Granite Guardian 4.1 8B

Open Weights

IBM

IBM Research's safety and hallucination judge, fine-tuned from granite-4.1-8b and released in April 2026. It scores whether a prompt or response meets a criterion, emitting yes or no inside <score> tags. Pre-baked criteria cover harm, social bias, jailbreaking, violence, profanity and unethical behaviour, plus RAG context relevance, groundedness and answer relevance and function-calling hallucination. Version 4.1 adds Bring Your Own Criteria, letting callers supply arbitrary natural-language rules, and a hybrid thinking mode that trades reasoning traces for latency.

Strengths

Bring Your Own Criteria: judges arbitrary natural-language rules such as formatting, length or domain constraints, not only a fixed taxonomy
Hybrid thinking, with reasoning traces in <think> tags for interpretability or a no-think mode for low-latency yes/no verdicts
Pre-baked criteria span harm, social bias, jailbreaking, violence, profanity and unethical behaviour
RAG-specific detectors for context relevance, groundedness and answer relevance
Function-calling hallucination detection for agentic workflows, at 0.79 balanced accuracy on FC Reward Bench (no-think), up from 0.74 in version 3.3
Doubles as a best-of-N reward model, scoring 70.29 overall on the JETTS verifiable tasks, above every tested reward model up to 70B parameters
Apache 2.0 licensed with published training-data provenance, including fairly paid human annotation via DataForce

Caveats

It does not beat its own predecessor on out-of-distribution safety: aggregate F1 is 0.79 (no-think) versus 0.81 for granite-guardian-3.3-8b non-think
The xstest RR row is very weak at 0.44 (no-think) and 0.45 (think), the lowest cell in IBM's own safety table
IBM states the model 'is only trained and tested on English data'
Use is restricted to the prescribed yes/no scoring mode; IBM warns that 'any deviation from this intended use may lead to unexpected, potentially unsafe, or harmful outputs' and that the model 'may also be prone to such behavior via adversarial attacks'
Reasoning traces 'may contain unsafe content and may not be faithful', and custom BYOC criteria 'require testing'
The card gives only 'April, 2026' with no day, so no exact release date is recorded, and no context window or output limit is stated

Vendor: IBM
License: Apache-2.0
Modalities: text

Benchmark	Score	Max
OOD safety benchmarks (aggregate F1)	0.8	1.0
LM-AggreFact RAG hallucination (average balanced accuracy)	0.8	1.0
FC Reward Bench (balanced accuracy)	0.8	1.0
IFEval Multi-Constraint (balanced accuracy)	0.8	1.0
JETTS best-of-N selection (overall)	70.3	100.0

Capabilities

Vision

Audio

Video

Tool Use

Resources

API Documentation Hugging Face

Pricing

Open weights under Apache 2.0, so there is no licence cost. Self-hosted via transformers or vLLM; IBM positions the 8B size for 'moderate cost, latency, and throughput' work such as model assessment, observability and spot-checking, and points to the 38M HAP model where cost or latency budgets are tighter.