gate (raw files answered 401 without a login), so the cards were read from gemma.ai and the public model pages. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service** (https://gemma.ai/resources/terms.md), read 2026-10-30, dated 2026-04-01, states 5 of the 7 things a reader expects. - To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). "…model in order to cause that model to perform similarly to Gemma, including distillation methods that use intermediate data representations or methods based on the generation of synthetic data Outputs by Gemma for training that model." - Gives the date it was last updated. Last updated 2026-04-01. - Names the governing law or courts. The law of the State of California. - States a limit on its liability. Rules out indirect and consequential losses, with no cap named in this sentence. - Not found in the text. Says how changes to the terms are announced. - Not found in the text. Refers to a service level or uptime commitment. **Privacy policy**. Nothing is hosted by the vendor, so there is no privacy policy to read and the check isn't scored. ## Humans behind the project (researched 2026-11-06 from public pages, not part of the grade) ### Key people - Demis Hassabis, Co-founder and CEO, Google DeepMind - Shane Legg, Co-founder and Chief AGI Scientist, Google DeepMind - Mustafa Suleyman, Co-founder and former head of applied AI, DeepMind - Gus Martins, Gemma Product Manager. LinkedIn: https://uk.linkedin.com/in/lgusmartins. X: https://x.com/gusthema - Wenjun Zeng, Lead author, ShieldGemma and ShieldGemma 2 technical reports - Ryan Mullins, Author, ShieldGemma and ShieldGemma 2 technical reports - Note: Google DeepMind's about page, read on 28 October 2026, names Demis Hassabis as Co-founder and CEO and no other leaders. The other two founders and their roles come from Wikipedia's articles on Shane Legg and Mustafa Suleyman. Google's Cloud Next 2026 speaker page calls Gus Martins a Product Manager at Google DeepMind driving the roadmap of the Gemma model family. The DiffusionGemma launch post of 10 June 2026 names Brendan O'Donoghue and Sebastian Flennerhag as Research Scientists, and the EmbeddingGemma launch post of 4 September 2025 names Min Choi (Product Manager) and Sahil Dua (Lead Research Engineer); they stay on those listings only. For this listing, the ShieldGemma and ShieldGemma 2 model cards on gemma.ai (read 6 November 2026) cite technical reports with Wenjun Zeng as first author and Ryan Mullins among the authors; Ryan Mullins also answered on the ShieldGemma 2 Hugging Face page in March 2025 from an account in Google's organisation. Ownership is carried from the Gemma listings. - Google DeepMind: LinkedIn https://www.linkedin.com/company/googledeepmind/ X https://x.com/googlegemma ### Ownership and investors - Ownership: Part of Alphabet Inc. ### Getting support - Help: https://gemma.ai/models/shieldgemma.md - Help: https://www.kaggle.com/models/google/shieldgemma - Community (ShieldGemma 2 discussions on Hugging Face): https://huggingface.co/google/shieldgemma-2-4b-it/discussions - Community (ShieldGemma 9B discussions on Hugging Face): https://huggingface.co/google/shieldgemma-9b/discussions - Sources: https://uk.linkedin.com/in/lgusmartins, https://x.com/gusthema, https://gemma.ai/, https://x.com/Google, https://deepmind.google/, https://en.wikipedia.org/wiki/Google_DeepMind, https://deepmind.google/about/, https://en.wikipedia.org/wiki/Demis_Hassabis, https://en.wikipedia.org/wiki/Shane_Legg, https://en.wikipedia.org/wiki/Mustafa_Suleyman, https://gemma.ai/models/shieldgemma/model-card-v1.md, https://gemma.ai/models/shieldgemma/model-card-v2.md ## Live (updated 2026-11-07 16:00 UTC) - security.txt: none - Always current: https://www.anchorterminal.com/api/v1/live/shieldgemma.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Strengths - Scoring mode returns the probability of `Yes` per policy from one forward pass, so the caller sets its own threshold - Four sizes, ShieldGemma 1 at 2B, 9B and 27B for text and ShieldGemma 2 at 4B for images - Cards give the exact guideline wording for each harm type, separately for input and output filtering, in Markdown listed in gemma.ai/llms.txt - Google accounts replied to every Hub thread we sampled, the newest on 22 March 2026 - Safetensors only, loaded through Transformers classes with no remote code, and Ollama's library carries ShieldGemma 1 ## Weaknesses - No file change since 4 April 2025 (ShieldGemma 2) and September 2024 (ShieldGemma 1), with no changelog or deprecation policy - ShieldGemma 1 covers four harm types in English only, and neither generation has a prompt-injection or jailbreak category - Each call checks one policy, so screening all four text harm types takes four passes - Google's files need a Hugging Face or Kaggle login and licence acceptance before download - The Gemma Terms of Use add a prohibited use policy and let Google restrict usage remotely ## Before you call it (notes for agents) 1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording 2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use 3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output 4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category 5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files ## Connect Install: ```bash pip install -U transformers[accelerate] ``` ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | NVIDIA NeMo Guardrails | B | 69.5 | 240 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/nemo-guardrails.md | | OpenAI Guardrails | B | 68 | 296 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/openai-guardrails.md | | Lakera Guard (Check Point AI Guardrails) | B | 65.8 | 400 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/lakera-guard.md | | Granite Guardian | C | 59.4 | 701 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/granite-guardian.md | | Llama Guard 4 | D | 49.5 | 1082 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/llama-guard.md | | Guardrails AI | D | 47.8 | 1128 | guard.moderation, guard.policy, guard.self-host | no | https://www.anchorterminal.com/tools/guardrails-ai.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - ShieldGemma 1 is text-to-text, English only, in 2B, 9B and 27B sizes built on Gemma 2, for four harm types (sexually explicit, dangerous content, hate, harassment), with separate guideline wording for prompt-only and prompt-response checks (source: ) - The models are meant to run in scoring mode. The caller reads the probability of the `Yes` and `No` tokens at the last position and applies softmax, and the Hub example prints a score of 0.73 (source: ) - ShieldGemma 2 is a 4B image classifier trained from Gemma 3 4B IT for sexually explicit, dangerous and violent content, returning Yes and No probabilities per policy (source: ) - Hugging Face downloads in the last 30 days on 6 November 2026, from the Hub's API: shieldgemma-9b 255,858, shieldgemma-2-4b-it 7,016, shieldgemma-2b 3,345, shieldgemma-27b 123 (source: ) - Files were last changed on 28 August 2024 (2B), 6 September 2024 (9B and 27B) and 4 April 2025 (ShieldGemma 2), per the Hub's API on 6 November 2026 (source: ) - Ollama's library carries `shieldgemma` in 2b, 9b and 27b tags with quantised builds, 992.6K downloads and last updated 2 years ago on 6 November 2026. There is no ShieldGemma 2 tag (source: ) - The ai.google.dev ShieldGemma page, last updated 15 January 2026, says it is deprecated and points to gemma.ai (source: ) - The Gemma Terms of Use let Google restrict usage remotely or otherwise where it believes the terms are breached, and incorporate the Prohibited Use Policy of 21 February 2024 (source: ) - #13 of 18 in Best guardrails and safety filters for AI agents: https://www.anchorterminal.com/best/guardrails/index.md - All 155 guardrails comparisons: https://www.anchorterminal.com/compare/guardrails/index.md ## Compare - [Amazon Bedrock Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/amazon-bedrock-guardrails-vs-shieldgemma.md): BB 77.4 vs C 54 - [Azure AI Content Safety (Prompt Shields) vs ShieldGemma](https://www.anchorterminal.com/compare/azure-ai-content-safety-vs-shieldgemma.md): B 67 vs C 54 - [Cisco AI Defense Inspection API vs ShieldGemma](https://www.anchorterminal.com/compare/cisco-ai-defense-inspection-vs-shieldgemma.md): B 63.1 vs C 54 - [Google Cloud Model Armor vs ShieldGemma](https://www.anchorterminal.com/compare/google-model-armor-vs-shieldgemma.md): BB 73.2 vs C 54 - [Granite Guardian vs ShieldGemma](https://www.anchorterminal.com/compare/granite-guardian-vs-shieldgemma.md): C 59.4 vs C 54 - [Guardrails AI vs ShieldGemma](https://www.anchorterminal.com/compare/guardrails-ai-vs-shieldgemma.md): D 47.8 vs C 54 - [Lakera Guard (Check Point AI Guardrails) vs ShieldGemma](https://www.anchorterminal.com/compare/lakera-guard-vs-shieldgemma.md): B 65.8 vs C 54 - [Llama Guard 4 vs ShieldGemma](https://www.anchorterminal.com/compare/llama-guard-vs-shieldgemma.md): D 49.5 vs C 54 - [Mistral Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/mistral-moderation-vs-shieldgemma.md): C 60.6 vs C 54 - [NVIDIA NeMo Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/nemo-guardrails-vs-shieldgemma.md): B 69.5 vs C 54 - [OpenAI Guardrails vs ShieldGemma](https://www.anchorterminal.com/compare/openai-guardrails-vs-shieldgemma.md): B 68 vs C 54 - [OpenAI Moderation API vs ShieldGemma](https://www.anchorterminal.com/compare/openai-moderation-vs-shieldgemma.md): BB 72.1 vs C 54 - [Prisma AIRS AI Runtime Security API vs ShieldGemma](https://www.anchorterminal.com/compare/prisma-airs-vs-shieldgemma.md): C 61.6 vs C 54 - [AgentGate vs ShieldGemma](https://www.anchorterminal.com/compare/agentgate-vs-shieldgemma.md): D 47.6 vs C 54 - [LlamaFirewall vs ShieldGemma](https://www.anchorterminal.com/compare/llamafirewall-vs-shieldgemma.md): D 50.1 vs C 54 - [Presidio vs ShieldGemma](https://www.anchorterminal.com/compare/microsoft-presidio-vs-shieldgemma.md): B 64.8 vs C 54 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on gemma.ai or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "shieldgemma", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html ShieldGemma on Anchor Terminal ``` Markdown badge, for a README: ```markdown [![ShieldGemma on Anchor Terminal](https://www.anchorterminal.com/badges/shieldgemma.svg)](https://www.anchorterminal.com/tools/shieldgemma) ``` Plain link: ```html ShieldGemma on Anchor Terminal ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say ShieldGemma is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/shieldgemma-dark.png - Light: https://www.anchorterminal.com/assets/share/shieldgemma-light.png --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp