# ShieldGemma (slim)

> ShieldGemma is Google's family of open-weight safety classifiers built on Gemma. ShieldGemma 1 (2B, 9B, 27B) scores English text against hate, harassment, dangerous and sexual content policies, and ShieldGemma 2 (4B) scores images. The owner runs them.

- Full: https://www.anchorterminal.com/tools/shieldgemma.md (~8,150 tokens) · this version ~1,780 tokens · JSON https://www.anchorterminal.com/tools/shieldgemma.json · canonical https://www.anchorterminal.com/tools/shieldgemma
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07 · pricing https://www.anchorterminal.com/tools/shieldgemma#pricing · reviews https://www.anchorterminal.com/tools/shieldgemma#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**C · 54/100 · rank #921 of 1486 · #13 in Guardrails & safety filters · not agent-ready · confidence medium**


Assessment: Google's open safety classifiers return a Yes probability per policy from one forward pass, in text sizes from 2B to 27B and a 4B image model, and Google accounts answer questions on the Hub. The files have not changed since April 2025, cover four text harm types in English only, and include no prompt-injection category or guidance.

## Facts

- Kind: Model API · vendor: Google DeepMind · category: Guardrails & safety filters · legal entity: Google LLC (RDAP registrant of gemma.ai; the Gemma Terms of Use are Google's and the cards name Google as author) · provenance 58/100
- Packages: huggingface `google/shieldgemma-2b`, huggingface `google/shieldgemma-9b`, huggingface `google/shieldgemma-27b`, huggingface `google/shieldgemma-2-4b-it`, ollama `shieldgemma`
- Auth: None · pricing: Free · x402: no · licence: Gemma Terms of Use (last modified 1 April 2026) with the Gemma Prohibited Use Policy. Not an OSI licence
- Benchmark probes: not run yet, so Performance is pending
- Surface listed: The four ShieldGemma checkpoints Google publishes, run by the owner through Transformers, Keras or Ollama. Read from gemma.ai, ai.google.dev, the Hugging Face pages and API, and Ollama's library on 6 November 2026. No weights were downloaded and no terms were accepted
- Same vendor, other listings: Google Cloud Model Armor (google-model-armor) is Google's hosted screening API and a separate listing. The Gemma 4 and EmbeddingGemma listings are other Gemma models
- Models: google/shieldgemma-2b (2,614,341,888 parameters), shieldgemma-9b (9,241,705,984), shieldgemma-27b (27,227,128,320), all BF16 safetensors on Gemma 2, and google/shieldgemma-2-4b-it (4,300,079,472) on Gemma 3
- Harm types: ShieldGemma 1, sexually explicit information, dangerous content, hate speech and harassment. ShieldGemma 2, sexually explicit, dangerous and violence or gore content in images
- Input: A preamble, the text or image to classify, one policy description and an epilogue, in a fixed pattern from the card. The Transformers chat template takes the policy as a `guideline` argument or a system message
- Output: The probability that the next token is `Yes` (violates the policy) or `No`, read from the logits. A caller that only gets text, such as an Ollama chat call, reads the first word
- Licence: Gemma Terms of Use, last modified 1 April 2026, with dated earlier versions in an archive. Commercial use allowed, distribution must carry the use restrictions, and the Prohibited Use Policy applies
- Access: Gated on Hugging Face (log in and accept the licence, approved immediately) and on Kaggle. Ollama's library copies of ShieldGemma 1 need no account
- Runtimes: Transformers (Gemma 2 classes for ShieldGemma 1, a `ShieldGemma2` model page in the Transformers docs), Keras through Google's Colab notebook, and Ollama for ShieldGemma 1. vLLM and llama.cpp support was not checked first-hand
- Google's figures: Optimal F1 and AU-PRC on Google's SG prompt and response sets, the OpenAI Moderation set and ToxicChat, for example 0.828/0.894 on SG Prompt for the 9B. These are the publisher's own results
- Support: Community tabs on each Hugging Face repository, where Google accounts answered every thread we sampled, and Kaggle discussions

- Scores: Reliability 46, Performance pending, Schema & documentation 56, Agent ergonomics 72, Security & auth 53, Payments & pricing 52, Task success pending, Maintenance & community 40, Transparency & trust 54 · total over the 7 assessed categories
- Why: Reliability, Scored on the local-software lines, since the owner runs the model, the reading used for Llama Guard and Granite Guardian. · Schema & documentation, Read for a model the owner serves. · Agent ergonomics, Read as a classifier an agent calls. · Security & auth, Read as a model the owner runs, on the model lines used for Granite Guardian, with retention and training in place of the read-only line. · Payments & pricing, Self-hosted rule. · Maintenance & community, Read as a model, on the lines used for Granite Guardian (recency 30, deprecation 12, churn 8, responsiveness 25, packages 15, health 10). · Transparency & trust, The weights are under the Gemma Terms of Use, not an OSI licence.
- Sources: 15, open questions: 7, both in the full twin
- Capabilities: guard.moderation, guard.policy, guard.self-host
- JSON: https://www.anchorterminal.com/api/v1/tools/shieldgemma.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/shieldgemma.svg` or a link to https://www.anchorterminal.com/tools/shieldgemma from a page on gemma.ai or one of its subdomains, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: https://gemma.ai/models/shieldgemma.md; https://www.kaggle.com/models/google/shieldgemma; more in the full twin

## Before you call it

1. Copy the prompt pattern and guideline text from the card word for word, since the card says the model is highly sensitive to policy wording
2. Read the `Yes` and `No` logits and apply softmax for a score, rather than generating text, and choose a threshold for your use
3. Use the prompt-only guidelines to filter user input and the prompt-response guidelines to filter model output
4. Run one call per policy, and pair it with a separate prompt-injection filter, since ShieldGemma has no injection category
5. Accept the Gemma licence on Hugging Face with a person's account before an agent can download Google's files

## Connect

```bash
pip install -U transformers[accelerate]
```

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| NVIDIA NeMo Guardrails | B | 69.5 | guard.moderation, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/nemo-guardrails.min.md |
| OpenAI Guardrails | B | 68 | guard.moderation, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/openai-guardrails.min.md |
| Lakera Guard (Check Point AI Guardrails) | B | 65.8 | guard.moderation, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/lakera-guard.min.md |
| Granite Guardian | C | 59.4 | guard.moderation, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/granite-guardian.min.md |
| Llama Guard 4 | D | 49.5 | guard.moderation, guard.policy, guard.self-host | https://www.anchorterminal.com/tools/llama-guard.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)