> For the complete documentation index, see [llms.txt](https://docs.mozilla.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mozilla.ai/any-guardrail/api-reference/index/content-safety/shield-gemma.md).

# ShieldGemma

Policy-conditioned safety classifier that judges a prompt against a user-supplied policy via Yes/No token logits.

ShieldGemma is Google's Gemma-2-based content-safety classifier. Rather than a fixed taxonomy, it is conditioned at construction on a free-text `policy` (a safety principle). Each call inserts the user prompt and the policy into ShieldGemma's judgment template — which asks whether the prompt violates the principle and requires the answer to start with `Yes` or `No` — runs the causal LM, and reads the logits of the `Yes` / `No` vocabulary tokens at the final position, softmaxing them into a violation probability.

Verdict mapping onto `GuardrailOutput`:

* `score` is the probability mass on `Yes` (the policy is violated) — the canonical risk axis, higher = riskier.
* `valid` is `score < threshold` (default `0.5`): the prompt passes when the violation probability stays below the threshold.
* No `categories`, `spans`, or `explanation` are produced.

Expected input: a single `input_text` prompt string, judged against the constructor's `policy`. This is prompt-only moderation; there is no response or RAG-context channel. Only the text classifier is wrapped — the ShieldGemma image classifier is not supported.

The models are gated on HuggingFace under the Gemma Terms of Use.

For more information, see:

* [ShieldGemma collection (Google)](https://huggingface.co/collections/google/shieldgemma-67d130ef8da6af884072a789)
* [google/shieldgemma-2b](https://huggingface.co/google/shieldgemma-2b)
* [google/shieldgemma-9b](https://huggingface.co/google/shieldgemma-9b)
* [google/shieldgemma-27b](https://huggingface.co/google/shieldgemma-27b)

## Supported Models

* `google/shieldgemma-2b`
* `google/shieldgemma-9b`
* `google/shieldgemma-27b`

## Constructor

| Parameter        | Type                                                 | Required | Default | Description                                                                                                                                                                                                                                                                                            |
| ---------------- | ---------------------------------------------------- | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `policy`         | `str`                                                | Yes      | —       | The free-text safety principle the prompt is judged against, inserted into ShieldGemma's judgment template as `{safety_policy}`. Bring-your-own policy — e.g. `"No Hate Speech: The prompt shall not contain or seek generation of content that targets identity or protected attributes ..."`.        |
| `threshold`      | `float`                                              | No       | `0.5`   | Decision threshold on the `Yes` (violation) probability. `valid` is `score < threshold`; raise it to flag only higher-confidence violations, lower it to be stricter. Defaults to `0.5`.                                                                                                               |
| `model_id`       | \`str                                                | None\`   | No      | `None`                                                                                                                                                                                                                                                                                                 |
| `provider`       | `Optional[Provider[dict[str, Any], dict[str, Any]]]` | No       | `None`  | Optional pre-configured provider. When `None`, a `HuggingFaceProvider` is built targeting a causal LM (`AutoModelForCausalLM` + `AutoTokenizer`). A supplied `HuggingFaceProvider` is corrected to those classes at load time so the Yes/No logit head is available; any other provider is used as-is. |
| `prompt`         | \`PromptTemplate                                     | None\`   | No      | `None`                                                                                                                                                                                                                                                                                                 |
| `prompt_version` | \`str                                                | None\`   | No      | `None`                                                                                                                                                                                                                                                                                                 |

Initialize the ShieldGemma guardrail.

## validate

Default validation pipeline: preprocess -> inference -> postprocess.

**Parameters**

| Parameter    | Type  | Required     | Default | Description |
| ------------ | ----- | ------------ | ------- | ----------- |
| `input_text` | \`str | list\[str]\` | Yes     | —           |

**Returns:** `GuardrailOutput | list[GuardrailOutput]`

## Benchmarks

### Content Safety

| Dataset (rev)                    | Metric | Threshold    | Value    | Harness                 | Source                           | Contam. |
| -------------------------------- | ------ | ------------ | -------- | ----------------------- | -------------------------------- | ------- |
| openai\_moderation (unspecified) | f1     | native-valid | 0.769231 | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |
| xstest (unspecified)             | fpr    | native-valid | 0.108    | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |
| wildguardmix (unspecified)       | f1     | native-valid | 0.801619 | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |
| aegis (unspecified)              | f1     | native-valid | 0.724409 | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |
| jbb (unspecified)                | f1     | native-valid | 0.666667 | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |
| orbench (unspecified)            | fpr    | native-valid | 0.136842 | guardrail-bench+ag0.7.4 | measured:guardrail-bench+ag0.7.4 |         |

## License

* **Vendor:** Google
* **Default license:** `gemma` (of the default model/service)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mozilla.ai/any-guardrail/api-reference/index/content-safety/shield-gemma.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.