Llama Guard 4 12B: A Multimodal Safety Classifier, Read Honestly

Llama Guard 4 shows up in model catalogues next to chat models, priced per token like them, and that placement misleads people. It is not something you talk to. You hand it a conversation and it answers with one word, safe or unsafe, plus the hazard categories it thinks were violated. Treat it as a classifier with a language-model interface and most of the confusion goes away.

Meta released it at the end of April 2025, alongside Llama Prompt Guard 2, as the safeguard model for the Llama 4 generation. This guide covers what it is built from, what its own published numbers actually say, and where it sits in a request path.

Where the 12B came from

Llama Guard 4 is a dense 12B model, but it was not trained as one from scratch. According to Meta's model card it was pruned from the Llama 4 Scout pre-trained model: the routed experts and the router layers were removed and only the shared expert was kept. What remains is a dense, early-fusion transformer that shares Scout's tokenizer and vision encoder.

That lineage explains the two things that are new compared with Llama Guard 3. First, it is natively multimodal, so it judges text and images together in one pass, including prompts with several images, which the earlier 11B vision variant could not handle. Second, Meta positions it as a single replacement for both Llama Guard 3 8B (text) and Llama Guard 3 11B (vision).

If you want the background on the parent model, see the Llama 4 Scout guide. The short version: removing the routed experts leaves a 12B model that the card says runs on a single GPU, a far smaller memory footprint than Scout, which is the right trade for a model that runs on every request.

The fourteen categories, and the ones to treat carefully

The model is trained on the MLCommons hazard taxonomy, codes S1 to S13, plus one Meta added: S14, code interpreter abuse, which applies to text only. The list covers violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialised advice, privacy, intellectual property, indiscriminate weapons, hate, suicide and self-harm, sexual content and elections.

Meta flags three of these itself. Defamation (S5), intellectual property (S8) and elections (S13) can depend on current factual knowledge, and a classifier with a fixed training cut-off cannot know whether a claim about a living person is true or whether an election rule changed last month. The model card suggests more elaborate systems for high-sensitivity uses in those categories. In practice that means routing S5, S8 and S13 hits to a second check or a human rather than blocking on them outright.

You can also narrow the category list in the prompt. If your product has no code interpreter, there is no reason to ask about S14; if it is an adult platform, S12 may be a policy question rather than a block. Fewer categories means fewer chances to misfire.

Reading Meta's own numbers

Meta published results on an internal test set, compared only against Llama Guard 3. They are more useful than most vendor tables because they include false positive rates:

• English: 69% recall, 11% false positive rate, F1 61%
• Multilingual: 43% recall, 3% false positive rate, F1 51%
• Single image: 41% recall, 9% false positive rate, F1 38%
• Multiple images: 61% recall, 9% false positive rate, F1 52%

Read those plainly. On English text it misses roughly three in ten unsafe items on Meta's set and flags about one in nine safe items. Multilingual recall is lower than Llama Guard 3 by two points, while the multi-image gain is the headline improvement at plus twenty points of recall. None of this is a criticism; it is what a 12B classifier looks like. It does mean Llama Guard 4 is a filter that lowers risk, not a guarantee, and you should never present it to stakeholders as one.

The internal test set is not your traffic. Before trusting any of these figures, label a few hundred real requests from your own logs and measure recall and false positives yourself. The method in building a 20-task eval transfers directly, with labels instead of pass or fail.

Wiring it into a request path

There are two placements, and most deployments want both:

1. Input filtering classifies the user turn before it reaches your main model. This is where you stop requests you never want to process.
2. Output filtering classifies the assistant reply before it reaches the user. This catches the cases where an innocent-looking prompt produced something you cannot ship.

The response is short, so cost is dominated by input tokens: you pay to send the conversation, not to receive a verdict. At the time of writing OpenRouter lists it at $0.18 per million tokens for both input and output, with a 163,840-token context window. For a long chat history, classify the latest turn plus a trimmed window rather than the whole transcript, because the cost of a guard call scales with whatever you send it.

Two cautions. Meta's evaluation covers text and mixed text-and-image prompts, mostly with a handful of images, so if you plan to scan uploaded photos with no accompanying text, or prompts with many images, test that case on your own data first. And it is itself a language model, so it can be manipulated by adversarial input. Meta's own answer is Prompt Guard 2, released the same day in 86M and 22M sizes and aimed specifically at jailbreaks and prompt injection. The two are complementary, and prompt injection and agent security covers why injection needs its own layer.

Licence and alternatives

The weights are gated under the Llama 4 Community Licence. That means attribution requirements, an acceptable use policy and the clause that requires a separate licence above 700 million monthly active users. For most teams that is workable, but it is not MIT, and the attribution and acceptable use terms travel with any product you build on it.

The nearest alternatives take a different approach. gpt-oss-safeguard-20b reads a policy you write at inference time rather than a fixed taxonomy, which suits teams whose rules do not map to MLCommons. Llama Guard 4 is the better fit when the standard categories cover you and you need images handled in the same call.

A practical decision rule: use Llama Guard 4 as the cheap, always-on first layer for text and image prompts; send its S5, S8 and S13 hits to a second check; add Prompt Guard 2 if users can inject content into your context; and measure recall on your own labelled sample before telling anyone how safe the system is.