Meta drops Llama Guard 4: a 12B safety model that runs on a single GPU

Meta just released Llama Guard 4, and the headline feature isn’t just about better detection — it’s about practicality. This is a 12-billion-parameter multimodal safety model pruned from the Llama 4 Scout architecture. The key engineering move? Meta stripped out all the routed experts and router layers from Scout’s Mixture-of-Experts design, leaving only the dense shared expert. No additional pre-training was needed. The result is a model that can run on a single GPU with 24GB of VRAM, making it far more accessible than a full MoE model would be.

What does it actually guard? The model classifies 14 hazard types from the MLCommons taxonomy, plus code interpreter abuse. It handles text-only and image-plus-text inputs, so you can filter both prompts going into a model and responses coming out. The training data was a 3:1 mix of text-only to multimodal examples, built on human-annotated multilingual data — the same dataset used for Llama Guard 3. Speaking of its predecessor, Meta reports performance improvements over Llama Guard 3, though specific benchmark numbers aren’t detailed in the release.

A genuinely useful feature is the configurable taxonomy. If your application doesn’t care about certain hazard categories, you can simply exclude them at inference time using an excluded_category_keys parameter. In the provided code example, filtering out categories S9, S2, and S1 reclassifies an unsafe prompt about bomb-making as safe — because the remaining categories don’t flag it. This isn’t softening safety; it’s reducing false positives for use cases where certain hazards are irrelevant. The model also understands multiple languages, which matters for global deployments.

Alongside Llama Guard 4, Meta also shipped Prompt Guard 2, a pair of compact classifiers at 86M and 22M parameters focused specifically on prompt injection and jailbreak detection. The smaller 22M version is faster and uses tokenization resistant to adversarial attacks, with simplified binary output: benign or malicious. This is a direct response to the arms race between safety filters and prompt injection techniques. The fact that Meta is investing in both a heavyweight multimodal guard and a lightweight text-only classifier suggests they see safety as a multi-layered problem — no single model catches everything. The real question is how these hold up against the increasingly creative jailbreaks circulating in open-source communities.