Field note
Mistral released Shieldstral, a 3B open-weights classifier for text and image safety. Its useful design choice is that the policy is not fixed inside a permanent harm taxonomy. The caller supplies an evaluation context and a yes-or-no policy question at inference time, then the model returns a calibrated score from the yes and no logits.
That gives one checkpoint a consistent interface for prompt classification, response moderation, refusal detection, toxicity checks, images, and mixed text-image content. Mistral says it runs on a single 16 GB GPU and matches or exceeds guard models up to seven times larger; those performance comparisons remain vendor-reported until independently reproduced.
The architectural fit is a policy sidecar near an AI gateway. Product-specific rules can be versioned as text, evaluated before or after a model call, and thresholded differently by context. Shieldstral is not an authorization layer: it can score content, but it cannot enforce network access, credential scope, or irreversible tool actions. The AISI incident makes that distinction concrete.
The weights are available under Apache 2.0. Teams can test it against their own policy corpus and false-positive costs before putting it in a blocking path.