Qwen3Guard: open multilingual safety moderation model family
Qwen3Guard is an open multilingual safety moderation model family from Alibaba Cloud. It is open source under the Apache-2.0 license and is offered as: Self-hosted, Library.
Teams that need an open multilingual moderation model they can host, including one that scores tokens while a response is still being generated
Teams that want published per-benchmark F1 scores, in English, Chinese and multilingual sets, before choosing a guard model
Consider instead if
You want models that also check groundedness and function-calling errors, with a clear Apache-2.0 repository license.
See Granite Guardian.
Your categories do not fit a fixed taxonomy and you would rather write the policy yourself, at the cost of running a 20B or 120B reasoning model.
See gpt-oss-safeguard.
What Qwen3Guard does
Qwen3Guard is the Qwen team's open moderation model series from Alibaba Cloud, in 0.6B, 4B and 8B sizes. It works from a fixed taxonomy: each prompt or response gets Safe, Controversial or Unsafe plus a category, and you decide whether Controversial counts as unsafe, which the technical report calls strict and loose modes. The Stream variant labels tokens while a reply is still being generated, so a harmful answer can be flagged before it finishes. Response checks also report whether the model refused. The report's own limits section says adversarial prompts may get past it. If your categories do not fit its taxonomy, gpt-oss-safeguard takes a written policy instead. Hugging Face cards state Apache-2.0; the GitHub repository states no license. You run it on your own hardware.
This summary is our own wording of the sourced facts on this page.
Key facts
Each value links to the page that states it, with the date we checked it.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document.
How the model works.
AI security layers that Qwen3Guard covers, with the role, how each applies and what it rests on
Includes Jailbreak as an input-only safety category for prompts
Not mapped in our analysis: LLM02, LLM05, LLM07, LLM09, LLM10.
These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.
Routes LLM traffic through Kong with prompt guards, PII sanitization, spend limits and observability.
Best for: Teams that already run Kong as an API gateway and want LLM routing and prompt controls on the same data plane
65Coverage Score 65 out of 100
LLM01 Prompt Injection
LLM02 Sensitive Information Disclosure
LLM10 Unbounded Consumption
Reviewed
Qwen3Guard FAQ
What license does Qwen3Guard use?
The Hugging Face cards for the 8B Gen and Stream models state Apache-2.0. The GitHub repository has no LICENSE file and its README states no license, so check the model card for the size you use.
What is the difference between Gen and Stream?
Gen classifies a whole prompt or response. Stream adds a token-level head that scores text as it is generated, and it works best with models that share the Qwen3 tokenizer. In the technical report, Stream-8B averages 88.3 F1 on English prompts against 90.0 for Gen-8B.
What are strict and loose modes?
Every label is Safe, Controversial or Unsafe with a category such as violent, PII, self-harm, politically sensitive or copyright; Jailbreak applies to prompts only. Strict mode treats Controversial as unsafe and loose mode treats it as safe. On ToxicChat the 8B Gen model scores 68.9 F1 strict and 82.8 loose.
Can I compare its scores with gpt-oss-safeguard?
Only loosely. Both vendors report F1 on ToxicChat and the OpenAI Moderation set, but Qwen3Guard is scored against its own fixed taxonomy while gpt-oss-safeguard is given policies OpenAI wrote, and each figure is the vendor's own.
Key facts you can cite
Qwen3Guard is released under the Apache-2.0 license.
We have no commercial relationship with Alibaba Cloud.
Sources & last reviewed
Last reviewed . We compile from the vendors' own public
pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.