GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
tbtlr
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
tbtlr
Model Tree
google/gemma-4-E2B-it
Input Modalities
Output Modalities
Supported Functionality
python
from transformers import AutoProcessor, Gemma4ForConditionalGenerationfrom peft import PeftModelimport torchbase = Gemma4ForConditionalGeneration.from_pretrained("google/gemma-4-E2B-it", dtype=torch.bfloat16)m = PeftModel.from_pretrained(base, "tbtlr/shieldgemma-4-e2b-trimodal-lora").cuda().eval()p = AutoProcessor.from_pretrained("tbtlr/shieldgemma-4-e2b-trimodal-lora")yes, no = p.tokenizer.encode("Yes", add_special_tokens=False)[0], p.tokenizer.encode("No", add_special_tokens=False)[0]# logits = m(**inputs, logits_to_keep=1).logits[:, -1]; p_violation = softmax([logits[yes], logits[no]])[0]Prompt templates, policy strings, training recipe, evaluation and limitations: see the merged model card
at tbtlr/shieldgemma-4-e2b-trimodal and the project README.
Text (ShieldGemma v1 wording): dangerous content, harassment, hate speech, sexually explicit, violence,
obscenity, plus a composite "any harm" policy. Image (ShieldGemma 2 wording): sexually explicit,
violence/gore, dangerous content, plus a composite. Audio: the text prompt policies applied to a spoken
user request (the audio clip replaces the text of the request). The classifier is policy-conditioned: it also
follows policy text it was not trained on (tested with OpenAI Moderation's own eight definitions).
Exact prompt templates and policy strings are in shield_policies.json.
Weights and code: Apache 2.0, the same license as the base model (LICENSE in this repo). The model was
trained on the datasets below; two of the text sets are CC BY-NC 4.0. Whether that restriction carries
over to model weights is legally unsettled, so commercial users should review the list and make their
own assessment.
| dataset | role | declared license |
|---|---|---|
| Aegis 2.0 (NVIDIA) | text train / eval | CC BY 4.0 |
| BeaverTails | text train / eval | CC BY-NC 4.0 |
| ToxicChat | text train (benign) / eval | CC BY-NC 4.0 |
| WildGuardMix | text train / eval | ODC-BY |
| XSTest | text eval | CC BY 4.0 |
| OpenAI Moderation eval | text eval | MIT |
| VLGuard | image train / eval | MIT |
| LlavaGuard (images from SMID) | image train / eval | Apache 2.0 (SMID: CC BY 4.0 original release) |
| UnsafeBench | image train / eval | gated data-use agreement (research, education, responsible commercial use) |
| COCO val2017 | image train (benign) | CC BY 4.0 annotations; images under their Flickr licenses |
| LibriSpeech | audio train (benign) / eval | CC BY 4.0 |
| LibriTTS-R Piper voice (en_US-libritts_r-medium) | TTS for audio train / eval | CC BY 4.0 |
| JALMBench | audio eval | not declared |
Binary "any unsafe" scores depend on how far a benchmark's taxonomy is from these policies (hate, political, privacy, fraud and misinformation images/text are out of scope). The dangerous-content image policy was trained with a broader reading (weapons, substance abuse, criminal planning, self-harm imagery) than its text counterpart. Audio training used synthetic (TTS) speech only; real recorded speech, accents, noise and non-English audio are untested. On the same spoken prompts, transcribing with Gemma 4 and scoring the transcript with the text policy still scores higher (0.886 F1) than the single-pass audio shield (0.852); the audio pathway is the faster option with a small accuracy cost. English only. Not a substitute for human review in high-stakes settings.
from transformers import AutoProcessor, Gemma4ForConditionalGenerationfrom peft import PeftModelimport torchbase = Gemma4ForConditionalGeneration.from_pretrained("google/gemma-4-E2B-it", dtype=torch.bfloat16)m = PeftModel.from_pretrained(base, "tbtlr/shieldgemma-4-e2b-trimodal-lora").cuda().eval()p = AutoProcessor.from_pretrained("tbtlr/shieldgemma-4-e2b-trimodal-lora")yes, no = p.tokenizer.encode("Yes", add_special_tokens=False)[0], p.tokenizer.encode("No", add_special_tokens=False)[0]# logits = m(**inputs, logits_to_keep=1).logits[:, -1]; p_violation = softmax([logits[yes], logits[no]])[0]