Identify what Llama Guard 4 adds over Llama Guard 3
Llama Guard 4 adds multimodal classification, images and text scored against the same harm taxonomy, closing the vision-injection gap Guard 3 had.
Picture a security scanner at an airport. The old version could read written notes inside a bag but not look at pictures or objects. So a smuggler could hide a forbidden item inside a photograph and walk through unchecked. The new scanner finally looks at both the writing and the images, judging them by the same rules. Llama Guard 3 was text-only, attackers found they could slip harmful instructions inside images that text-only classifiers never saw. Llama Guard 4 lifts the camera so the policy scanner sees the pictures too.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Llama Guard is the open-weights content classifier Meta ships alongside the Llama chat models. It is one of several layers a safety stack uses, and its specific job is to label a chat turn against a configurable harm taxonomy.
The 2024 release was text-only. By 2026, production LLMs were broadly multimodal, attackers had moved into the image channel, and Meta shipped Guard 4 with image+text input to close the visible gap. Knowing what changed, and what did not, is the difference between using Guard 4 correctly and assuming it solves more than it does.
Where Llama Guard sits in a safety stack
Llama Guard is a classifier, not a generator. You wrap it around your main model. On the input side, the user's prompt (plus any image) goes through Guard before reaching the generator; on the output side, the generator's response goes through Guard before reaching the user. Each call returns a label, safe or unsafe, and, when unsafe, the specific harm category that fired.
The taxonomy is configurable. The shipped defaults cover violent crimes, non-violent crimes, sexual content, child sexual exploitation, defamation, weapons of mass destruction, privacy, code abuse, intellectual property, and a few others. You can suppress categories you do not enforce or add custom ones for per-deployment policy (competitor mentions, regulated-industry language).
Guard is one of several layers. NeMo Guardrails handles flow-control and topical rails; OpenAI Moderation is OpenAI's hosted equivalent for their stack; Lakera Guard focuses on injection detection. Llama Guard's distinguishing properties are open weights, configurable taxonomy, and tight alignment with the Llama family.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- Meta Llama Guard 4 (2026), 8B vision-language safety classifier, configurable taxonomy, open weights.
- AWS Bedrock Guardrails 2026 integrates Llama Guard 4 as one of its image-content policy options for multimodal Bedrock chats.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you combine Guard 4 with a text-only fast classifier for cost?
Talk about the cascade pattern, cheap text classifier first, escalate to Guard 4 only when an image is attached or the cheap stage is uncertain.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Assuming a text-only safety classifier covers a multimodal app. The moment your product accepts image input, the text-only guard is blind to the dominant injection channel.
60 second bullets to scan on the way to the call.
Name the input modalities supported by Llama Guard 3 vs Guard 4
Recall at least three harm categories in the Llama Guard taxonomy
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.