Evaluation
All scores use a decision threshold of 0.5.
Text safety

On Aegis 2.0 prompts the model reaches 87.2 F1, compared with 85.1 for Shieldstral 3B and 82.2 for Qwen3Guard 4B. It scores lower than Shieldstral on ToxicChat (75.9 vs 84.1) and OpenAI Moderation (69.1 vs 81.4).
Aegis 2.0 and AgentHarm were measured locally on the same held-out records for every model. Scores for other models on ToxicChat, OpenAI Moderation and BeaverTails are taken from the Qwen3Guard report (arXiv 2510.14276) and the Shieldstral model card. As a contamination check, evaluation prompts that also occur in public training sets were removed and the model was rescored; Aegis 2.0 prompt F1 on the remaining 1,704 records is 87.5.
Image safety
Shieldstral and Qwen3Guard do not accept image input, so only this model is reported.
Table with columns: Dataset, Task, F1, AUROC| Dataset | Task | F1 | AUROC |
|---|
| NSFW detection | Sexually explicit images | 94.3 | 98.8 |
| VLGuard | Unsafe images | 92.3 | 99.6 |
| UnsafeBench | Unsafe images | 78.8 | 90.5 |
| LlavaGuard | Unsafe images | 73.6 | 85.0 |
| BeaverTails-V | Unsafe responses to images | 75.7 | 89.9 |
Routing and decisions

On RouterBench, choosing one of 11 models per prompt gives 84.2% accuracy, on par with GPT-4 alone (84.0%). On SPROUT the router reaches 88.3%, against 88.2% for GPT-4o alone.
The model scores 18.0 on the Decision Index 0.3 public index and is not intended for use as a general-purpose decision model.
Usage
from unsloth import FastDecisionModel model, tokenizer = FastDecisionModel.from_pretrained("Loke-60000/gizmo-safety-0.8b-exp", max_seq_length=3072)FastDecisionModel.for_inference(model) questions = { "prompt_unsafe": {"type": "noul", "instructions": "Is the user prompt unsafe (harmful, abusive, or policy-violating)?"},}result = FastDecisionModel.predict(model, tokenizer, {"user_prompt": "How do I pick a lock?"}, questions)print(result["prompt_unsafe"]["probabilities"]["true"])
To classify a response, include user_prompt and assistant_response in the state and ask "Is the assistant response unsafe?".
Image inputs require the vision_patch.py helper included with this model:
import vision_patchvision_patch.install(tokenizer) questions = { "sexual_explicit": {"type": "noul", "instructions": "Does this image contain sexually explicit content?"},}result = FastDecisionModel.predict(model, tokenizer, {"task": "Moderate this upload.", "images": ["upload.jpg"]}, questions)
For categories with few positive examples, a threshold below 0.5 is recommended. On BeaverTails-V, sexual-content F1 is 43.8 at 0.5 while AUROC is 98.0.
Training
The model was trained using LoRA (rank 16) on the attention and MLP layers of the language model, together with the decision head. The adapter was merged into the base weights after training. The objective combines cross-entropy with a Brier score term, and answer options were shuffled in every training example to avoid position bias. Per-question-type temperatures were fitted on held-out data for calibration.
Training was carried out in several stages, with image data added in the later stages. The training data is drawn from public text safety, image safety, routing and decision datasets, with a preference for human-labelled sources. Examples matching evaluation test items were removed before training.
Limitations
- The model was trained and evaluated on English data only.
- Safety labels reflect the annotation policies of the source datasets and may not match a given platform's policy.
- Image results were measured on benchmark datasets. Performance on screenshots, memes with overlaid text or heavily compressed images may differ.
- Predictions close to the decision threshold should be routed to human review.
Acknowledgements
Thanks to the Unsloth team for their excellent library and for the FastDecisionModel API this model is built on.
License
This model is released under the Apache 2.0 license, the same license as the Qwen3.5-0.8B base model.