Meta-Llama-Guard-2-8B

Meta Llama Guard 2 is an 8-billion-parameter safeguard model built on the Llama 3 architecture and released by Meta on April 18, 2024 as part of the Purple Llama safety toolkit. Unlike general-purpose chat models, it is fine-tuned exclusively for content moderation: it classifies LLM prompts and responses as safe or unsafe, and when content is flagged it outputs the violated harm categories from the MLCommons AI Safety taxonomy (S1–S11, covering violent crimes, hate, self-harm, sexual content, privacy, intellectual property, and related hazards).

The model operates as a text-generation classifier. Developers wrap conversations in a structured prompt containing category definitions and the content to evaluate; Llama Guard 2 then emits "safe" or "unsafe" on the first line, with violated category codes on a second line if applicable. Binary decisions can also be derived from the first-token probability at a 0.5 threshold. On Meta's internal test set it achieves an F1 of 0.915 and AUPRC of 0.974, substantially outperforming the original Llama Guard (F1 0.665) and commercial moderation APIs such as OpenAI Moderation and Azure Content Safety, while maintaining a low false-positive rate to avoid over-moderation in production applications.

Llama Guard 2 is distributed as open weights under the Meta Llama 3 Community License and is intended to be deployed as an inference-time filter in front of other LLMs rather than used for open-ended conversation. Key limitations include policy-specific training (performance varies when evaluated against datasets with different safety definitions), susceptibility to adversarial prompt injection, and no coverage of MLCommons Election or Defamation categories, which require external fact-checking or retrieval-augmented approaches.