Llama Guard 4

What Llama Guard 4 is and who makes it

Llama Guard 4 is a safety model from Meta. It is not a chatbot you talk to. Instead, developers place it next to a chat model to check what goes in and what comes out. Given a user prompt or a model's reply, Llama Guard 4 writes a short verdict: "safe", or "unsafe" followed by the hazard categories it found. It works with text and with images, including several images in one prompt.

According to Meta's model card, Llama Guard 4 has 12 billion parameters and a dense architecture. Meta built it by taking a pre-trained Llama 4 Scout checkpoint, removing the routed experts so that only the shared expert remained, and then fine-tuning the result for safety classification. It shares its tokenizer and vision encoder with Llama 4 Scout and Maverick and can run on a single GPU. It was listed on OpenRouter on April 30, 2025, a few weeks after the Llama 4 launch, and is released under the Llama 4 Community License.

The Llama Guard family

Meta has published several Llama Guard versions alongside its Llama releases. Llama Guard 4 combines what used to be two separate models, Llama Guard 3 8B for text and Llama Guard 3 11B Vision for images, into a single classifier. Meta pairs it with other open safety tools; for example, the model card points to Llama Prompt Guard 2 for detecting prompt attacks such as jailbreak attempts.

What it checks: the hazard categories

Llama Guard 4 is trained on the MLCommons hazard taxonomy, plus one extra category for tool use. When it marks something unsafe, it names the categories:

"Specialized advice" covers replies that give specialized financial, medical or legal advice, or that suggest dangerous activities or objects are safe.

What Llama Guard 4 is good at

• Input filtering. Check a user's prompt before the main model sees it, and stop clearly harmful requests early.
• Output filtering. Check the main model's answer before showing it, so the model gets a chance to respond safely and is only blocked if its reply is unsafe.
• Images. Classify prompts that mix text with one or more images, which earlier text-only guards could not do.
• Many languages. It supports English plus the languages of Llama Guard 3, which Meta lists as French, German, Hindi, Italian, Portuguese, Spanish and Thai.

Meta notes that using both input and output filtering gives additional security, and that in its internal tests input filtering raised refusal rates more than output filtering.

Limits to know about

• It is a model, not a rulebook. It can miss harmful content and flag harmless content. Meta's card says performance may be limited by its training data in areas that need common sense or specific languages.
• Facts it cannot check. Categories such as defamation, intellectual property and elections often need up-to-date facts to judge, and Meta recommends more complex systems for sensitive uses there.
• Prompt attacks. As a language model it can be tricked by adversarial or prompt injection attacks.
• Many images. It was tested mostly with prompts containing a few images, so results may vary with many more.

How to get Llama Guard 4 officially

The weights are on Hugging Face as meta-llama/Llama-Guard-4-12B, where Meta's model card also includes example code for the Transformers library. Accept the license on the model page to unlock the files. OpenRouter lists it with a context window of 163,840 tokens at $0.18 per million input tokens and $0.18 per million output tokens (OpenRouter list price, Oct 2026).

As a Llama 4 model, it falls under the Llama 4 Community License and acceptable use policy, including "Built with Llama" for products that use it and the separate rules for multimodal models in the EU. See our license page for a plain-language summary, and our API guide for calling Llama models from code.

Privacy notes

A safety classifier reads every message it checks, so treat it like any other part of your AI pipeline: if you call it through a cloud provider, that provider's privacy terms apply; if you host it yourself, the data stays on your servers. Our guide to AI privacy and safety covers good habits for users.

How Llama Guard 4 compares

Compared with Llama Guard 3, Meta reports that version 4 roughly matches or exceeds the earlier text and vision guards while being one model instead of two. Compared with chat models such as Llama 4 Scout, it is much smaller and only classifies; it does not write answers. If you are building an app on open models, a guard model like this is one layer of safety, alongside clear rules for users, rate limits and human review.

FAQ

Can I chat with Llama Guard 4 on Llama.Online?

No, Llama Guard 4 is not in our chat. It is a classifier for developers, not a conversational model.

What does Llama Guard 4 output?

A short text verdict: "safe", or "unsafe" plus category codes such as S9 for indiscriminate weapons.

Does it work with images?

Yes. It classifies prompts that combine text with one or more images.

Is Llama Guard 4 free to use?

The weights are free to download under the Llama 4 Community License. Hosted APIs charge per token.