Ranking
A ranking of open-source guardrail models.
updated Aug 5, 2026
Ranking Filters
Models Table
| # | Model | ||||||
|---|---|---|---|---|---|---|---|
| 1 | YuFeng-XGuard-Reason-8B Qwen (Alibaba-AAIG XGuard) · 8B · Alibaba-AAIG | 0.764 | 0.157 | 21.8% | 12.2% | 102.6 | 8B |
| 2 | Sing-Guard-2b Sing-Guard · 2B · inclusionAI | 0.755 | 0.395 | 19.2% | 17.2% | 80.8 | 2B |
| 3 | HiveTraceGuard-Pro HiveTrace · 0.6B · hivetrace | 0.743 | 0.326 | 26.8% | 15.6% | 28.8 | 0.6B |
| 4 | Shieldstral-1.0-3B Shieldstral · 3B · mistralai | 0.742 | 0.192 | 24.4% | 12.6% | 32.2 | 3B |
| 5 | OpenGuardrails-Text-2510 OpenGuardrails · 15B · openguardrails | 0.738 | 0.401 | 14.0% | 19.9% | 127.1 | 15B |
| 6 | Qwen3Guard-Gen-8B Qwen3 · 8B · Qwen | 0.726 | 0.108 | 24.7% | 10.6% | 216.1 | 8B |
| 7 | Qwen3Guard-Gen-4B Qwen3Guard · 4B · Qwen | 0.724 | 0.134 | 25.9% | 11.2% | 136.6 | 4B |
| 8 | YuFeng-XGuard-Reason-0.6B Qwen (Alibaba-AAIG XGuard) · 0.6B · Alibaba-AAIG | 0.720 | 0.135 | 21.8% | 16.8% | 24.7 | 0.6B |
| 9 | Llama-3.1-Nemotron-Safety-Guard-8B-v3 Llama-3.1 (NVIDIA Nemotron) · 8B · nvidia | 0.712 | 0.199 | 23.2% | 16.6% | 398.3 | 8B |
| 10 | Qwen3Guard-Gen-0.6B Qwen3 · 0.6B · Qwen | 0.712 | 0.131 | 26.8% | 15.2% | 51.1 | 0.6B |
| 11 | PolyGuard-Qwen-Smol Qwen (ToxicityPrompts PolyGuard) · 0.5B · ToxicityPrompts | 0.695 | 0.244 | 26.0% | 22.2% | 89.4 | 0.5B |
| 12 | Nemotron-3.5-Content-Safety Nemotron · 4B · nvidia | 0.687 | 0.107 | 27.3% | 13.0% | 112.7 | 4B |
| 13 | opir-multitask-multilang-v1.0 Opir (GLiNER) · 0.3B · knowledgator | 0.669 | 0.133 | 37.2% | 15.7% | 17.3 | 0.3B |
| 14 | opir-multitask-large-v1.0 Opir (GLiNER) · 0.4B · knowledgator | 0.665 | 0.267 | 25.9% | 22.2% | 54.1 | 0.4B |
| 15 | Llama-Guard-3-8B Llama-3.1 (Meta Llama Guard) · 8B · meta-llama | 0.663 | 0.346 | 9.5% | 34.7% | 107.0 | 8B |
| 16 | gliguard-LLMGuardrails-300M GLiGuard · 0.3B · fastino | 0.638 | 0.152 | 39.3% | 19.7% | 20.9 | 0.3B |
| 17 | Sing-Guard-4b SingGuard · 4B · inclusionAI | 0.636 | 0.262 | 14.7% | 31.0% | 109.3 | 4B |
| 18 | Llama-Guard-4-12B Llama 4 (Meta Llama Guard) · 12B · meta-llama | 0.630 | 0.353 | 11.7% | 38.6% | 147.3 | 12B |
| 19 | Llama-Guard-3-1B Llama-3.2 (Meta Llama Guard) · 1B · meta-llama | 0.629 | 0.368 | 19.1% | 36.3% | 29.2 | 1B |
| 20 | wildguard Mistral (AllenAI WildGuard) · 7B · allenai partial | 0.622 | 0.163 | 22.7% | 25.9% | 212.8 | 7B |
| 21 | HiveTraceLite HiveTrace · 0.3B · hivetrace | 0.618 | 0.172 | 32.6% | 25.2% | 13.6 | 0.3B |
| 22 | gliner-guard-omni GLiNER Guard · 0.3B · hivetrace | 0.590 | 0.048 | 38.4% | 14.3% | 20.3 | 0.3B |
| 23 | shieldgemma-2b Gemma (ShieldGemma) · 2B · google | 0.525 | 0.262 | 15.3% | 46.2% | 249.2 | 2B |
| 24 | shieldgemma-9b Gemma (ShieldGemma) · 9B · google | 0.491 | 0.142 | 14.7% | 48.6% | 463.9 | 9B |
| 25 | OpenGuardrails-Text-4B-0124 OpenGuardrails · 4B · openguardrails | 0.404 | 0.207 | 21.2% | 54.5% | 334.5 | 4B |
| 26 | promptguard PromptGuard · 0.1B · codeintegrity-ai | 0.346 | 0.026 | 48.0% | 39.2% | 12.2 | 0.1B |
| 27 | gliner-guard-uniencoder GLiNER Guard · 0.1B · hivetrace | 0.263 | 0.000 | 36.2% | 19.7% | 157.4 | 0.1B |
| 28 | Nandi-Mini-600M-GuardRails Nandi-Mini · 0.6B · FrontiersMind | 0.081 | 0.000 | 18.6% | 51.9% | 506.0 | 0.6B |
| 29 | deberta-v3-base-injection DeBERTa · 0.2B · deepset | 0.007 | 0.000 | 77.6% | 25.5% | 12.9 | 0.2B |
| 30 | Nandi-Mini-150M-GuardRails Nandi-Mini · 0.15B · FrontiersMind | 0.002 | 0.000 | 22.2% | 53.1% | 323.5 | 0.15B |
| 31 | Llama-Prompt-Guard-2-86M DeBERTa (Meta Prompt Guard) · 0.086B · meta-llama | 0.001 | 0.000 | 7.0% | 89.2% | 22.9 | 0.086B |
| 32 | deberta-v3-base-prompt-injection-v2 DeBERTa · 0.2B · protectai | 0.000 | 0.000 | 9.6% | 87.4% | 13.1 | 0.2B |
| 33 | Text-Moderation DeBERTa · 0.1B · KoalaAI | 0.000 | 0.000 | 1.7% | 87.7% | 14.1 | 0.1B |
| 34 | deberta-v3-base-prompt-injection-detection DeBERTa · 0.2B · Octavio-Santana | 0.000 | 0.000 | 100.0% | 0.0% | 9.3 | 0.2B |
| 35 | Llama-Prompt-Guard-2-22M DeBERTa (Meta Prompt Guard) · 0.022B · meta-llama | 0.000 | 0.000 | 0.4% | 98.9% | 9.4 | 0.022B |