Llama Guard
Meta's open classifier for filtering unsafe LLM prompts/replies
Overview
Llama Guard is Meta's open-weight moderation model, screening prompts and responses against a configurable harm taxonomy. The current Llama Guard 4 (12B) is natively multimodal, judging text and images together.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 11 Jul 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
Use cases
What you can produce with Llama Guard
- Configurable harm-category taxonomy for prompt and response classification
- Llama Guard 4 (12B) handles text and image inputs natively
- Runs locally via Transformers or vLLM, or through Meta's hosted Moderations API
- Available on Hugging Face and the Azure AI model catalog
- Part of the broader Purple Llama safety toolkit (with Prompt Guard, Code Shield)
- Permissive license for research and commercial use
ASEAN Perspective
Llama Guard in Southeast Asia
ASEAN-region availability and pricing notes coming soon. Drop the editorial team a note via /contact/ if you can supply local context (Singapore/Malaysia/Indonesia/Thailand/Vietnam).
Llama Guard has gone through four generations since its 2023 debut: a Llama 2-based 7B classifier, then a Llama 3 refresh, then a Llama 3.1/3.2-based Guard 3 suite (8B, 1B and an 11B vision model tuned to the MLCommons hazard taxonomy), and now Guard 4 — a 12B model pruned from the Llama 4 Scout mixture-of-experts network so one model handles text and image moderation together. It's a legitimate, widely-adopted open guardrail: self-hostable, tunable to your own harm categories, and free of the black-box problem you get with closed moderation APIs. It is not a solved problem, though. A February 2026 MindStudio test found it caught 66.2% of adversarial attack prompts — meaning roughly one in three got through — and a separate research paper found it underperforming general-purpose LLMs repurposed as safety judges. Use it as one layer of a defense-in-depth stack, not the whole stack.
What people say
The version history tells you where Meta's priorities shifted: Llama Guard 1 was a straightforward 7B input/output classifier bolted onto Llama 2; Guard 2 moved to a Llama 3 base; Guard 3 split into a family (8B, a 1B model small enough for edge deployment, and an 11B vision variant) aligned to the MLCommons standard hazards taxonomy so results could be compared across vendors. Guard 4, released in 2025, consolidated that into a single 12B model — natively multimodal by pruning Llama 4 Scout's MoE architecture down to a dense, shared-expert network, rather than running separate text and image classifiers side by side.
On the question that actually matters — does it catch bad content — the record is mixed. A February 2026 evaluation by MindStudio reported Llama Guard blocking 66.2% of attack prompts thrown at it, which reads less like a guardrail and more like a speed bump against a determined adversary. A separate academic paper ("The Bitter Lesson of Misuse Detection") went further, finding that Llama Guard 4 12B underperformed general-purpose LLMs simply repurposed as safety judges — an uncomfortable result for a model whose entire job is safety classification. Neither finding means it's useless; both point at the same conclusion, that a dedicated small classifier trained on a fixed taxonomy struggles to keep up with adversarial prompting techniques that evolve faster than the model gets retrained.
On the deployment side, there's little to complain about. Weights ship on Hugging Face under the meta-llama org and in the PurpleLlama GitHub repo, it runs fine through standard inference stacks (Transformers, vLLM), and it's also available through Meta's hosted Moderations API and the Azure AI model catalog if you'd rather not self-host. License terms are permissive enough for both research and commercial use. Teams building on open LLMs generally reach for it as a first line of defense precisely because it's free, self-hostable and configurable — not because it's the last word in content safety. Meta itself ships it as part of the broader Purple Llama toolkit alongside Prompt Guard (injection detection) and Code Shield, which is the honest framing: one component, not the whole system.
Summary of public user & expert reviews, compiled by RECATOOLS.
About this listing
This entry was compiled from publicly available data including Llama Guard's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Llama Guard unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Llama Guard directly →
Spotted something out of date? Suggest an update →
Alternatives to Llama Guard
More in LLMs & Chat
