Llama Guard and Safety Classifiers

Llama Guard is a safety-classification model intended to work alongside a generative model. It can classify an incoming prompt, a generated response, or both, and returns a safe/unsafe label with category information for unsafe content. That output can support a product’s moderation decision, but the application still has to define what to do with each label: block, transform, escalate, or permit. A classifier’s categories and training policy are not automatically identical to an organization’s legal duties or product rules. Capabilities depend on the version. Meta’s current Llama Guard 4 12B model card describes a natively multimodal classifier for text and one or more images, based on a hazard taxonomy, with prompt and response classification. It also describes an added text-only code-interpreter-abuse category. Earlier Guard versions are different; do not transfer Guard 4’s image support, parameter size, or language claims to them. The official documentation gives model-specific prompt formats and compatibility guidance, so deployments should verify the exact checkpoint and interface they use. Use input filtering when a product wants to stop certain requests before generation, and output filtering when it wants to inspect what the model actually produced. Using both provides two decision points, but can also increase refusals or latency. Meta documents limitations including imperfect policy coverage, dependence on training knowledge for some categories, and susceptibility to adversarial or prompt-injection attacks. Evaluate the full application with representative examples, inspect false positives and misses, and add other controls for sensitive decisions. A safety label is evidence for a workflow, not proof that all unsafe content has been caught.