Introduction
Introduction
Llama Guard 4 (12B) is our latest safeguard model with improved inference for detecting problematic prompts and responses. It is designed to work with the Llama 4 line of models, such as Llama 4 Scout and Llama 4 Maverick.
Download the Model
Download Llama Guard 4.
Model Card
For comprehensive technical information about Llama Guard 4, please see the official model card, located on GitHub.
Architecture
Llama Guard 4 is a natively multimodal safeguard model. The model has 12 billion parameters in total and uses an early fusion transformer architecture with dense layers to keep the overall size small. The model can be run on a single GPU. Llama Guard 4 shares the same tokenizer and vision encoder as Llama 4 Scout and Maverick.
Llama Guard 4 and Llama 3
Llama Guard 4 is also compatible with the Llama 3 line of models and can be used as a drop-in replacement for Llama Guard 3 8B and 11B for both text-only and multimodal applications. However, Llama Guard 3 1B still holds value for specific use cases, such as deployment on edge devices.
Image Support
Llama Guard 4 evaluates both the prompt text and the image together in order to classify the prompt. It is not designed to perform image-only classification. Further, the model has been optimized for English-language text, so the text component of the prompt should be in English. For other languages, developers are expected to ensure that their deployments are tested and completed safely and responsibly.
Images that are submitted for evaluation should have the same format (resolution and aspect ratio) as the images that you submit to the Llama 4 models. Also, note that the model does not support the evaluation of images that were themselves created using generative AI technology.
You can evaluate images in multi-turn conversations, but you need to add the image token (see below) to the turn in which the image occurs.
Prompt format
Tokens
| Token | Description |
|---|---|
| `< | begin_of_text |
| `< | header_start |
| `< | eot |
Image Tokens
Note: These tokens are automatically populated when you run inference with images (reference code). Here they are shown just for your information.
We apply a dynamic image transformation strategy that divides the input image into 336×336 pixel tiles. Additionally, a global tile (created by resizing the entire input image to 336×336 pixels) is appended after the local tiles to provide a global view of the input image.
<|image_start|>...<|image_end|>: These tokens enclose the image data in the prompt.<|patch|>: These tokens represent subsets of the input image. Larger images have more patch tokens in the prompt.<|tile_y_separator|>...<|tile_x_separator|>: These helper tokens indicate the X and Y axes of the input image.<|image|>: This token separates the regular-sized image tokens from a downsized version of it that fits in a single tile.
Prompt Sections
A properly constructed Llama Guard prompt contains a number of sections, delimited by tags, such as
As the guardrails can be applied both on the input and output of the model, there are two different prompts: one for user input and the other for agent output. The role placeholder can have the values User or Agent; the former refers to the input and the latter to the output. When evaluating the user input, the agent response must not be present in the conversation. At the same time, when evaluating the agent response, both the user input and the agent response need to be present in the conversation; in this case, the user input provides important context for the evaluation.
The llama-cookbook repository has a helper function and an inference example that shows how to properly format the prompt with the provided categories. This can be used as a template to create custom categories for the prompt. You can also refer to the llama-stack GitHub repository that has reference implementations for input and output guardrails.