When an organization deploys a private AI system — whether a customer service chatbot, an internal assistant, a content moderation tool, or a public-facing product — they take on responsibility for what that system outputs. A private LLM running on your infrastructure has no external safety layer. The model's own alignment training is the only guardrail, and for most open-weight models, that alignment is imperfect and variable across different prompt patterns.
ShieldGemma provides a second layer of defense. It is a 2B to 9B classifier — trained specifically to evaluate text for harmful content across Google's defined safety taxonomy — that can be inserted into an AI pipeline as an input filter, output filter, or both. Before a user's message reaches your main LLM, ShieldGemma can evaluate it for prompt injection attempts, jailbreak patterns, and harmful content requests. Before the LLM's response reaches the user, ShieldGemma can evaluate it for dangerous instructions, sexually explicit content, harassment, and other defined harm categories. If the classifier flags a message, the pipeline can route it to a refusal response, a human review queue, or simply log it for analysis.
The critical differentiator for private AI deployments is that ShieldGemma runs on your infrastructure. Using an external safety API — even Google's own Perspective API or similar services — means every user conversation, including the sensitive context that often surrounds harmful content requests, passes through a third-party server. For applications handling legally privileged conversations, confidential business discussions, or any personal information, this creates the same privacy exposure that motivated the private AI deployment in the first place. ShieldGemma eliminates this by running the safety classification entirely locally.
What ShieldGemma Classifies
ShieldGemma is trained against a specific set of harm categories derived from Google's safety policy framework. Understanding what it classifies — and what it does not — is important for building accurate expectations about what a ShieldGemma deployment will and will not catch.
The primary classification categories include: dangerous content (instructions for weapons, self-harm, or illegal activities that could enable real-world harm), sexually explicit content (material inappropriate for general audiences), harassment and hate speech (targeted personal attacks and content denigrating protected groups), and prompt injection attacks (attempts to override or manipulate the system's instructions through user input). ShieldGemma can evaluate both the input side — what a user sends — and the output side — what the AI generates in response.
What ShieldGemma does not replace: it is a classifier, not a comprehensive ethical review system. It evaluates against defined categories and will not catch every possible harmful output — particularly subtle manipulation, factually incorrect but not overtly harmful content, or harms specific to domain contexts it was not trained on. It is one layer in a defense-in-depth approach to AI safety, not a complete solution.
Where ShieldGemma Consistently Delivers
Input filtering for customer-facing AI
Before user messages reach your main LLM, ShieldGemma screens for prompt injection attempts, jailbreak patterns, and overtly harmful requests. The classification adds minimal latency (ShieldGemma 2B processes in under a second) while catching the highest-risk input patterns before they consume expensive main model inference.
Output validation before delivery
ShieldGemma evaluates LLM outputs before they are sent to users, flagging responses containing dangerous instructions, explicit content, or harassment. For applications using open-weight models without strong safety alignment — or models where jailbreaks are a known risk — output filtering provides a backstop against the most damaging failures.
Audit logging and compliance evidence
ShieldGemma classification results, logged with conversation IDs and timestamps, create an auditable record of safety decisions in your AI system. For organizations subject to AI Act compliance requirements, internal governance reviews, or litigation discovery, this log demonstrates that a safety layer was operating and what it classified.
Replacing external moderation APIs
Organizations currently using OpenAI's moderation endpoint, Perspective API, or similar cloud safety services can replace those API calls with local ShieldGemma inference. The privacy improvement is significant — no conversation content leaves the network — and the per-classification cost drops to infrastructure cost alone.
Multi-tenant platform guardrails
SaaS platforms offering AI features to customers need a safety layer that operates on customer data without exposing that data to third parties. Private ShieldGemma deployment provides safety classification for every tenant's conversations on the platform's own infrastructure, keeping customer data fully contained.
Research and red-team evaluation
Security researchers and AI safety teams evaluating model vulnerabilities can use ShieldGemma to systematically classify outputs across adversarial test suites without sending potentially sensitive test prompts to external APIs. The local deployment allows unrestricted red-team testing against the classifier itself and against the main model combination.
Who this model family is for
Who This Model Family is For
ShieldGemma is not a chatbot — it does not write, answer questions, or generate text. Its only role is to act as a safety classifier. For personal use, it is only relevant if you are building your own private AI setup and want an automated filter that flags toxic, harmful, or unsafe content before it reaches you. Most individuals will not need it unless they are actively constructing a custom moderation pipeline.
This is where ShieldGemma delivers real value. If your organization runs a private AI assistant (for employees or customers) and you need to moderate both user inputs and model outputs without sending data to a third-party moderation service, ShieldGemma gives you a self-hosted safety layer. It is especially useful for customer-facing tools, internal knowledge systems, or any deployment where you must catch hate speech, harassment, sexually explicit content, or dangerous instructions while keeping all data inside your own infrastructure.
Developers use ShieldGemma as a guard model placed in front of or alongside a generative model (such as Gemma, Llama, Mistral, or Qwen). It evaluates text against defined harm categories and returns a clear safety judgment with a probability score. You can then programmatically block, flag, log, or escalate the content. Because it is a focused classifier rather than a general LLM, integration is predictable and lightweight.
Researchers studying content safety, moderation reliability, or adversarial prompting will find ShieldGemma a transparent and reproducible baseline. You can benchmark its performance against your own labeled datasets, tune decision thresholds, and audit how well your generative models behave across the four standard harm categories. It is particularly useful for building internal safety evaluations in an offline, auditable environment.
Licensing information
Licensing Information
ShieldGemma is released by Google under the Gemma Terms of Use. This license permits commercial use, including deploying ShieldGemma as a moderation layer in commercial products and internal systems, provided you comply with Google's Prohibited Use Policy.
The license is more permissive than many closed models but is not a standard open-source license like Apache 2.0. You must pass the use restrictions forward if you redistribute the model.
Official model card:
Disclaimer: NoCloudGPT provides this licensing summary as a convenience reference only. It does not constitute legal advice. License terms can change. Always review the official model card and consult your legal counsel before deploying any model in a commercial or regulated context.
Available model sizes
Available Model Sizes
| Model Size | Ollama Tag | Recommended NoCloudGPT Tier | Notes | |
|---|---|---|---|---|
| ShieldGemma 2B | shieldgemma:2b |
Starter | Lightweight guard model. Best for high-throughput input/output screening where low latency matters most. | Get quote → |
| ShieldGemma 9B | shieldgemma:9b |
Standard / Professional | Stronger classification accuracy on nuanced or borderline content. A solid default for most production moderation pipelines. | Get quote → |
| ShieldGemma 27B | shieldgemma:27b |
Professional / Enterprise | Highest accuracy for subtle or context-dependent harm detection. Best when moderation quality is critical. | Get quote → |
Note: ShieldGemma is a safety classifier, not a generative model. It evaluates text and returns safety signals. You decide what action to take (block, flag, log, etc.) in your own application logic.
ShieldGemma 2B is small enough to co-deploy on the same instance as a primary LLM without meaningful memory competition on a 16 GB or larger deployment. For high-throughput applications, a dedicated ShieldGemma instance with a load-balanced API endpoint scales independently from the main model, allowing safety classification capacity to be adjusted separately from generation capacity.
Deploy ShieldGemma on Your Infrastructure
NoCloudGPT configures ShieldGemma as part of a complete private AI deployment — co-deployed with your primary model or on a dedicated safety classification instance with API integration into your existing AI pipeline. Logging configuration, threshold tuning, and integration with human review workflows are available for regulated industry deployments.