# Llama Guard 3-8B Model Card
## Model Details
Llama Guard 3-8B is a Llama-3.1-8B pretrained model, fine-tuned for content safety classification. Similar to previous versions, it can be used to classify content in both LLM inputs (prompt classification) and in LLM responses (response classification). It acts as an LLM – it generates text in its output that indicates whether a given prompt or response is safe or unsafe, and if unsafe, it also lists the content categories violated.
Llama Guard 3 was aligned to safeguard against the MLCommons standardized hazards taxonomy and designed to support Llama 3.1 capabilities. Specifically, it provides content moderation in 8 languages, and was optimized to support safety and security for search and code interpreter tool calls.
Below is a response classification example for Llama Guard 3.
In order to produce classifier scores, we look at the probability for the first token, and use that as the “unsafe” class probability. We can then apply score thresholding to make binary decisions.
## Get started
Once you have access to the model weights, please refer to our [documentation](https://www.llama.com/docs/model-cards-and-prompt-formats/llama-guard-3/) to get started.
## Hazard Taxonomy and Policy
The model is trained to predict safety labels on the 14 categories shown below, based on the [MLCommons taxonomy](https://mlcommons.org/2024/04/mlc-aisafety-v0-5-poc/) of 13 hazards, as well as an additional category for Code Interpreter Abuse for tool calls use cases.
| Hazard categories |
| S1: Violent Crimes |
S2: Non-Violent Crimes |
| S3: Sex-Related Crimes |
S4: Child Sexual Exploitation |
| S5: Defamation |
S6: Specialized Advice |
| S7: Privacy |
S8: Intellectual Property |
| S9: Indiscriminate Weapons |
S10: Hate |
| S11: Suicide & Self-Harm |
S12: Sexual Content |
| S13: Elections |
S14: Code Interpreter Abuse |
**S1 - Violent Crimes**
Responses that enable, encourage, or endorse the commission of violent crimes, including: (1) unlawful violence toward people (ex: terrorism, genocide, murder, hate-motivated violent crimes, child abuse, assault, battery, kidnapping) and (2) unlawful violence toward animals (ex: animal abuse)
**S2 - Non-Violent Crimes**
Responses that enable, encourage, or endorse the commission of non-violent crimes, including: (1) personal crimes (ex: labor trafficking, threats, intimidation, hate-motivated non-violent crimes), (2) financial crimes (ex: fraud, scams, money laundering), (3) property crimes (ex: theft, arson, vandalism), (4) drug crimes (ex: creating or using regulated substances), (5) weapons crimes (ex: producing unlicensed firearms), and (6) cyber crimes (ex: hacking)
**S3 - Sex-Related Crimes**
Responses that enable, encourage, or endorse the commission of sex-related crimes, including: (1) sex trafficking, (2) sexual assault (ex: rape), (3) sexual harassment (physical, verbal, or visual), and (4) prostitution
**S4 - Child Sexual Exploitation**
Responses that contain, describe, enable, encourage, or endorse the sexual abuse of children
**S5 - Defamation**
Responses that are both verifiably false and likely to injure a living person’s reputation
**S6 - Specialized Advice**
Responses that contain specialized financial, medical, or legal advice, or that indicate dangerous activities or objects are safe
**S7 - Privacy**
Responses that contain sensitive, nonpublic personal information that could undermine someone’s physical, digital, or financial security
**S8 - Intellectual Property**
Responses that may violate the intellectual property rights of any third party
**S9 - Indiscriminate Weapons**
Responses that enable, encourage, or endorse the creation of indiscriminate weapons, including: (1) chemical weapons (ex: nerve gas), (2) biological weapons (ex: anthrax), (3) radiological weapons (ex: cobalt bombs), (4) nuclear weapons (ex: fission bombs), and (5) high-yield explosive weapons (ex: cluster munitions)
**S10 - Hate**
Responses that demean or dehumanize people on the basis of their sensitive, personal characteristics (i.e., race, color, ethnicity, national origin, disability, religious affiliation, caste, sexual orientation, sex, gender identity, and/or serious disease)
**S11 - Suicide & Self-Harm**
Responses that enable, encourage, or endorse acts of intentional self-harm, including: (1) suicide, (2) self-injury (ex: cutting), and (3) disordered eating
**S12 - Sexual Content**
Responses that contain erotica
**S13 - Elections**
Responses that contain factually incorrect information about electoral systems and processes, including in the time, place, or manner of voting in civic elections
**S14 - Code Interpreter Abuse**
Responses that seek to abuse code interpreters, including those that enable denial of service attacks, container escapes or privilege escalation exploits
## Supported languages
Llama Guard 3 supports content safety for the following languages : English, French, German, Hindi, Italian, Portuguese, Spanish, Thai.
## Training Data
We use the English data used by Llama Guard [1], which are obtained by getting Llama 2 and Llama 3 generations on prompts from the hh-rlhf dataset [2]. In order to scale training data for new categories and new capabilities such as multilingual and tool use, we collect additional human and synthetically generated data. Similar to the English data, the multilingual data are Human-AI conversation data that are either single-turn or multi-turn. To reduce the model’s false positive rate, we curate a set of multilingual benign prompt and response data where LLMs likely reject the prompts.
For the tool use capability, we consider search tool calls and code interpreter abuse. To develop training data for search tool use, we use Llama3 to generate responses to a collected and synthetic set of prompts. The generations are based on the query results obtained from the Brave Search API. To develop synthetic training data to detect code interpreter attacks, we use an LLM to generate safe and unsafe prompts. Then, we use a non-safety-tuned LLM to generate code interpreter completions that comply with these instructions. For safe data, we focus on data close to the boundary of what would be considered unsafe, to minimize false positives on such borderline examples.
## Evaluation
**Note on evaluations:** As discussed in the original Llama Guard paper, comparing model performance is not straightforward as each model is built on its own policy and is expected to perform better on an evaluation dataset with a policy aligned to the model. This highlights the need for industry standards. By aligning the Llama Guard family of models with the Proof of Concept MLCommons taxonomy of hazards, we hope to drive adoption of industry standards like this and facilitate collaboration and transparency in the LLM safety and content evaluation space.
In this regard, we evaluate the performance of Llama Guard 3 on MLCommons hazard taxonomy and compare it across languages with Llama Guard 2 [3] on our internal test. We also add GPT4 as baseline with zero-shot prompting using MLCommons hazard taxonomy.
Tables 1, 2, and 3 show that Llama Guard 3 improves over Llama Guard 2 and outperforms GPT4 in English, multilingual, and tool use capabilities. Noteworthily, Llama Guard 3 achieves better performance with much lower false positive rates. We also benchmark Llama Guard 3 in the OSS dataset XSTest [4] and observe that it achieves the same F1 score but a lower false positive rate compared to Llama Guard 2.
Table 1: Comparison of performance of various models measured on our internal English test set for MLCommons hazard taxonomy (response classification).
| | **F1 ↑** | **AUPRC ↑** | **False Positive
Rate ↓** |
|--------------------------|:--------:|:-----------:|:----------------------------:|
| Llama Guard 2 | 0.877 | 0.927 | 0.081 |
| Llama Guard 3 | 0.939 | 0.985 | 0.040 |
| GPT4 | 0.805 | N/A | 0.152 |
Table 2: Comparison of multilingual performance of various models measured on our internal test set for MLCommons hazard taxonomy (prompt+response classification).
| F1 ↑ / FPR ↓ |
|
French |
German |
Hindi |
Italian |
Portuguese |
Spanish |
Thai |
| Llama Guard 2 |
0.911/0.012 |
0.795/0.062 |
0.832/0.062 |
0.681/0.039 |
0.845/0.032 |
0.876/0.001 |
0.822/0.078 |
| Llama Guard 3 |
0.943/0.036 |
0.877/0.032 |
0.871/0.050 |
0.873/0.038 |
0.860/0.060 |
0.875/0.023 |
0.834/0.030 |
| GPT4 |
0.795/0.157 |
0.691/0.123 |
0.709/0.206 |
0.753/0.204 |
0.738/0.207 |
0.711/0.169 |
0.688/0.168 |
Table 3: Comparison of performance of various models measured on our internal test set for other moderation capabilities (prompt+response classification).
|
Search tool calls |
Code interpreter abuse |
|
F1 ↑ |
AUPRC ↑ |
FPR ↓ |
F1 ↑ |
AUPRC ↑ |
FPR ↓ |
| Llama Guard 2 |
0.749 |
0.794 |
0.284 |
0.683 |
0.677 |
0.670 |
| Llama Guard 3 |
0.856 |
0.938 |
0.174 |
0.885 |
0.967 |
0.125 |
| GPT4 |
0.732 |
N/A |
0.525 |
0.636 |
N/A |
0.90 |
## Application
As outlined in the Llama 3 paper, Llama Guard 3 provides industry leading system-level safety performance and is recommended to be deployed along with Llama 3.1. Note that, while deploying Llama Guard 3 will likely improve the safety of your system, it might increase refusals to benign prompts (False Positives). Violation rate improvement and impact on false positives as measured on internal benchmarks are provided in the Llama 3 paper.
## Quantization
We are committed to help the community deploy Llama systems responsibly. We provide a quantized version of Llama Guard 3 to lower the deployment cost. We used int 8 [implementation](https://huggingface.co/docs/transformers/main/en/quantization/bitsandbytes) integrated into the hugging face ecosystem, reducing the checkpoint size by about 40% with very small impact on model performance. In Table 5, we observe that the performance quantized model is comparable to the original model.
Table 5: Impact of quantization on Llama Guard 3 performance.
Task
|
Capability
|
Non-Quantized
|
Quantized
|
|
Precision
|
Recall
|
F1
|
FPR
|
Precision
|
Recall
|
F1
|
FPR
|
|
Prompt Classification
|
English
|
0.952
|
0.943
|
0.947
|
0.057
|
0.961
|
0.939
|
0.950
|
0.045
|
|
Multilingual
|
0.901
|
0.899
|
0.900
|
0.054
|
0.906
|
0.892
|
0.899
|
0.051
|
|
Tool Use
|
0.884
|
0.958
|
0.920
|
0.126
|
0.876
|
0.946
|
0.909
|
0.134
|
|
Response Classification
|
English
|
0.947
|
0.931
|
0.939
|
0.040
|
0.947
|
0.925
|
0.936
|
0.040
|
|
Multilingual
|
0.929
|
0.805
|
0.862
|
0.033
|
0.931
|
0.785
|
0.851
|
0.031
|
|
Tool Use
|
0.774
|
0.884
|
0.825
|
0.176
|
0.793
|
0.865
|
0.827
|
0.155
|
## Get started
Llama Guard 3 is available by default in Llama 3.1 [reference implementations](https://github.com/meta-llama/llama-agentic-system). You can learn more about how to configure and customize using [Llama Recipes](https://github.com/meta-llama/llama-recipes/tree/main/recipes/responsible_ai/) shared on our Github repository.
## Limitations
There are some limitations associated with Llama Guard 3. First, Llama Guard 3 itself is an LLM fine-tuned on Llama 3.1. Thus, its performance (e.g., judgments that need common sense knowledge, multilingual capability, and policy coverage) might be limited by its (pre-)training data.
Some hazard categories may require factual, up-to-date knowledge to be evaluated (for example, S5: Defamation, S8: Intellectual Property, and S13: Elections) . We believe more complex systems should be deployed to accurately moderate these categories for use cases highly sensitive to these types of hazards, but Llama Guard 3 provides a good baseline for generic use cases.
Lastly, as an LLM, Llama Guard 3 may be susceptible to adversarial attacks or prompt injection attacks that could bypass or alter its intended use. Please feel free to [report](https://github.com/meta-llama/PurpleLlama) vulnerabilities and we will look to incorporate improvements in future versions of Llama Guard.
## Citation
```
@misc{dubey2024llama3herdmodels,
title = {The Llama 3 Herd of Models},
author = {Llama Team, AI @ Meta},
year = {2024}
eprint = {2407.21783},
archivePrefix = {arXiv},
primaryClass = {cs.AI},
url = {https://arxiv.org/abs/2407.21783}
}
```
## References
[1] [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://arxiv.org/abs/2312.06674)
[2] [Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback](https://arxiv.org/abs/2204.05862)
[3] [Llama Guard 2 Model Card](https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard2/MODEL_CARD.md)
[4] [XSTest: A Test Suite for Identifying Exaggerated Safety Behaviors in Large Language Models](https://arxiv.org/abs/2308.01263)