Granite Guardian
IBMIBM's open guardrail model family for detecting risks in prompts and responses, plus RAG-specific checks. It covers harm, social bias, jailbreaking, violence, profanity and sexual content, and adds hallucination checks for retrieval pipelines (context relevance, groundedness, answer relevance).
Scored on the Granite Guardian 3.2 5B checkpoint, a pruned version of the 3.1 8B model; the capability reading also draws on the newer 4.1 8B release.
Openness
3 medium confidence- weights
- open(granite-guardian-3.2-5b on HF)
- data
- not-released
- license
- Apache-2.0(OSI)
Granite Guardian's weights are released under Apache-2.0. The card says the model was trained on human-annotated and synthetic data but does not publish that training set, and no fine-tuning code is released, which makes this an open-weights release rather than a fully open model.
- https://huggingface.co/api/models/ibm-granite/granite-guardian-3.2-5b recorded 2026-09-29
The Hugging Face API record for the checkpoint carries the tag "license:apache-2.0", reports the repository as not gated, and lists the weight shards "model-00001-of-00003.safetensors" through "model-00003-of-00003.safetensors" as downloadable files. It declares no datasets.
- https://huggingface.co/ibm-granite/granite-guardian-3.2-5b/raw/main/README.md recorded 2026-09-29
The raw model card front matter records "license: apache-2.0" and names no datasets. Its Training Data section says "Granite Guardian is trained on a combination of human annotated and synthetic data" and that "Additional synthetic data was used to supplement the training set", without publishing the resulting training set. Searched the card for fine-tune, training code and train.py: the only linked code is the inference cookbooks.
Adoption
1 medium confidenceAdoption here is read from Hugging Face downloads for the declared checkpoint, granite-guardian-3.2-5b, distilled from an 8B version that is not separately counted. That leaves the reading based on one size in the family rather than its full reach.
- https://huggingface.co/api/models/ibm-granite/granite-guardian-3.2-5b recorded 2026-08-13
1,837 downloads in the trailing 30 days for ibm-granite/granite-guardian-3.2-5b
Capability
4 medium confidenceBeyond the usual harm categories, Granite Guardian checks retrieval pipelines for context relevance, groundedness and answer relevance, and flags hallucinated function calls in agent workflows. The 4.1 release also judges text against criteria the user writes, which takes it past a fixed moderation taxonomy.
- https://huggingface.co/ibm-granite/granite-guardian-3.2-5b/raw/main/README.md recorded 2026-09-29
The raw model card lists the risks the model detects, including "Social Bias", "Jailbreaking", "Profanity" and "Sexual Content" under an umbrella Harm category, and says it assesses "three key issues: context relevance" plus groundedness and answer relevance in RAG, along with "Function calling risk detection within agentic workflows".
- https://huggingface.co/ibm-granite/granite-guardian-4.1-8b/raw/main/README.md recorded 2026-09-29
The model card for Granite Guardian 4.1 8B says the model is "designed to judge if the input prompts and the output responses of an LLM-based system meet specified criteria", keeps pre-baked harm, RAG and function-calling criteria, and adds that "the model also allows users to bring their own criteria and tailor the judging behavior to specific use cases."
Verified 2026-09-27