Open moderation models that flag unsafe user prompts and model responses, all evaluated with the same script at a 0.5 threshold on 9 public benchmarks: multilingual prompt and response harm (PolyGuard, 17 languages), response harm (BeaverTails), real user prompts (ToxicChat), the OpenAI moderation set, over-blocking (XSTest), multilingual toxicity (textdetox) and recall on clearly harmful prompts (Aya red-teaming, SimpleSafetyTests). Click a column to sort; the best value per column is highlighted (false-alarm rates are not highlighted, because a model that flags nothing would win).
Disclosure: this page is maintained by Horizon Labs, which makes two of the listed models
(content-safety-guard). Qwen3Guard-Gen-8B was the teacher for our models' labels. The "macro" column is the plain mean F1 over
the 7 mixed benchmarks; it weights ToxicChat and the OpenAI set, where our models do well, as much as PolyGuard and XSTest,
where Qwen3Guard-0.6B is better, so read the individual columns too. Vela-Shield was trained on PolyGuardMix, so its PolyGuard
columns are in-distribution. BeaverTails "unseen" keeps only the 1,894 test items whose prompt is not in our training data
(BeaverTails and Aegis share HH red-team prompts). Toxicity classifiers (granite-guardian-hap, unitary) target a narrower task
and are included because they are often used for moderation. Qwen3Guard is scored from its next-token probabilities after
"Safety:" (strict = Unsafe or Controversial count as unsafe; loose = only Unsafe). Encoders other than ours receive the response
alone for response items. Eval code: code/safety/eval_safety.py and code/safety/build_safety_evals.py in
the model repo. Want a model added or
found a problem? Open a discussion on this Space.
Metrics: F1 of the unsafe class (false-alarm rate on safe items in the tooltip); recall on the two all-unsafe sets.