Llama Guard 4 12B is Meta's natively multimodal safety classifier with 12 billion parameters. It is trained jointly on text and multiple images and generates a textual classification: safe or unsafe, with violated hazard categories when the result is unsafe. Its purpose is evaluating content in a prompt or generated response rather than acting as a general chat assistant.
Prompt and response classification
The model can classify material before it is sent to a generative model, after that model produces an answer, or at both points. These are different questions. Prompt classification evaluates the user's input, while response classification evaluates what an assistant actually wrote. A system can therefore distinguish a risky request from a response that handles the request in an acceptable way under the classifier's taxonomy.
Supply the exact content to classify with the conversation roles and relevant context. If the target is a response, retain the question that gives the response its meaning. For a mixed text-and-image input, include the images associated with that prompt rather than classifying unrelated text or one arbitrarily selected image. The classifier result is information for the application's rule or review step; it does not itself block a request or change a file.
Fourteen hazard categories
The maker aligns the classifier with the MLCommons hazard taxonomy and adds a text-only code-interpreter category. The fourteen labels cover violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialized advice, privacy, intellectual property, indiscriminate weapons, hate, suicide and self-harm, sexual content, elections and code interpreter abuse.
The categories use identifiers S1 through S14. S14, Code Interpreter Abuse, is specifically for text-only tool-call use cases. Keep the taxonomy identifier with the safe/unsafe result so a later application step can interpret the classification under the same category definitions. A short result is a category judgment, not a full explanation, legal determination or guarantee that every possible harm has been detected.
For an illustrative format, an unsafe classification can be followed by the applicable category identifier. Retain the original evaluated text, its source or conversation position and the returned labels together. That association lets an application distinguish the content examined from a subsequent rewritten response or a separate prompt.
Architecture and training
Llama Guard 4 has a dense early-fusion Transformer architecture, pruned from a pretrained Llama 4 Scout checkpoint. The maker removes routed experts and router layers and retains the shared dense expert, then post-trains the resulting model for content classification. It performs no additional pretraining after that pruning step. This creates a different model from Scout's mixture-of-experts chat edition.
The model shares the Llama 4 tokenizer and vision encoder and combines text-only and multimodal classification training. The maker describes multilingual data and multi-image training, with most such samples containing two to five images and an approximate three-to-one blend of text-only to multimodal data. Those are training characteristics, not hard input-count limits.
The documented multilingual scope follows the languages supported by Llama Guard 3, and the card discusses English together with French, German, Hindi, Italian, Portuguese, Spanish and Thai. A classification request should preserve the actual wording and visual context in the language being evaluated rather than replacing the content with an unrelated summary.
Preparing a useful classification result
For an input check, provide the user's message and its associated images and ask for the prompt classification in the maker's format. For an output check, provide the assistant's actual response together with the relevant prior message. A multi-image example can retain the text linking the images so the model evaluates the combined request rather than independent fragments without context.
The model card demonstrates applying the matching conversation template and decoding only the generated classification. Its ten-token generation example illustrates a short label result; that number is not a separate maximum answer capacity. Keep the requested output aligned with the classifier's purpose instead of asking it to write an ordinary conversational answer.
Specific limitations
The maker states that judgments may be limited by the model's training data, common-sense knowledge, language coverage and policy coverage. Defamation, intellectual property and election-related categories can require factual, current knowledge that the classifier may not possess. The category label should therefore retain its relationship to the content and the information available for that evaluation.
The card reports testing mostly on prompts with a few images, most often three, and notes that behavior may vary with a much larger image collection. This describes the tested scope rather than a universal three-image maximum. The model can also be susceptible to adversarial or prompt-injection content that changes its intended behavior.
Llama Guard 4's classifier role should not inherit Scout's context specification or general assistant capabilities merely because it was pruned from Scout. The card read does not give a separate hard context or output-token capacity for this classifier. Preserve the evaluated material and taxonomy labels as the practical artifact, and let the application decide the action associated with that result.
", "aboutText": "Llama Guard 4 12B is Meta's natively multimodal safety classifier with 12 billion parameters. It is trained jointly on text and multiple images and generates a textual classification: safe or unsafe, with violated hazard categories when the result is unsafe. Its purpose is evaluating content in a prompt or generated response rather than acting as a general chat assistant.\n\nPrompt and response classification\n\nThe model can classify material before it is sent to a generative model, after that model produces an answer, or at both points. These are different questions. Prompt classification evaluates the user's input, while response classification evaluates what an assistant actually wrote. A system can therefore distinguish a risky request from a response that handles the request in an acceptable way under the classifier's taxonomy.\n\nSupply the exact content to classify with the conversation roles and relevant context. If the target is a response, retain the question that gives the response its meaning. For a mixed text-and-image input, include the images associated with that prompt rather than classifying unrelated text or one arbitrarily selected image. The classifier result is information for the application's rule or review step; it does not itself block a request or change a file.\n\nFourteen hazard categories\n\nThe maker aligns the classifier with the MLCommons hazard taxonomy and adds a text-only code-interpreter category. The fourteen labels cover violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialized advice, privacy, intellectual property, indiscriminate weapons, hate, suicide and self-harm, sexual content, elections and code interpreter abuse.\n\nThe categories use identifiers S1 through S14. S14, Code Interpreter Abuse, is specifically for text-only tool-call use cases. Keep the taxonomy identifier with the safe/unsafe result so a later application step can interpret the classification under the same category definitions. A short result is a category judgment, not a full explanation, legal determination or guarantee that every possible harm has been detected.\n\nFor an illustrative format, an unsafe classification can be followed by the applicable category identifier. Retain the original evaluated text, its source or conversation position and the returned labels together. That association lets an application distinguish the content examined from a subsequent rewritten response or a separate prompt.\n\nArchitecture and training\n\nLlama Guard 4 has a dense early-fusion Transformer architecture, pruned from a pretrained Llama 4 Scout checkpoint. The maker removes routed experts and router layers and retains the shared dense expert, then post-trains the resulting model for content classification. It performs no additional pretraining after that pruning step. This creates a different model from Scout's mixture-of-experts chat edition.\n\nThe model shares the Llama 4 tokenizer and vision encoder and combines text-only and multimodal classification training. The maker describes multilingual data and multi-image training, with most such samples containing two to five images and an approximate three-to-one blend of text-only to multimodal data. Those are training characteristics, not hard input-count limits.\n\nThe documented multilingual scope follows the languages supported by Llama Guard 3, and the card discusses English together with French, German, Hindi, Italian, Portuguese, Spanish and Thai. A classification request should preserve the actual wording and visual context in the language being evaluated rather than replacing the content with an unrelated summary.\n\nPreparing a useful classification result\n\nFor an input check, provide the user's message and its associated images and ask for the prompt classification in the maker's format. For an output check, provide the assistant's actual response together with the relevant prior message. A multi-image example can retain the text linking the images so the model evaluates the combined request rather than independent fragments without context.\n\nThe model card demonstrates applying the matching conversation template and decoding only the generated classification. Its ten-token generation example illustrates a short label result; that number is not a separate maximum answer capacity. Keep the requested output aligned with the classifier's purpose instead of asking it to write an ordinary conversational answer.\n\nSpecific limitations\n\nThe maker states that judgments may be limited by the model's training data, common-sense knowledge, language coverage and policy coverage. Defamation, intellectual property and election-related categories can require factual, current knowledge that the classifier may not possess. The category label should therefore retain its relationship to the content and the information available for that evaluation.\n\nThe card reports testing mostly on prompts with a few images, most often three, and notes that behavior may vary with a much larger image collection. This describes the tested scope rather than a universal three-image maximum. The model can also be susceptible to adversarial or prompt-injection content that changes its intended behavior.\n\nLlama Guard 4's classifier role should not inherit Scout's context specification or general assistant capabilities merely because it was pruned from Scout. The card read does not give a separate hard context or output-token capacity for this classifier. Preserve the evaluated material and taxonomy labels as the practical artifact, and let the application decide the action associated with that result.", "editorialOverlay": { "copy_fields": { "practical_html": "Technical example in English
Classify a benign library prompt\n\nClassify this user prompt using Llama Guard 4's prompt-safety taxonomy: 'Summarize the public library opening hours from the notice I pasted, and list any days when it is closed.' Evaluate the quoted prompt itself, not an imagined answer. Return the documented safe or unsafe classification; include S1-S14 hazard identifiers only if applicable.The documented safe/unsafe label, with applicable S1-S14 identifiers only for an unsafe result.Check the output uses only the documented classifier labels and does not answer the library-hours question.meta-llama/llama-guard-4-12bLlama Guard 4 12B is Meta's multimodal content classifier for prompts and generated responses. It analyzes text with one or more images and returns a safe/unsafe label plus applicable hazard categories, using a dense architecture pruned from Llama 4 Scout.
This description covers the model’s capabilities. Available in Ailoot inputs, outputs and options are listed for the selected method below.
Llama Guard 4 12B is Meta's natively multimodal safety classifier with 12 billion parameters. It is trained jointly on text and multiple images and generates a textual classification: safe or unsafe, with violated hazard categories when the result is unsafe. Its purpose is evaluating content in a prompt or generated response rather than acting as a general chat assistant.
Prompt and response classification
The model can classify material before it is sent to a generative model, after that model produces an answer, or at both points. These are different questions. Prompt classification evaluates the user's input, while response classification evaluates what an assistant actually wrote. A system can therefore distinguish a risky request from a response that handles the request in an acceptable way under the classifier's taxonomy.
Supply the exact content to classify with the conversation roles and relevant context. If the target is a response, retain the question that gives the response its meaning. For a mixed text-and-image input, include the images associated with that prompt rather than classifying unrelated text or one arbitrarily selected image. The classifier result is information for the application's rule or review step; it does not itself block a request or change a file.
Fourteen hazard categories
The maker aligns the classifier with the MLCommons hazard taxonomy and adds a text-only code-interpreter category. The fourteen labels cover violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialized advice, privacy, intellectual property, indiscriminate weapons, hate, suicide and self-harm, sexual content, elections and code interpreter abuse.
The categories use identifiers S1 through S14. S14, Code Interpreter Abuse, is specifically for text-only tool-call use cases. Keep the taxonomy identifier with the safe/unsafe result so a later application step can interpret the classification under the same category definitions. A short result is a category judgment, not a full explanation, legal determination or guarantee that every possible harm has been detected.
For an illustrative format, an unsafe classification can be followed by the applicable category identifier. Retain the original evaluated text, its source or conversation position and the returned labels together. That association lets an application distinguish the content examined from a subsequent rewritten response or a separate prompt.
Architecture and training
Llama Guard 4 has a dense early-fusion Transformer architecture, pruned from a pretrained Llama 4 Scout checkpoint. The maker removes routed experts and router layers and retains the shared dense expert, then post-trains the resulting model for content classification. It performs no additional pretraining after that pruning step. This creates a different model from Scout's mixture-of-experts chat edition.
The model shares the Llama 4 tokenizer and vision encoder and combines text-only and multimodal classification training. The maker describes multilingual data and multi-image training, with most such samples containing two to five images and an approximate three-to-one blend of text-only to multimodal data. Those are training characteristics, not hard input-count limits.
The documented multilingual scope follows the languages supported by Llama Guard 3, and the card discusses English together with French, German, Hindi, Italian, Portuguese, Spanish and Thai. A classification request should preserve the actual wording and visual context in the language being evaluated rather than replacing the content with an unrelated summary.
Preparing a useful classification result
For an input check, provide the user's message and its associated images and ask for the prompt classification in the maker's format. For an output check, provide the assistant's actual response together with the relevant prior message. A multi-image example can retain the text linking the images so the model evaluates the combined request rather than independent fragments without context.
The model card demonstrates applying the matching conversation template and decoding only the generated classification. Its ten-token generation example illustrates a short label result; that number is not a separate maximum answer capacity. Keep the requested output aligned with the classifier's purpose instead of asking it to write an ordinary conversational answer.
Specific limitations
The maker states that judgments may be limited by the model's training data, common-sense knowledge, language coverage and policy coverage. Defamation, intellectual property and election-related categories can require factual, current knowledge that the classifier may not possess. The category label should therefore retain its relationship to the content and the information available for that evaluation.
The card reports testing mostly on prompts with a few images, most often three, and notes that behavior may vary with a much larger image collection. This describes the tested scope rather than a universal three-image maximum. The model can also be susceptible to adversarial or prompt-injection content that changes its intended behavior.
Llama Guard 4's classifier role should not inherit Scout's context specification or general assistant capabilities merely because it was pruned from Scout. The card read does not give a separate hard context or output-token capacity for this classifier. Preserve the evaluated material and taxonomy labels as the practical artifact, and let the application decide the action associated with that result.
POST /v1/chat/completionstexttext| Field | Type | Requirement | Values & limits | Default |
|---|---|---|---|---|
Fieldmodel | Typestring | RequirementRequired | Values & limits meta-llama/llama-guard-4-12b | Default— |
Fieldmessages | Typemessage[] | RequirementRequired | Values & limits Minimum items: 1 | Default— |
Fieldmessages[].role | Typestring | RequirementRequired | Values & limits Examples: system, user, assistant, tool, function Conditions: These roles are explicitly represented by Source compatibility types; the exact model role set remains model-specific. Model-specific | Default— |
Fieldmessages[].content | Typestring|content_part[]|null | RequirementOptional | Values & limits | Default— |
Fieldmessages[].tool_calls | Typetool_call[] | RequirementOptional | Values & limits | Default— |
Fieldmessages[].tool_call_id | Typestring | RequirementOptional | Values & limits Applies when: role=tool; use actual returned ID | Default— |
Fieldmessages[].name | Typestring | RequirementOptional | Values & limits | Default— |
Fieldmessages[].reasoning_content | Typestring | RequirementOptional | Values & limits Applies when: Round-trip actual returned reasoning where this model uses it | Default— |
Fieldmessages[].reasoning_details | Typeobject|array | RequirementOptional | Values & limits Model-specific | Default— |
Fieldmax_tokens | Typeinteger | RequirementOptional | Values & limits Minimum: 1 Model-specific | Default— |
Fieldmax_completion_tokens | Typeinteger | RequirementOptional | Values & limits Minimum: 1 Model-specific | Default— |
Fieldstream | Typeboolean | RequirementOptional | Values & limits | Defaultfalse |
Fieldstream_options.include_usage | Typeboolean | RequirementOptional | Values & limits Model-specific | Default— |
Fieldtemperature | Typenumber | RequirementOptional | Values & limits Model-specific | Default— |
Fieldtop_p | Typenumber | RequirementOptional | Values & limits Model-specific | Default— |
Fieldstop | Typestring|string[] | RequirementOptional | Values & limits Model-specific | Default— |
Fieldtools | Typefunction_tool[] | RequirementOptional | Values & limits Model-specific | Default— |
Fieldtools[].type | Typestring | RequirementOptional | Values & limits function Model-specific | Default— |
Fieldtools[].function.name | Typestring | RequirementRequired | Values & limits Applies when: function tool supplied | Default— |
Fieldtools[].function.description | Typestring | RequirementOptional | Values & limits | Default— |
Fieldtools[].function.parameters | TypeJSON_schema | RequirementOptional | Values & limits | Default— |
Fieldtool_choice | Typestring|object | RequirementOptional | Values & limits Model-specific | Default— |
Fieldparallel_tool_calls | Typeboolean | RequirementOptional | Values & limits Model-specific | Default— |
Fieldresponse_format | Typeobject | RequirementOptional | Values & limits Model-specific | Default— |
Fieldreasoning_effort | Typestring | RequirementOptional | Values & limits Model-specific | Default— |
Fieldreasoning | Typeobject | RequirementOptional | Values & limits Model-specific | Default— |
Fieldservice_tier | Typestring | RequirementOptional | Values & limits Model-specific | Default— |
Fieldinstructions | Typestring | RequirementOptional | Values & limits Compatibility field | Default— |
Fieldfunctions | Typefunction[] | RequirementOptional | Values & limits Model-specific | Default— |
Fieldfunction_call | Typestring|object | RequirementOptional | Values & limits Model-specific | Default— |
Fieldprompt_cache_options | Typeobject | RequirementOptional | Values & limits Model-specific | Default— |
Fieldmodalities | Typestring[] | RequirementOptional | Values & limits text | Default— |
Fieldprovider | Typeobject | RequirementOptional | Values & limits Conditions: provider.options is rejected on this Ultra text route | Default— |
Fieldcache_control.ttl | Typestring | RequirementOptional | Values & limits Conditions: 1h is rejected in actual prompt-cache locations | Default— |
Text · UTF8 text
messages[].content
| Parameter | Contract |
|---|---|
Parametercontent_type | Contractapplication/json |
Parameterrequired | Contractmodel, messages |
Parametermaterial_types | Contracttext |
Parametermessages | Contractmessage array with role/content shape |
Parameterfile_material | Contractactual UTF-8 document inserted as literal text; no file ID inferred |
Parameteroptional_controls | Contractstream, temperature, top_p, stop, max_tokens, max_completion_tokens, reasoning, response_format, tools, tool_choice |
Parametercontrol_scope | Contractmodel-specific; user function tools differ from hosted tools |
Parameteroutput_modalities | Contracttext |
Parameterhosted_operations | Contractfalse |
Parametermultimodal_input_binding | Contractnull |
Lifecycle: synchronous_or_streamed
Send exact model ID with messages.
Context length is not an output cap.
A text file may supply literal text; image/audio/file-object inputs need exact binding.
Tariff references do not add request options. Supported parameters are listed for the selected method.
Match each charge to the conditions shown. Use one rate for each set of alternative configurations.
| Configuration | Rate schedule | Context tokens, more than | Context tokens, up to and including | Charge |
|---|---|---|---|---|
| ConfigurationBase token rates | Rate scheduleBase rate | Context tokens, more than— | Context tokens, up to and includingNo upper bound | Charge Input · Input tokens $0.00036 / 1K tokens Output · Output tokens $0.00036 / 1K tokens Input · Cache read — / 1K tokens Input · Cache write — / 1K tokens Input · Cache write, 1 hour — / 1K tokens |
| ConfigurationRequest-length tier 1 | Rate schedule— | Context tokens, more than0 | Context tokens, up to and includingNo upper bound | Charge Input · Input tokens $0.00036 / 1K tokens Output · Output tokens $0.00036 / 1K tokens Input · Cache read — / 1K tokens Input · Cache write — / 1K tokens Input · Cache write, 1 hour — / 1K tokens |
Ailoot reserves an estimated amount before a request. After the result, it settles the final charge from measured usage. Streaming settlement uses the final usage record. How reservation and settlement work →
set -eu\n: "${AILOOT_API_KEY:?Set your Ailoot API key}"\npython3 - <<'PY_REQUEST'\nimport json,os\nfrom pathlib import Path\np=json.loads('{"model": "meta-llama/llama-guard-4-12b", "messages": [{"role": "user", "content": "Explain the difference between an observation and a hypothesis in three sentences."}]}')\n\nPath("request.json").write_text(json.dumps(p,ensure_ascii=False))\nPY_REQUEST\ncurl --fail-with-body --silent --show-error https://api.ailoot.ai/v1/chat/completions \\\n -H "Authorization: Bearer $AILOOT_API_KEY" -H 'Content-Type: application/json' \\\n --data-binary @request.json -D response-headers.txt -o result.json\npython3 - <<'PY_RESULT'\nimport json\nfrom pathlib import Path\nr=json.loads(Path("result.json").read_text())\nfor x in r.get("choices",[]):\n if x.get("message",{}).get("content"): print(x["message"]["content"])\nPY_RESULT\nfrom openai import OpenAI\nimport os\n\nif not os.environ.get("AILOOT_API_KEY", "").strip(): raise SystemExit("Set AILOOT_API_KEY before making a request")\nclient=OpenAI(base_url="https://api.ailoot.ai/v1",api_key=os.environ["AILOOT_API_KEY"],max_retries=0)\nresult=client.chat.completions.create(model='meta-llama/llama-guard-4-12b',messages=[{"role":"user","content":"Explain observations and hypotheses in three sentences."}])\nimport base64, json\nfrom pathlib import Path\n\ndef save_result(data, stem="result"):\n # Keep every field, including usage, IDs, reasoning and tool requests.\n Path(stem + ".json").write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")\n print(json.dumps(data, ensure_ascii=False, indent=2))\n def save_blob(encoded, suffix, label):\n raw = base64.b64decode(encoded, altchars=b"-_", validate=True)\n ext = "png" if raw.startswith(b"\\x89PNG\\r\\n\\x1a\\n") else "jpg" if raw.startswith(b"\\xff\\xd8") else "webp" if raw[:4] == b"RIFF" and raw[8:12] == b"WEBP" else suffix\n file = Path(stem + "-" + label + "." + ext)\n file.write_bytes(raw)\n print("Saved", file)\n for index, block in enumerate(data.get("content") or []):\n print("Content", index, json.dumps(block, ensure_ascii=False))\n for choice in data.get("choices") or []:\n print("Choice", choice.get("index"), json.dumps(choice.get("message", choice.get("delta", {})), ensure_ascii=False))\n for index, item in enumerate(data.get("output") or []):\n print("Output", index, json.dumps(item, ensure_ascii=False))\n if item.get("type") == "image_generation_call" and item.get("result"):\n save_blob(item["result"], item.get("output_format") or "bin", "output-" + str(index))\n for ci, candidate in enumerate(data.get("candidates") or []):\n for pi, part in enumerate((candidate.get("content") or {}).get("parts") or []):\n print("Candidate/part", ci, pi, json.dumps(part, ensure_ascii=False))\n blob = part.get("inlineData") or part.get("inline_data")\n if blob and blob.get("data"):\n mime = blob.get("mimeType") or blob.get("mime_type")\n suffix = {"image/png":"png", "image/jpeg":"jpg", "image/webp":"webp", "audio/wav":"wav", "audio/mpeg":"mp3", "video/mp4":"mp4"}.get(mime, "bin")\n save_blob(blob["data"], suffix, "candidate-" + str(ci) + "-part-" + str(pi))\n\nsave_result(result.to_dict(mode="json"))\nfrom openai import OpenAI\nimport os\nfrom pathlib import Path\n\nif not os.environ.get("AILOOT_API_KEY", "").strip(): raise SystemExit("Set AILOOT_API_KEY before making a request")\nclient=OpenAI(base_url="https://api.ailoot.ai/v1",api_key=os.environ["AILOOT_API_KEY"],max_retries=0)\nimport base64, json\nfrom pathlib import Path\n\ndef save_result(data, stem="result"):\n # Keep every field, including usage, IDs, reasoning and tool requests.\n Path(stem + ".json").write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")\n print(json.dumps(data, ensure_ascii=False, indent=2))\n def save_blob(encoded, suffix, label):\n raw = base64.b64decode(encoded, altchars=b"-_", validate=True)\n ext = "png" if raw.startswith(b"\\x89PNG\\r\\n\\x1a\\n") else "jpg" if raw.startswith(b"\\xff\\xd8") else "webp" if raw[:4] == b"RIFF" and raw[8:12] == b"WEBP" else suffix\n file = Path(stem + "-" + label + "." + ext)\n file.write_bytes(raw)\n print("Saved", file)\n for index, block in enumerate(data.get("content") or []):\n print("Content", index, json.dumps(block, ensure_ascii=False))\n for choice in data.get("choices") or []:\n print("Choice", choice.get("index"), json.dumps(choice.get("message", choice.get("delta", {})), ensure_ascii=False))\n for index, item in enumerate(data.get("output") or []):\n print("Output", index, json.dumps(item, ensure_ascii=False))\n if item.get("type") == "image_generation_call" and item.get("result"):\n save_blob(item["result"], item.get("output_format") or "bin", "output-" + str(index))\n for ci, candidate in enumerate(data.get("candidates") or []):\n for pi, part in enumerate((candidate.get("content") or {}).get("parts") or []):\n print("Candidate/part", ci, pi, json.dumps(part, ensure_ascii=False))\n blob = part.get("inlineData") or part.get("inline_data")\n if blob and blob.get("data"):\n mime = blob.get("mimeType") or blob.get("mime_type")\n suffix = {"image/png":"png", "image/jpeg":"jpg", "image/webp":"webp", "audio/wav":"wav", "audio/mpeg":"mp3", "video/mp4":"mp4"}.get(mime, "bin")\n save_blob(blob["data"], suffix, "candidate-" + str(ci) + "-part-" + str(pi))\n\nwith client.chat.completions.stream(model='meta-llama/llama-guard-4-12b',messages=[{"role":"user","content":"Explain observations and hypotheses in three sentences."}]) as stream:\n with Path("stream-events.jsonl").open("w",encoding="utf-8") as log:\n for event in stream:\n payload=event.to_dict(mode="json")\n log.write(json.dumps(payload,ensure_ascii=False)+"\\n"); log.flush()\n print(json.dumps(payload,ensure_ascii=False))\n final=stream.get_final_completion()\n save_result(final.to_dict(mode="json"),"stream-result")\njson or SSE
Keep every complete returned response, file and content part.
Keep every choice and its content/tool calls/reasoning. In SSE assemble deltas by choice/tool index, retain the final finish reason and usage.
Keep request/response IDs and headers. No generic text job retrieval URL is supplied.
| Field | Type |
|---|---|
Fieldchoices[].index | Typeinteger |
Fieldchoices[].message.content | Typestring|null |
Fieldchoices[].message.tool_calls | Typetool_call[] |
Fieldchoices[].message.reasoning_content | Typestring |
Fieldchoices[].message.reasoning_details | Typeobject|array |
Fieldchoices[].finish_reason | Typestring|null |
Fieldusage | Typeobject |
| Response | Condition | Next step |
|---|---|---|
Response400 · invalid_request_error | ConditionInvalid required fields, material representation or parameter value | Next stepCorrect the indicated fields before a new creation request. |
Ailoot Ultra meta-llama/llama-guard-4-12b
Use the method paths shown above.
meta-llama/llama-guard-4-12bLlama Guard 4 12B is Meta's multimodal content classifier for prompts and generated responses. It analyzes text with one or more images and returns a safe/unsafe label plus applicable hazard categories, using a dense architecture pruned from Llama 4 Scout.
This description covers the model’s capabilities. Available in Ailoot inputs, outputs and options are listed for the selected method below.
Llama Guard 4 12B is Meta's natively multimodal safety classifier with 12 billion parameters. It is trained jointly on text and multiple images and generates a textual classification: safe or unsafe, with violated hazard categories when the result is unsafe. Its purpose is evaluating content in a prompt or generated response rather than acting as a general chat assistant.
Prompt and response classification
The model can classify material before it is sent to a generative model, after that model produces an answer, or at both points. These are different questions. Prompt classification evaluates the user's input, while response classification evaluates what an assistant actually wrote. A system can therefore distinguish a risky request from a response that handles the request in an acceptable way under the classifier's taxonomy.
Supply the exact content to classify with the conversation roles and relevant context. If the target is a response, retain the question that gives the response its meaning. For a mixed text-and-image input, include the images associated with that prompt rather than classifying unrelated text or one arbitrarily selected image. The classifier result is information for the application's rule or review step; it does not itself block a request or change a file.
Fourteen hazard categories
The maker aligns the classifier with the MLCommons hazard taxonomy and adds a text-only code-interpreter category. The fourteen labels cover violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialized advice, privacy, intellectual property, indiscriminate weapons, hate, suicide and self-harm, sexual content, elections and code interpreter abuse.
The categories use identifiers S1 through S14. S14, Code Interpreter Abuse, is specifically for text-only tool-call use cases. Keep the taxonomy identifier with the safe/unsafe result so a later application step can interpret the classification under the same category definitions. A short result is a category judgment, not a full explanation, legal determination or guarantee that every possible harm has been detected.
For an illustrative format, an unsafe classification can be followed by the applicable category identifier. Retain the original evaluated text, its source or conversation position and the returned labels together. That association lets an application distinguish the content examined from a subsequent rewritten response or a separate prompt.
Architecture and training
Llama Guard 4 has a dense early-fusion Transformer architecture, pruned from a pretrained Llama 4 Scout checkpoint. The maker removes routed experts and router layers and retains the shared dense expert, then post-trains the resulting model for content classification. It performs no additional pretraining after that pruning step. This creates a different model from Scout's mixture-of-experts chat edition.
The model shares the Llama 4 tokenizer and vision encoder and combines text-only and multimodal classification training. The maker describes multilingual data and multi-image training, with most such samples containing two to five images and an approximate three-to-one blend of text-only to multimodal data. Those are training characteristics, not hard input-count limits.
The documented multilingual scope follows the languages supported by Llama Guard 3, and the card discusses English together with French, German, Hindi, Italian, Portuguese, Spanish and Thai. A classification request should preserve the actual wording and visual context in the language being evaluated rather than replacing the content with an unrelated summary.
Preparing a useful classification result
For an input check, provide the user's message and its associated images and ask for the prompt classification in the maker's format. For an output check, provide the assistant's actual response together with the relevant prior message. A multi-image example can retain the text linking the images so the model evaluates the combined request rather than independent fragments without context.
The model card demonstrates applying the matching conversation template and decoding only the generated classification. Its ten-token generation example illustrates a short label result; that number is not a separate maximum answer capacity. Keep the requested output aligned with the classifier's purpose instead of asking it to write an ordinary conversational answer.
Specific limitations
The maker states that judgments may be limited by the model's training data, common-sense knowledge, language coverage and policy coverage. Defamation, intellectual property and election-related categories can require factual, current knowledge that the classifier may not possess. The category label should therefore retain its relationship to the content and the information available for that evaluation.
The card reports testing mostly on prompts with a few images, most often three, and notes that behavior may vary with a much larger image collection. This describes the tested scope rather than a universal three-image maximum. The model can also be susceptible to adversarial or prompt-injection content that changes its intended behavior.
Llama Guard 4's classifier role should not inherit Scout's context specification or general assistant capabilities merely because it was pruned from Scout. The card read does not give a separate hard context or output-token capacity for this classifier. Preserve the evaluated material and taxonomy labels as the practical artifact, and let the application decide the action associated with that result.
POST /v1/messagestextjson, sse| Field | Type | Requirement | Values & limits | Default |
|---|---|---|---|---|
Fieldmodel | Typestring | RequirementRequired | Values & limits meta-llama/llama-guard-4-12b | Default— |
Fieldmessages | Typemessage[] | RequirementRequired | Values & limits | Default— |
Fieldmessages[].role | Typestring | RequirementRequired | Values & limits user, assistant | Default— |
Fieldmessages[].content | Typestring | RequirementRequired | Values & limits | Default— |
Fieldmax_tokens | Typeinteger | RequirementRequired | Values & limits | Default— |
Fieldstream | Typeboolean | RequirementOptional | Values & limits | Defaultfalse |
Text · UTF-8 text
messages[].content string
| Parameter | Contract |
|---|---|
Parametercontent_type | Contractapplication/json |
Parameterrequired | Contractmodel, messages, max_tokens |
Parameteroptional_controls | Contractstream |
Parametermaterial_types | Contracttext |
Parametertext_file_material | ContractRead the actual UTF-8 document and put its text in the indicated input or message content string. |
Lifecycle: synchronous_or_streamed
Tariff references do not add request options. Supported parameters are listed for the selected method.
Match each charge to the conditions shown. Use one rate for each set of alternative configurations.
| Configuration | Rate schedule | Context tokens, more than | Context tokens, up to and including | Charge |
|---|---|---|---|---|
| ConfigurationBase token rates | Rate scheduleBase rate | Context tokens, more than— | Context tokens, up to and includingNo upper bound | Charge Input · Input tokens $0.00036 / 1K tokens Output · Output tokens $0.00036 / 1K tokens Input · Cache read — / 1K tokens Input · Cache write — / 1K tokens Input · Cache write, 1 hour — / 1K tokens |
| ConfigurationRequest-length tier 1 | Rate schedule— | Context tokens, more than0 | Context tokens, up to and includingNo upper bound | Charge Input · Input tokens $0.00036 / 1K tokens Output · Output tokens $0.00036 / 1K tokens Input · Cache read — / 1K tokens Input · Cache write — / 1K tokens Input · Cache write, 1 hour — / 1K tokens |
Ailoot reserves an estimated amount before a request. After the result, it settles the final charge from measured usage. Streaming settlement uses the final usage record. How reservation and settlement work →
{\n "model": "meta-llama/llama-guard-4-12b",\n "max_tokens": 128,\n "messages": [\n {\n "role": "user",\n "content": "Summarize the incident report."\n }\n ],\n "stream": false\n}set -eu\n: "${AILOOT_API_KEY:?Set your Ailoot API key}"\n: "${AILOOT_TEXT_FILE:?Set your actual UTF-8 document}"\nexport AILOOT_TEXT_FILE\npython3 - <<'PY_REQUEST'\nimport json, os\nfrom pathlib import Path\n\nsource_file = Path(os.environ['AILOOT_TEXT_FILE'])\nif not source_file.is_file():\n raise SystemExit('Set AILOOT_TEXT_FILE to your actual UTF-8 document')\ntext = source_file.read_text(encoding='utf-8')\nif not text.strip():\n raise SystemExit('Choose a document containing text')\npayload = {'model': 'meta-llama/llama-guard-4-12b', 'max_tokens': 128, 'messages': [{'role': 'user', 'content': 'Summarize the incident report.'}]}\npayload['messages'][0]['content'] = 'Summarize this material and quote supporting source passages.\\n\\n' + text\nPath('request.json').write_text(json.dumps(payload, ensure_ascii=False), encoding='utf-8')\nPY_REQUEST\ncurl --fail-with-body --silent --show-error https://api.ailoot.ai/v1/messages \\\n -H "x-api-key: $AILOOT_API_KEY" -H 'anthropic-version: 2023-06-01' -H 'Content-Type: application/json' \\\n --data-binary @request.json -D response-headers.txt -o result.json\npython3 - <<'PY_RESULT'\nimport json\nfrom pathlib import Path\n\nresult = json.loads(Path('result.json').read_text(encoding='utf-8'))\nprint(json.dumps(result, ensure_ascii=False, indent=2))\nPY_RESULT\nimport json, os\nfrom pathlib import Path\n\nsource_file = Path(os.environ['AILOOT_TEXT_FILE'])\nif not source_file.is_file():\n raise SystemExit('Set AILOOT_TEXT_FILE to your actual UTF-8 document')\ntext = source_file.read_text(encoding='utf-8')\nif not text.strip():\n raise SystemExit('Choose a document containing text')\npayload = {'model': 'meta-llama/llama-guard-4-12b', 'max_tokens': 128, 'messages': [{'role': 'user', 'content': 'Summarize the incident report.'}]}\npayload['messages'][0]['content'] = 'Summarize this material and quote supporting source passages.\\n\\n' + text\nfrom urllib.request import Request, urlopen\nfrom urllib.error import HTTPError\n\napi_key = os.environ['AILOOT_API_KEY']\nif not api_key.strip():\n raise SystemExit('Set AILOOT_API_KEY before making a request')\nheaders = {'x-api-key': 'PLACEHOLDER_KEY', 'anthropic-version': '2023-06-01', 'Content-Type': 'application/json'}\nheaders['x-api-key'] = api_key\nrequest = Request('https://api.ailoot.ai/v1/messages', data=json.dumps(payload, ensure_ascii=False).encode('utf-8'), headers=headers, method='POST')\ntry:\n with urlopen(request, timeout=120) as response:\n raw = response.read()\n Path('response-headers.txt').write_text(str(response.headers), encoding='utf-8')\nexcept HTTPError as error:\n Path('result.json').write_bytes(error.read())\n Path('response-headers.txt').write_text(str(error.headers), encoding='utf-8')\n raise\nPath('result.json').write_bytes(raw)\nimport json\nfrom pathlib import Path\n\nresult = json.loads(Path('result.json').read_text(encoding='utf-8'))\nprint(json.dumps(result, ensure_ascii=False, indent=2))\nJSON or SSE
Keep every complete returned response, file and content part.
Keep all content blocks, thinking signatures and actual tool-use IDs. Assemble all SSE block deltas; a first text block is not the complete output.
Keep request/response IDs and headers. No generic text job retrieval URL is supplied.
| Field | Type |
|---|---|
Fieldid | Typestring |
Fieldmodel | Typestring |
Fieldcontent[] | Typetext|thinking|tool_use|other content block |
Fieldstop_reason | Typestring|null |
Fieldusage | Typeobject |
| Response | Condition | Next step |
|---|---|---|
Response400 · invalid_request_error | ConditionInvalid required fields, material representation or parameter value | Next stepCorrect the indicated fields before a new creation request. |
Ailoot Ultra meta-llama/llama-guard-4-12b
Use the method paths shown above.
Technical example in English
Classify a benign library prompt\n\nClassify this user prompt using Llama Guard 4's prompt-safety taxonomy: 'Summarize the public library opening hours from the notice I pasted, and list any days when it is closed.' Evaluate the quoted prompt itself, not an imagined answer. Return the documented safe or unsafe classification; include S1-S14 hazard identifiers only if applicable.The documented safe/unsafe label, with applicable S1-S14 identifiers only for an unsafe result.Check the output uses only the documented classifier labels and does not answer the library-hours question.