Low Guardrail Models: Why Makers Ship Safety Separately

Low guardrail models are open-weight models released with little refusal built into the base weights, and with safety offered as a separate component that you can attach or leave off. Major makers such as Meta, Google and Mistral publish them, as do community developers who modify weights after the fact.

Attach the safety component and you get a service that blocks dangerous content as usual. Leave it off and you get a raw model for research. Because the choice is left to the user, "how much safety to stack on" becomes a part you can select.

---

How does building low guardrails differ from removing them?#

The difference is the order of steps. Removal methods such as abliteration start from a model whose refusals are already baked into its weights and cut them out afterward. Major makers' designs never stack heavy refusals into the base model in the first place, and they put the safety judgment outside it as a separate component.

Abliteration removes the direction in the weights that produces refusals. A standard model has the "decline" behavior burned into its weights (the learned numerical data) during post-training, and abliteration finds that structure and deletes it directly. It is a procedure for taking off something that was piled on thickly.

The big makers' design is the reverse. The base model carries only a thin layer of refusal, and the safety check sits outside it, so there is nothing to remove in the first place.

Three terms matter here:

• Model weights: the learned numerical data that makes up the model's "brain." The tendency to decline is stored here too.
• Moderation / guardrails: a separate mechanism that inspects inputs and outputs and blocks what it judges dangerous. It is an inspector placed outside the base model.
• System prompt: the role and rules handed to the model before a conversation starts.

A "thin" refusal layer does not mean the model is defenseless. A low guardrail model is one whose safety mechanism is left in an attachable state. With a guardrail attached it behaves like a normal service that blocks danger, and without one it is a raw model for research.

Type 1, decoupled: why are the model and its safety separate components?#

In the decoupled type, the base model stays close to raw and safety is offered as separate models or services. Meta is the main example: alongside Llama it publishes Llama Guard 4, a 12B multimodal safety classifier. Whether to attach it, and what counts as dangerous, is up to the user.

Llama Guard 4 is built from Llama 4 Scout and tuned to the MLCommons hazard taxonomy. It judges text and image inputs and outputs as safe or unsafe, and it is also available through the /moderations endpoint of the Llama API. Meta adds Prompt Guard 2, which detects prompt attacks (malicious instructions slipped into a prompt), and LlamaFirewall, which coordinates these guards, and packages them as "Llama Protections."

Other makers point the same way:

• Google ShieldGemma: a safety classifier derived from Gemma 2, in 2B, 9B and 27B sizes. Its published internal prompt-classification Optimal F1 score (a measure of judgment accuracy) is about 0.83.
• Mistral Shieldstral 1.0: a 3.8B model released on August 4, 2026 under Apache 2.0. It takes a policy as a natural-language question and returns a continuous yes/no probability, with no fixed categories. It is self-host only and is not offered through Mistral's API.
• Others: Alibaba's Qwen3Guard-8B, OpenAI's open-weight safety model GPT-OSS-Safeguard-20B, and NVIDIA's Nemotron-3.5-Content-Safety-4B.

NVIDIA's Llama Nemotron Safety Guard Permissive goes a step further. It treats "Needs Caution" verdicts from the safety classifier as Safe, so a permissive setting ships as an official product. That makes it an example of low guardrail operation being distributed as a product category.

Type 2, raw weights with a policy applied at use: how does Mistral let developers set moderation?#

Mistral leaves the choice of applying a filter to the user. Its base models are open weights, and its Studio platform lets you set a 0-to-1 threshold for each moderation category, where 1 explicitly disables that category. If you configure nothing, the model simply responds.

Where type 1 was "a raw base model with safety as a separate part," this type goes one step further: it provides the separate part and also leaves the decision to use it to the user. The foundation is open weights, meaning the trained numerical data is published. According to Mistral's 2026 documentation, the current lineup is:

• Mistral Small 4 (Apache 2.0, released March 2026)
• Mistral Large 3 (Apache 2.0, released December 2025)
• Ministral 3 in 14B, 8B and 3B (Apache 2.0, released December 2025)
• Mistral Medium 3.5 (Modified MIT, released April 2026)

Behavior is also left to the user. The model card for Mistral Small 3.2 says a system prompt must be supplied, and it recommends the SYSTEM_PROMPT.txt shipped with the model for general assistant use. Even the default for "how to behave" is prepared by the user rather than fixed by the maker.

On the platform side, Studio has a "Moderation & Guardrailing" feature. With custom guardrails you declare rules per request and give each category a threshold from 0 to 1, a scale for how strict the judgment is. A threshold of 1 explicitly disables the category.

The check runs on the input only, before the request reaches the model, and a violation returns a 403 (a response that denies the request). The check is done by a dedicated mechanism, mistral-moderation-2603. The safety device sits outside the base model, and its strength, including switching it off, is set by the user.

Type 3, same weights, different operation: what changes when someone else runs DeepSeek?#

The same weights can behave differently depending on who runs them. DeepSeek publishes its weights under the MIT license, so self-hosting can skip any refusal layer. Yet in a January 2025 Promptfoo test, DeepSeek's own service refused or evaded about 85% of politically sensitive prompts.

The V4-Pro model is a 1.6-trillion-parameter MoE (a structure with many specialist parts, of which only 49B parameters are active per token). V4.1-Flash is a 552B multimodal MoE with 8 to 16B active. If you self-host the published weights, you can run them without a refusal layer. Some outside providers do exactly that on their own GPUs and offer the model with no refusal layer and no output filter. So far this matches types 1 and 2.

DeepSeek's own service was different. In the January 2025 Promptfoo study of DeepSeek-R1, about 85% (1,156) of 1,360 politically sensitive questions ended in a refusal or an evasion. A notable feature was that fixed refusal text overwrote the reasoning, the thought process that leads to an answer. Two further points were reported: on sensitive topics the reasoning trace stops soon after it starts, and, according to Ars Technica, the same question can get different answers from run to run.

Academic research points the same way. A May 2025 paper (arXiv 2505.12625) analyzed R1's "local censorship" with about 10,030 prompts. It found that the censorship tendency does not transfer completely through distillation (training a smaller model), and that simple jailbreaks such as rewording and repetition bypassed it in up to 97.86% of cases.

These facts show that refusals come in two kinds:

• Refusals baked into the weights: behavior that soaked into the weights themselves through training.
• Moderation at the serving layer: a classifier separate from the base model that inspects inputs and outputs and blocks them.

DeepSeek's own service has a thick serving layer, while the published weights carry a thin baked-in layer. That difference is what showed up in the measurements. Refusal is therefore shaped by both the model and whoever decides how many layers to place where.

How can you tell the three types apart? What should you check?#

Will official low guardrail models continue in this form?#

Not necessarily. Community modifiers say Google is starting to adopt a method close to NVIDIA's GenRM, which uses a generative reward model as an "internal critic." A reward model is a second model that scores the output of the first. In this design the reward model makes the decision to refuse or answer inside the model, at every generation.

The change amounts to spreading refusal out. Abliteration worked because a conventional model's refusal was etched fairly compactly inside the weights. The modifiers' view is that when the decision is handed to an internal critic, simple abliteration will become less effective.

Whichever of the three types a model belongs to, an official low guardrail can change shape with the maker's policy. That is why it matters whether the weights are public and anyone can check what is inside. For running models yourself, see our local LLM guide and our overview of uncensored models.

What is Deepent Research?#

Deepent Research is a browser-accessible LLM chat service built to refuse as little as possible. It keeps going with research that a standard AI would cut off mid-answer.

• It refuses nothing. We run uncensored and abliterated models with guardrails reduced as far as possible, so prompts a standard AI answers with "I can't help with that" still get a response (Qwen3.5 / Qwen3.8-27B-abliterated, depending on your plan).
• Your input is never used for training. What you look up is used only to provide the service, never to train AI or for any other purpose. Personal data is protected, and our privacy policy is public.
• Try it free. No GPU and no install, just open a browser. In the logged-out trial your conversation isn't saved, so you can start casually.

→ Try it free, no sign-up: https://deepentresearch.com

No question can stop research.

Frequently asked questions#

Does "low guardrails" mean a model has no protection?#

⌄

No. A low guardrail model is released with its safety mechanism left attachable rather than fused into the base weights. If you attach a classifier such as Llama Guard, the model runs as a service that blocks dangerous content as usual. If you leave it off, you get a raw model for research. The choice sits with the user.

Can moderation or guardrails be turned off afterward?#

⌄

It depends on the platform. In Mistral's custom guardrails, you set a threshold from 0 to 1 for each category, and setting it to 1 explicitly disables that category. The check runs on the input before the request reaches the model, and if you configure nothing, the model responds as it is.

Why does it matter whether a model is open-weight?#

⌄

When the weights are public, you or a third party can test the model's behavior directly. You do not have to rely only on the operator's description or on outside test reports. Mistral and DeepSeek both publish their weights, so both can be checked this way, which is the main value of open weights when you are choosing a model.

Why does the same model refuse on one service but answer on another?#

⌄

Refusals come from two places: those baked into the weights, and moderation layers added by the operator. Two services can run the same weights and still differ, because each decides where to place its layers and how strong to make them. DeepSeek's own service versus its published weights is the measured example.

Disclaimer#

This article was drafted with AI assistance and then reviewed, fact-checked, and edited by the Deepent Research team before publication.
It is provided for educational and research purposes and is not intended to encourage unlawful activity or crime.
Where figures are cited, they come from third-party public reports and vendor-published values and may vary with measurement conditions.