Llama Guard is Meta's open-weights content-safety classifier. You feed it the prompt and the model's response, and it outputs a label against a configurable harm taxonomy, categories like violent crimes, sexual content, self-harm, and so on. It is used as an input or output rail next to a larger generation model.
Llama Guard 3 was text-only. You could classify a chat turn, but if the input included an image, say, a screenshot containing a jailbreak instruction, or an image that itself depicted something harmful, Guard 3 saw nothing.
Llama Guard 4, released in 2026, is the multimodal version. It accepts image+text input and classifies both against the same harm categories. The motivation is that multimodal jailbreaks became the dominant attack vector once GPT-4o, Gemini, and Llama vision models went mainstream, attackers learned to put their payloads in images because text-side guardrails could not see them. Guard 4 closes that gap.
The other answer options, CPU performance, MCP hosting, IDE plugins, are not features of any Llama Guard release.
**Multimodal coverage** is the headline addition in Llama Guard 4.
Guard 3 was a text-in, text-out classifier, chat turns against a configurable harm taxonomy, with categories for violent crimes, sexual content, self-harm, weapons of mass destruction, code abuse, privacy, and others. The classifier output is a structured label plus optional category flags.
Guard 4 takes the same taxonomy and the same usage pattern and extends the input modality. It accepts image+text and classifies them jointly. The practical consequence is that an image carrying harmful content, depicted violence, exfiltrated PII in a screenshot, an embedded textual jailbreak rendered as pixels, is now classifiable against the same policy the text turn is.
The reason this matters is that multimodal injection became the practical bypass once production LLMs went multimodal. Attackers learned to embed instructions in images that text-side guardrails could not see, and a meaningful fraction of jailbreak attempts moved into the visual channel. Guard 4 was Meta's response to that gap. The other answer options, CPU speed, MCP hosting, IDE plugins, describe products in different domains.
Quick reference
TL;DR
Llama Guard 4 adds multimodal classification, images and text scored against the same harm taxonomy, closing the vision-injection gap Guard 3 had.
Picture a security scanner at an airport. The old version could read written notes inside a bag but not look at pictures or objects. So a smuggler could hide a forbidden item inside a photograph and walk through unchecked. The new scanner finally looks at both the writing and the images, judging them by the same rules. Llama Guard 3 was text-only, attackers found they could slip harmful instructions inside images that text-only classifiers never saw. Llama Guard 4 lifts the camera so the policy scanner sees the pictures too.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Your product is strictly text in, text out, with no image input or output anywhere in the pipeline Guard 3 covers the surface adequately and avoids the 2-4x cost and latency hit Guard 4 brings for image processing
You need a session-state safety monitor that tracks intent across many turns Guard 4 is single-turn; it will miss drip attacks that no individual turn would trigger on, and a different architecture is required
Your primary risk is indirect prompt injection through retrieved documents, not user-supplied content Content tagging and dual-LLM patterns address that risk; classifying the retrieved document with Guard 4 helps only marginally
Quick scan · 2–4 min
Everything important, quickly.
7 min: position Llama Guard in the rail pattern, contrast text-only Guard 3 with multimodal Guard 4, walk the multimodal-injection motivation, and cover cost, latency, and failure modes Guard 4 does not solve.
Real-world examples
Real products, models, and research that use this idea.
2AWS Bedrock Guardrails 2026 integrates Llama Guard 4 as one of its image-content policy options for multimodal Bedrock chats.
3Hugging Face Inference Endpoints offers a Guard 4 hosted endpoint for low-volume teams that do not want to self-host.
4Llama Guard 3 (2024) remains the right text-only choice for chat products that never accept image input.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you combine Guard 4 with a text-only fast classifier for cost?
Sign in or go Pro to see the approach for this follow-up.
QWhat if Guard 4 disagrees with the main model on whether the image is harmful?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Assuming a text-only safety classifier covers a multimodal app. The moment your product accepts image input, the text-only guard is blind to the dominant injection channel.