GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
tbtlr
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
tbtlr
Model Tree
google/gemma-4-E2B-it
Input Modalities
Output Modalities
Supported Functionality
Text (ShieldGemma v1 wording): dangerous content, harassment, hate speech, sexually explicit, violence,
obscenity, plus a composite "any harm" policy. Image (ShieldGemma 2 wording): sexually explicit,
violence/gore, dangerous content, plus a composite. Audio: the text prompt policies applied to a spoken
user request (the audio clip replaces the text of the request). The classifier is policy-conditioned: it also
follows policy text it was not trained on (tested with OpenAI Moderation's own eight definitions).
Exact prompt templates and policy strings are in shield_policies.json.
python
from transformers import AutoProcessor, Gemma4ForConditionalGenerationimport torchm = Gemma4ForConditionalGeneration.from_pretrained("tbtlr/gemma-shield-e2b-trimodal", dtype=torch.bfloat16).cuda().eval()p = AutoProcessor.from_pretrained("tbtlr/gemma-shield-e2b-trimodal")yes, no = p.tokenizer.encode("Yes", add_special_tokens=False)[0], p.tokenizer.encode("No", add_special_tokens=False)[0]# Build the prompt from shield_policies.json (template + policy text), run one forward pass and read# the first generated position: logits = m(**inputs, logits_to_keep=1).logits[:, -1]# p_violation = softmax([logits[yes], logits[no]])[0]# Audio: 16 kHz mono waveform via processor(text=..., audio=[wave], sampling_rate=16000).Reference scorers, data mappings and the full evaluation suite live in the project repository
(shield/prompt.py, shield/score*.py).
Text: ToxicChat 0.769 / 0.831 (ShieldGemma 2B paper: 0.704 / 0.778), Aegis 2.0 test 0.818 / 0.891, BeaverTails 0.843 / 0.918, WildGuardTest 0.792 / 0.871, XSTest 0.882 / 0.956, OpenAI Moderation 0.763 / 0.840. Image, UnsafeBench test: sexual 0.844 / 0.910, dangerous 0.692 / 0.732, violence 0.645 / 0.696, composite 0.702 / 0.780; LlavaGuard test composite 0.684 / 0.675; VLGuard test composite 0.754 / 0.803. Audio: spoken ToxicChat (595 TTS clips, 904 voices) 0.843 / 0.929; JALMBench harmful speech vs LibriSpeech 0.935 / 0.973. Full tables and error analyses: project README.
Weights and code: Apache 2.0, the same license as the base model (LICENSE in this repo). The model was
trained on the datasets below; two of the text sets are CC BY-NC 4.0. Whether that restriction carries
over to model weights is legally unsettled, so commercial users should review the list and make their
own assessment.
| dataset | role | declared license |
|---|---|---|
| Aegis 2.0 (NVIDIA) | text train / eval | CC BY 4.0 |
| BeaverTails | text train / eval | CC BY-NC 4.0 |
| ToxicChat | text train (benign) / eval | CC BY-NC 4.0 |
| WildGuardMix | text train / eval | ODC-BY |
| XSTest | text eval | CC BY 4.0 |
| OpenAI Moderation eval | text eval | MIT |
| VLGuard | image train / eval | MIT |
| LlavaGuard (images from SMID) | image train / eval | Apache 2.0 (SMID: CC BY 4.0 original release) |
| UnsafeBench | image train / eval | gated data-use agreement (research, education, responsible commercial use) |
| COCO val2017 | image train (benign) | CC BY 4.0 annotations; images under their Flickr licenses |
| LibriSpeech | audio train (benign) / eval | CC BY 4.0 |
| LibriTTS-R Piper voice (en_US-libritts_r-medium) | TTS for audio train / eval | CC BY 4.0 |
| JALMBench | audio eval | not declared |
Binary "any unsafe" scores depend on how far a benchmark's taxonomy is from these policies (hate, political, privacy, fraud and misinformation images/text are out of scope). The dangerous-content image policy was trained with a broader reading (weapons, substance abuse, criminal planning, self-harm imagery) than its text counterpart. Audio training used synthetic (TTS) speech only; real recorded speech, accents, noise and non-English audio are untested. On the same spoken prompts, transcribing with Gemma 4 and scoring the transcript with the text policy still scores higher (0.886 F1) than the single-pass audio shield (0.843); the audio pathway is the faster option with a small accuracy cost. English only. Not a substitute for human review in high-stakes settings.
from transformers import AutoProcessor, Gemma4ForConditionalGenerationimport torchm = Gemma4ForConditionalGeneration.from_pretrained("tbtlr/gemma-shield-e2b-trimodal", dtype=torch.bfloat16).cuda().eval()p = AutoProcessor.from_pretrained("tbtlr/gemma-shield-e2b-trimodal")yes, no = p.tokenizer.encode("Yes", add_special_tokens=False)[0], p.tokenizer.encode("No", add_special_tokens=False)[0]# Build the prompt from shield_policies.json (template + policy text), run one forward pass and read# the first generated position: logits = m(**inputs, logits_to_keep=1).logits[:, -1]# p_violation = softmax([logits[yes], logits[no]])[0]# Audio: 16 kHz mono waveform via processor(text=..., audio=[wave], sampling_rate=16000).