Granite Guardian

Every call pairs a conversation with one criterion. The model answers yes or no, and in thinking mode it also writes out its reasoning. The criteria below are built in. Since 4.1, users can also write their own.

Granite Guardian is fine-tuned from the Granite base model on human-annotated data combined with synthetic data informed by internal red-teaming. Additional synthetic data improves hallucination and jailbreak assessment.

The clearest measure of what training contributes is the comparison with prompting the same base model. On IFEval multi-constraint checks, the base Granite 4.1 8B reaches 0.569 balanced accuracy when prompted as a judge. Granite Guardian 4.1 8B reaches 0.844.

The model runs in two modes. No-think returns the verdict directly for low latency. Think produces a reasoning trace first, for cases where the justification matters more than speed.

A judge, not a classifier

Guardian is fine-tuned to answer with a yes or no token and its probability, instead of a classification head on top of the base model. That kept the whole language model in play. It is what later let 4.1 take criteria it had never seen and serve as a reward model.

Criteria at runtime

4.1 moved from a fixed risk taxonomy to criteria written in the request. Out-of-distribution safety F1 slipped from 0.81 to 0.79; IFEval multi-constraint checking went from 0.458 to 0.844. The trade was the point: a judge that applies the user’s rule beats a classifier that applies ours.

A reasoning mode from the same weights

Think mode writes its justification before the verdict. It costs latency, 59 ms to 1.3 s on the Artificial Analysis benchmark, and buys three things: a justification where one is needed, a way to see why a custom criterion misfires and tighten its wording, and a trace for debugging verdicts in production.

In June 2026 Artificial Analysis, in partnership with NVIDIA, scored twenty guardrail configurations from seven vendors on 7,232 prompts drawn from WildGuardTest, ToxicChat and XSTest. Models that take a policy at runtime, Granite Guardian among them, were all given the same broad safety policy, written by Artificial Analysis and not tuned per dataset.

Average F1

0.859

Fifth of 20, within 0.03 of the leader

Among policy-at-runtime models

First

Ahead of gpt-oss-safeguard 20B and 120B and ShieldGemma 9B

Average latency

59 ms

No-think mode

Benign prompts passed

91.4%

Second among the top five

Thinking mode costs about 1.3 seconds per check and scores 0.832 on F1, below the no-think mode. On this task, thinking adds an explanation but does not improve accuracy.

Read the full results at Artificial Analysis.

The 4.1 release turned a safety classifier into a general judge. Custom-criteria accuracy rose sharply and tool-call checking improved, while groundedness held level and out-of-distribution safety dipped slightly.

Both versions in no-think mode. Source: Granite Guardian 4.1 8B model card.

As a reward model

The same verdicts can rank candidate responses. On the verifiable tasks in the JETTS benchmark, which cover math, code and instruction following, Granite Guardian 4.1 8B selects better answers than every reward model it was compared with.

Best-of-N selection, no-think mode. An oracle selector scores 81.54.