Compare Safety Models by Threat, Modality, and Policy Control

Safety model engineering / Guide 2 of 5. A source-linked decision guide with synthetic technical examples. No model benchmarks were run for this series.

Choose a supported task before comparing model size

A useful safety-model comparison starts with the thing being classified. Explicit instruction attacks, harmful generated text, unsafe images, unsupported claims, and policy-specific conduct require different inputs and labels. A model that excels at one of those tasks can be irrelevant to another. Parameter count becomes meaningful only after task coverage, languages, modality, licensing, and deployment constraints are understood.

This is a selective engineering snapshot checked on 29 October 2026 against official documentation and model cards. It is not a market leaderboard. No checkpoints were run for this series. Model-card evaluations describe the vendor's setup; their scores do not become comparable simply because each table contains an F1 column. Different policies, thresholds, datasets, and unsupported cases can reverse an apparent ranking.

The matrix below identifies candidates and exclusions. Treat each row as the start of a shortlist, then pin the exact checkpoint revision and prompt template for evaluation. A family name is too broad for a release manifest. Hosted aliases also change, so record the service model identifier and re-test behavior when an upgrade occurs.

A capability matrix reveals where the families differ

Capabilities describe documented scope, not independently measured quality.
Family	Scope and size	Decision interface	Important boundary
Meta Llama Guard 4	12B; text and mixed text/images	Safe/unsafe plus violation categories	Image use has stricter scope than multilingual text
Meta Prompt Guard 2	22M / 86M; text attack detection	Binary benign/malicious	512-token window; not general harm moderation
Google ShieldGemma	2B / 9B / 27B; English text	Policy-formatted Yes/No classification	Four text harm categories
Google ShieldGemma 2	4B; image moderation	Yes/No token scoring	Three image harm categories
NVIDIA Nemotron 3.5 Content Safety	4B; text and optional single image	Standard taxonomy or custom-policy labels	Policy mode and modality must be tested separately
IBM Granite Guardian 4.1	8B; English text	Criterion-specific score tags	Yes/no meaning depends on criterion
OpenAI omni-moderation-latest	Hosted text/image; size undisclosed	Flags, scores, input-type coverage	Some categories support text only; no audio
OpenAI gpt-oss-safeguard	20b / 120b named variants; text	Developer policy plus reasoning/classification	Separate from hosted moderation
Qwen3Guard Gen / Stream	0.6B / 4B / 8B; text	Completed-input or incremental classification	Taxonomy and streaming exposure differ

Fixed taxonomies make integration predictable but require mapping to the application's policy. Custom-policy models accept richer criteria but make policy wording part of the inference input and versioning contract. Neither approach removes ambiguity. A supported category can still have poor recall on the application's language or data distribution. The links in the following sections identify the relevant official cards.

Meta and Google address distinct classification boundaries

Llama Guard 4 12B provides safe/unsafe judgments and violation categories for text and mixed text with images. It uses the Llama 4 Community License. Meta's usage guidance says image prompts should include English text, excludes image-only classification as the intended use, and does not extend its image evaluation to generated images. Multilingual text support must not be advertised as unrestricted multilingual multimodal coverage. Meta: Llama Guard 4 12B model card; Meta: Llama Guard 4 usage and scope.

Prompt Guard 2 is a different product. The 22M and 86M checkpoints classify benign versus malicious instruction-override attempts within a 512-token window. Version 2 is binary; copying the original Prompt Guard three-label parser is an integration error. Chunk long inputs deliberately, test attacks that span boundaries, and retain source information. LlamaFirewall's scanner documentation emphasizes explicit or universal jailbreak patterns, which is narrower than a guarantee against all context-dependent indirect attacks. Meta: Prompt Guard 2 86M model card; Meta LlamaFirewall: Prompt Guard 2 scanner scope.

ShieldGemma's text family covers four English harm categories with policy-formatted prompts. ShieldGemma 2 is an image-focused 4B model with three image categories, including natural and synthetic images. It is not a blanket replacement for the earlier text series. Both use Gemma terms; the checkpoint and applicable terms matter more than the generic description open weights. Google: ShieldGemma text model card; Google: ShieldGemma 2 image model card.

NVIDIA and IBM expose richer criteria with different contracts

The current Nemotron 3.5 Content Safety card describes a 4B model with text, an optional single image, standard Aegis V2 classification, and custom-policy mode. Its documented languages include Hindi among twelve named languages. The card identifies a June 2, 2026 release. Standard and custom modes expose different output behavior, so an adapter should validate which mode produced a result rather than infer meaning from an arbitrary final word. NVIDIA: Nemotron 3.5 Content Safety model card.

The same current card lists OpenMDW-1.1 together with Gemma terms and prohibited-use conditions. Older NVIDIA content-safety checkpoints have different names, dates, and licensing descriptions. Do not transfer the older text-only reasoning model's deployment claims to the newer multimodal checkpoint. A large documented context window also does not establish useful recall across every position in a long input.

Granite Guardian 4.1 8B is an English text model under Apache 2.0 with predefined criteria and Bring Your Own Criteria. Grounding, jailbreaking, harmfulness, and function-call hallucination checks require different evidence. The prescribed scoring template is part of the contract, and criterion polarity needs explicit mapping. A groundedness yes can be favorable while a harmfulness yes is unfavorable. The model card warns that adversarial attacks and unexpected outputs remain possible. IBM: Granite Guardian 4.1 8B model card.

OpenAI and Qwen illustrate two different deployment choices

OpenAI's hosted omni moderation accepts text and images and returns overall flags, category flags, scores, and category input-type coverage. Some categories do not support images, and image-only inputs receive zero for unsupported categories. That zero means absent coverage, not evidence that the category was cleared. The guide does not disclose a parameter count or self-hostable weights for the service. It also warns that score-based policies can need recalibration as models change. OpenAI: moderation guide.

OpenAI's separate gpt-oss-safeguard models are open-weight text policy reasoners with developer-supplied policy and Harmony formatting. The named 20b and 120b variants have 21B and 117B total parameters, with different active parameter counts. Apache 2.0 availability does not make their memory or latency equal to a compact encoder. Reasoning effort, context, batching, and deployment implementation still affect the serving budget. OpenAI: gpt-oss-safeguard repository.

Qwen3Guard offers Gen and Stream variants at 0.6B, 4B, and 8B. Gen classifies completed prompts or responses; Stream attaches classification to incremental generation. The repository reports 119 languages and dialects, which is a coverage statement rather than proof of equal quality across them. Its safe, controversial, and unsafe labels and categories need explicit policy mapping. The Gen 4B card lists Apache 2.0, but record terms per chosen checkpoint rather than assuming every related artifact is interchangeable. Qwen: Qwen3Guard repository; Qwen: Qwen3Guard Gen 4B model card.

Turn the matrix into a defensible shortlist

For a synthetic text-only fixture assistant, first decide whether the target is harmful output, hostile retrieved instructions, unsupported summaries, or all three. Shortlist a content classifier, an attack detector, and a grounding candidate independently. Reject candidates lacking a required language or modality before running an accuracy comparison. Then compare the remaining candidates and a general LLM baseline on the same held-out policy labels.

Account for deployment constraints explicitly. Local weights permit a different data path from a hosted API but require model operations, capacity planning, and updates. A hosted service can reduce serving work while introducing network latency and a service dependency. Neither choice guarantees lower total cost. Licensing, retention settings, release stability, and team expertise belong in the decision alongside classifier quality.

Finally, write down what the selected guard will not decide. No row in the matrix grants tool permissions or proves an operation safe. A model shortlist becomes a system design only when the application defines enforcement, timeout behavior, unsupported cases, and a rollback plan. Select a candidate for its documented contract and measured fit, not because its vendor also supplies the generator.

The safety model engineering series

Existing detailed guides

Sources and evidence limits

Official sources checked on 29 October 2026. Capability descriptions reflect these documents, not independent model measurements. Check the pinned revision and current terms before deployment.

Views are my own and do not represent any employer, past or present.