ShieldGemma 9B
The 9B member of Google's ShieldGemma series of safety content-moderation models, built on Gemma 2 and available in English with open weights alongside 2B and 27B sizes. It is a text-to-text, decoder-only classifier: the caller supplies a preamble establishing the model as a policy expert, the text to be classified wrapped in turn tokens, a written description of the safety guideline, and an epilogue, and the model answers with a string starting 'Yes' or 'No' for whether that policy was violated. Google publishes guideline wording for four harm types - dangerous content, harassment, hate speech and sexually explicit information - in both prompt-only and prompt-response phrasings. Although generative, it is designed to be run in scoring mode over the Yes/No token probability.
Strengths
- Policy text is supplied at inference time, so the same weights enforce a rewritten or narrowed safety policy without retraining
- Covers both input filtering (prompt-only) and output filtering (prompt-response), with distinct guideline wording published for each
- Designed to be run in scoring mode over the probability of the Yes/No token, giving a continuous score the caller can threshold rather than a hard label
- Google publishes an evaluation table with absolute numbers on four datasets and comparison rows for OpenAI Mod API, LlamaGuard 1 and 2, WildGuard and GPT-4
- Part of a size-matched series (2B, 9B, 27B) so the same prompt format ports across deployment budgets
- Open weights distributed through Hugging Face and Kaggle, and shipped as part of Google's Responsible Generative AI Toolkit
Caveats
- English only, per the card's own description - it is not a multilingual moderation layer
- The 9B is not uniformly the better mid-size choice: on ToxicChat it scores 0.694 optimal F1, below both the 27B (0.729) and the smaller 2B (0.704)
- Only four harm categories (sexually explicit, dangerous content, hate, harassment), far narrower than the 13- or 14-class taxonomies used by WildGuard and Llama Guard - PII, misinformation and self-harm have no published guideline
- Google warns it is 'highly sensitive to the specific user-provided description of safety principles, and might perform unpredictably under conditions that require a good understanding of language ambiguity and nuance'
- The Gemma Terms of Use are not an OSI-approved open-source licence, and use is additionally bound by Google's prohibited use policies
- Google itself notes 'there are limited benchmarks that can be used to evaluate content moderation so the training and evaluation data might not be representative of real-world scenarios'
- The card states no release date, context window or output limit, and it is built on the superseded Gemma 2 generation
- Vendor
- License
- Gemma Terms of Use
- Modalities
- text
| Benchmark | Score | Max |
|---|---|---|
| SG Prompt (Optimal F1) | 0.8 | 1.0 |
| OpenAI Mod (Optimal F1) | 0.8 | 1.0 |
| ToxicChat (Optimal F1) | 0.7 | 1.0 |
| SG Response (Optimal F1) | 0.8 | 1.0 |
Capabilities
Resources
Pricing
Open weights, self-hosted at no licence fee, but distributed under the Gemma Terms of Use rather than an OSI-approved licence and subject to Google's prohibited use policies. Available on Hugging Face and Kaggle.