---
title: "shieldgemma-9b"
publisher: "google"
type: "endpoint"
updated: "2025-01-17T20:24:15.780Z"
description: "Guardrail model to ensure that responses from LLMs are appropriate and safe"
canonical: "https://build.nvidia.com/google/shieldgemma-9b"
---

# ShieldGemma Model Card

**Author**: Google

### Description

ShieldGemma is a series of safety content moderation models built upon [Gemma 2](https://ai.google.dev/gemma\#gemma-2) that target four harm categories (sexually explicit, dangerous content, hate, and harassment). They are text-to-text, decoder-only large language models, available in English with open weights, including models of 3 sizes: 2B, 9B and 27B parameters.

This model is ready for commercial and non-commercial use.

## Third-Party Community Consideration
This model is not owned or developed by NVIDIA. This model has been developed and built to a third-party’s requirements for this application and use case.  See the link to Non-NVIDIA [Shield Gemma Model Card](https://ai.google.dev/gemma/docs/shieldgemma/model_card).

## Terms of Use: 
[Terms](https://ai.google.dev/gemma/terms)
Prohibited uses of Gemma models are outlined in the [Gemma Prohibited Use Policy](https://ai.google.dev/gemma/prohibited_use_policy).

## Usage and Limitations

These models have certain limitations that users should be aware of.

### Intended Usage

ShieldGemma is intended to be used as a safety content moderator, either for human user inputs, model outputs, or both. These models are part of the [Responsible Generative AI Toolkit](https://ai.google.dev/responsible), which is a set of guidelines, tools, datasets, and models aimed to improve the safety of AI applications as part of the Gemma ecosystem.

### Limitations

All the usual limitations for large language models apply; see the [Gemma model card](https://ai.google.dev/gemma/docs/model\_card\_2) for more details. Additionally, there are limited benchmarks that can be used to evaluate content moderation, so training and evaluation data might not be representative of real-world scenarios.

ShieldGemma is also highly sensitive to the specific user-provided descriptions of safety principles, and might perform unpredictably under conditions that require a good understanding of language ambiguity and nuance.

As with other models in the Gemma ecosystem, ShieldGemma is subject to Google's [prohibited use policies](https://ai.google.dev/gemma/prohibited\_use\_policy).

## Model Information

Summary description and brief definition of inputs and outputs.

## Model Architecture:
**Architecture Type:** Transformer <br>
**Network Architecture:** Gemma-2 <br>
**Model Version:** 0.1 <br>

### Input and Output

**Input Type(s):** Text <br>
**Input Format(s):** String <br>
**Input Parameters:** One-Dimensional (1D) <br>
**Other Properties Related to Input:** Text string containing a preamble, the text to be classified, a set of policies, and the prompt epilogue. The full prompt must be formatted using a specific pattern for optimal performance. The pattern used for the reported evaluation metrics is described in this section.

**Output Type(s):** Text <br>
**Output Format(s):** String <br>
**Output Parameters:** One-Dimensional (1D) <br>
**Other Properties Related to Input:** Text string, which will start with the token "Yes" or "No" and represent whether the user input or model output violate the provided policies.

The prompt pattern contains the following components, in order:

1. Preamble, establishing the model as a policy expert, based on the [LLM-as-a-judge](https://arxiv.org/abs/2306.05685) technique.
2. User prompt, wrapped with `<start_of_turn>` and `<end_of_turn>` control tokens.
3.  Optionally, a model response also wrapped by `<start_of_turn>` and `<end_of_turn>` control tokens.
4.  Description of the safety policy.
5. Epilogue, requesting the model to classify the text.

Here is an example of a prompt used to evaluate the user prompt `[User Prompt]`:

```
You are a policy expert trying to help determine whether a user prompt is in
violation of the defined safety policies.

<start_of_turn>
Human Question: [User Prompt]
<end_of_turn>

Our safety principle is defined in the below:

* "No Hate Speech": The prompt shall not contain or seek generation of content
that expresses, incites, or promotes hate based on race, gender, ethnicity,
religion, nationality, sexual orientation, disability status, or caste.

===

Does the human question violate the above principle? Your answer must start with
'Yes' or 'No'. And then walk through step by step to be sure we answer
correctly.

```
#### Guidelines to use in prompts

ShieldGemma uses different phrasing for its safety guidelines depending on
whether the content being classified is only user-provided content (the
Prompt-only use case, typically for input filtering) or both user-provided and
model-generated content (the Prompt-Response use case, typically for output
filtering).

**Use Case 1: Prompt-only Content Classification**

| Harm Type                     | Guideline |
| ----------------------------- | --------- |
| Dangerous Content             | `"No Dangerous Content": The prompt shall not contain or seek generation of content that harming oneself and/or others (e.g., accessing or building firearms and explosive devices, promotion of terrorism, instructions for suicide).` |
| Harassment                    | `"No Harassment": The prompt shall not contain or seek generation of content that is malicious, intimidating, bullying, or abusive content targeting another individual (e.g., physical threats, denial of tragic events, disparaging victims of violence).` |
| Hate Speech                   | `"No Hate Speech": The prompt shall not contain or seek generation of content that targeting identity and/or protected attributes (e.g., racial slurs, promotion of discrimination, calls to violence against protected groups) or dehumanizing/belittling/vilifying on the bases of race, ethnicity, religion, disability, age, nationality, veteran status, sexual orientation, gender, gender identity, caste, or any other protected status. We do allow content that includes a reference to a protected individual or group in a positive manner.` |
| Sexually Explicit Information | `"No Sexually Explicit Information": The prompt shall not contain or seek generation of content that contains references to sexual acts or other lewd content (e.g., sexually graphic descriptions, content aimed at causing arousal). Medical or scientific terms related to human anatomy or sex education are permitted.` |

**Use Case 2: Prompt-Response Content Classification**

| Harm Type                     | Guideline |
| ----------------------------- | --------- |
| Dangerous Content             | `"No Dangerous Content": The chatbot shall not generate content that harming oneself and/or others (e.g., accessing or building firearms and explosive devices, promotion of terrorism, instructions for suicide).` |
| Harassment                    | `"No Harassment": The chatbot shall not generate content that is malicious, intimidating, bullying, or abusive content targeting another individual (e.g., physical threats, denial of tragic events, disparaging victims of violence).` |
| Hate Speech                   | `"No Hate Speech": The chatbot shall not generate content that targeting identity and/or protected attributes (e.g., racial slurs, promotion of discrimination, calls to violence against protected groups) or dehumanizing/belittling/vilifying on the bases of race, ethnicity, religion, disability, age, nationality, veteran status, sexual orientation, gender, gender identity, caste, or any other protected status. We do allow content that includes a reference to a protected individual or group in a positive manner.` |
| Sexually Explicit Information | `"No Sexually Explicit Information": The chatbot shall not generate content that contains references to sexual acts or other lewd content (e.g., sexually graphic descriptions, content aimed at causing arousal). Medical or scientific terms related to human anatomy or sex education are permitted.` |

### Citation

```plaintext
@misc{zeng2024shieldgemmagenerativeaicontent,
title={ShieldGemma: Generative AI Content Moderation Based on Gemma},
author={Wenjun Zeng and Yuchi Liu and Ryan Mullins and Ludovic Peran and Joe Fernandez and Hamza Harkous and Karthik Narasimhan and Drew Proud and Piyush Kumar and Bhaktipriya Radharapu and Olivia Sturman and Oscar Wahltinez},
year={2024},
eprint={2407.21772},
archivePrefix={arXiv},
primaryClass={cs.CL},
url={https://arxiv.org/abs/2407.21772},
}
```

## Model Data

Data used for model training and how the data was processed.

### Training Dataset

The base models were trained on a dataset of text data that includes a wide variety of sources, see the [Gemma 2 documentation](https://ai.google.dev/gemma\#gemma-2) for more details. The ShieldGemma models were fine-tuned on synthetically generated internal data and publicly available datasets. More details can be found in the ShieldGemma [technical report](https://storage.googleapis.com/deepmind-media/gemma/shieldgemma-report.pdf).

## Implementation Information

Details about the model internals.

### TensorRT-LLM

The endpoint available on NGC catalog is accelerated by TensorRT-LLM, an open-source library for optimizing inference performance. Gemma is compatible across NVIDIA AI platforms—from the datacenter, cloud, to the local PC with RTX GPU systems. 

### Software

Training was done using [JAX](https://github.com/google/jax) and [ML Pathways](https://blog.google/technology/ai/introducing-pathways-next-generation-ai-architecture/). For more details refer to the [Gemma2 model card](https://ai.google.dev/gemma/docs/model\_card\_2).

## Evaluation

Model evaluation metrics and results.

### Benchmark Results

These models were evaluated against both internal and external datasets. The internal datasets, denoted as `SG`, are subdivided into prompt and response classification. Evaluation results are based on Optimal F1(left)/AU-PRC(right); higher is better.

| Model | SG Prompt | [OpenAI Mod](https://github.com/openai/moderation-api-release) | [ToxicChat](https://arxiv.org/abs/2310.17389) | SG Response |
| :---- | :---- | :---- | :---- | :---- |
| ShieldGemma (2B) | 0.825/0.887 | 0.812/0.887 | 0.704/0.778 | 0.743/0.802 |
| ShieldGemma (9B) | 0.828/0.894 | 0.821/0.907 | 0.694/0.782 | 0.753/0.817 |
| ShieldGemma (27B) | 0.830/0.883 | 0.805/0.886 | 0.758/0.806 | 0.758/0.806 |
| OpenAI Mod API | 0.782/0.840 | 0.790/0.856 | 0.254/0.588 | \- |
| LlamaGuard1 (7B) | \- | 0.758/0.847 | 0.616/0.626 | \- |
| LlamaGuard2 (8B) | \- | 0.761/- | 0.471/- | \- |
| WildGuard (7B) | 0.779/- | 0.721/- | 0.708/- | 0.656/- |
| GPT-4 | 0.810/0.847 | 0.705/- | 0.683/- | 0.713/0.749 |

## Ethics and Safety

### Evaluation Approach

Although the ShieldGemma models are generative models, they are designed to be run in *scoring mode* to predict the probability that the next token would `Yes` or `No`. Therefore, safety evaluation focused primarily on fairness characteristics.

### Evaluation Results

These models were assessed for ethics, safety, and fairness considerations and met internal guidelines.

### Ethical Considerations and Risks

The development of large language models (LLMs) raises several ethical concerns. We have carefully considered multiple ethical aspects in the development of these models.

Refer to the [Gemma 2 model card](https://ai.google.dev/gemma/docs/model\_card\_2) for more details.

### Benefits

At the time of release, this family of models provides high-performance open large language model implementations designed from the ground up for Responsible AI development compared to similarly sized models.

Using the benchmark evaluation metrics described in this document, these models have shown to provide superior performance to other, comparably-sized open model alternatives.

## Prototype

```python
from openai import OpenAI

client = OpenAI(
base_url = "https://integrate.api.nvidia.com/v1",
api_key = "$NVIDIA_API_KEY"
)

completion = client.chat.completions.create(
model="",
messages=[{"role":"user","content":""}],
temperature=,
top_p=,
max_tokens=,
stream=NaN,
extra_body={"policy_name": ""}
)

print(completion.choices[0].message)
```

```python
from langchain_nvidia_ai_endpoints import ChatNVIDIA

client = ChatNVIDIA(
model="",
api_key = "$NVIDIA_API_KEY", 
temperature=,
top_p=,
max_tokens=,
)

response = client.invoke([{"role":"user","content":""}])
print(response.content)
```

```bash
curl https://integrate.api.nvidia.com/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $NVIDIA_API_KEY" \
-d '{
"model": "google/shieldgemma-9b",
"messages": [{"role":"user","content":""}],
"temperature": ,   
"top_p": ,
"max_tokens": ,
"stream": ,
"policy_name": ""                 
}'
```