Shieldstral 1.0 3B
Mistral AI · European Union · Apache 2.0
Commercial use: Yes — free for commercial use
Apache 2.0. Unrestricted.
A small model whose only job is checking whether text going into or out of your AI is a problem.
Why it should matter to you
Guardrails are the part of an AI build that gets cut first and missed most. A general model asked to police itself is unreliable, because the same prompt injection that redirects the model redirects its self-check. A separate classifier is a different, harder target.
How it connects to our work
We run guardrails as a distinct layer outside the model, because a model that follows its instructions 98% of the time is an impressive research result and an unacceptable compliance posture. Hidden prompt injection is the attack that makes this concrete.
From our field notesHidden prompt injection is the attack vector nobody's demo covers.
Advantages
- A dedicated safety classifier rather than a general model asked to police itself
- Tiny and fast enough to sit in front of every request without adding noticeable latency
- Apache 2.0 and EU-origin, so it can run inside a GDPR-constrained pipeline
Disadvantages
- Classifier only — it does not generate
- No classifier catches everything, particularly prompt injection hidden inside documents
- Adds a step to every request, so it needs to be genuinely fast in your stack
Reach for it when
Filtering input and output around a production agent, especially where you need the guardrail itself to stay in the EU.
Where it falls down
Being the whole safety story. It is one layer; policy enforcement, blast-radius limits and logging are the others.
Running it
4 GB. Runs on almost anything. See the hardware sizing tables for how that maps to specific chips and cards, and the quantisation guide for what you give up at each bit width.
Which cloud instance actually runs this, and what it costs
At Q4_K_M the weights are about 2 GB, so 20 catalogued instances fit with room for context, of which the 8 best value are shown. Cheapest per token is Hetzner GEX45 (~$0.24 per million output tokens at an estimated 336 tok/s). Fastest on a single card is Azure NCads H100 v5 at roughly 1675 tok/s for $1.16 per million tokens, which is the speed-versus-cost trade in one line.
| Instance | GPU | VRAM | Bandwidth | Est. tok/s | $/hr | $/M tokens |
|---|---|---|---|---|---|---|
| Hetzner GEX45 | RTX PRO 4000 Blackwell | 24 GB | 672 GB/s | ~336 | $0.290 | $0.24 |
| RunPod A100 PCIe | A100 80GB | 80 GB | 1935 GB/s | ~968 | $1.190 | $0.34 |
| Hetzner GEX131 | RTX PRO 6000 Blackwell Max-Q | 96 GB | 1792 GB/s | ~896 | $1.420 | $0.44 |
| RunPod L40S | L40S | 48 GB | 864 GB/s | ~432 | $0.790 | $0.51 |
| RunPod H100 PCIe | H100 PCIe | 80 GB | 2000 GB/s | ~1000 | $1.990 | $0.55 |
| Lambda A100 40GB | A100 40GB | 40 GB | 1555 GB/s | ~778 | $1.990 | $0.71 |
| Lambda H100 PCIe | H100 PCIe | 80 GB | 2000 GB/s | ~1000 | $3.290 | $0.91 |
| AWS g5.xlarge | A10G | 24 GB | 600 GB/s | ~300 | $1.006 | $0.93 |
Token generation on a single request is memory-bandwidth-bound, not compute-bound: the GPU must read every active weight from memory for each token it emits. So the ceiling is roughly GPU memory bandwidth divided by the size of the active weights. A 16 GB model on a 300 GB/s L4 tops out near 19 tokens/sec; the same model on a 2039 GB/s A100 tops out near 127. Figures on model pages are that arithmetic, computed from the bandwidth and weight-size columns here. They are a ceiling for one request at batch size 1, before serving overhead, so treat them as an upper bound for comparing instances rather than a benchmark. Batching raises total throughput well above this and does not raise per-request speed.
For identical silicon, the hyperscalers charge roughly 2 to 5 times what the specialist GPU clouds charge. An A100 80GB is about $3.43/GPU-hr on AWS, $3.67 on Azure and $5.03 on Google Cloud, against $1.19-1.39 on RunPod and $1.99 on Lambda. That spread is the single largest cost lever in a self-hosted inference budget, and it is larger than any saving from picking a smaller model.
Three costs that are absent from every headline rate: egress, storage for the weights, and idle time. A 70B model at Q4 is tens of gigabytes that must be pulled to the instance on every cold start, and an endpoint billed hourly is billed while it sits idle waiting for a request. Rates read 2026-09-06; check each provider's live pricing on the directory hub.
Free tiers carrying this model
| Provider | Type | The catch | Live limits |
|---|---|---|---|
| Mistral La Plateforme | First-party API | Not every Mistral model is commercially free even when the weights are public — Codestral ships under a non-production licence. Check per model, not per vendor. | check → |
Jurisdiction: European Union
Mistral is the only EU-headquartered lab shipping frontier-adjacent open weights. Contracting with an EU entity removes the international-transfer question entirely rather than solving it with a framework. Most of the Mistral open range is Apache 2.0, so you can also self-host and remove the vendor from the data path altogether.
Watch for: EU jurisdiction is not the same as EU data residency, and neither is the same as EU-only sub-processors. Ask for all three in writing if it matters to you. Also note that Codestral ships under a non-production licence — being a European vendor does not make every model commercially free.
Frequently asked
Can I use Shieldstral 1.0 3B commercially?
Apache 2.0. Unrestricted.
What hardware do I need to run Shieldstral 1.0 3B?
4 GB. Runs on almost anything. Weights alone are roughly 2 GB at Q4_K_M and 3.5 GB at Q8_0. Add KV cache on top of that, which grows with your context length.
What licence is Shieldstral 1.0 3B released under?
Apache 2.0. Full commercial use, modification and redistribution. Patent grant included. The most permissive licence in common use for open-weight models.
Where can I use Shieldstral 1.0 3B for free?
Free tiers carrying it include Mistral La Plateforme. Limits differ per provider and change often, so check each provider's own limits page. You can also self-host the weights, which has no rate limit at all.
Similar models
Mistral Large 3 675B
Multi-GPU datacentre, or hosted on La Plateforme.
DeepSeek-V4-Flash
Hosted, or 256 GB+ unified memory at Q4. Not a laptop model.
GLM-5.3-Flash
80-96 GB at Q4_K_M. A workstation or Ultra-class Mac.
Qwen3.8 27B
24 GB GPU at Q4_K_M, or a 32 GB Mac at Q6_K.
Wiring Shieldstral 1.0 3B into something real?
We build the evaluation harness, the failover and the cost ceilings around a model like this, so it survives contact with production.
Maps to AI agent development, AI automation development and AI strategy and consulting. Or see it working: our case studies.