WildGuard

weights

open(allenai/wildguard on HF)

data

open(WildGuardMix corpus public)

code

partial(inference/serving package only

base

Mistral-7B

license

Apache-2.0(OSI)

WildGuard's weights are released under Apache-2.0, and its WildGuardMix training corpus is published alongside them, both behind an automatic click-through agreement to Ai2's responsible-use guidelines. The published code is an inference package rather than the fine-tuning pipeline that produced the model, which makes this an open-weights release rather than a fully open model.

• https://api.github.com/repos/allenai/wildguard/contents recorded 2026-08-13

  Root listing of the project's own repo, which is the whole of what it ships as code. Nine entries (.gitignore, LICENSE.md, README.md, docs, examples, pyproject.toml, requirements.txt, tests, wildguard). No training directory, no trainer entrypoint, no SFT or DPO config. The `wildguard` package is the classifier wrapper and `examples/wildguard_filter` is a serving demo, so the published code is inference and serving only.

• https://github.com/allenai/wildguard/blob/main/README.md recorded 2026-08-13

  The project's own README installs with `pip install wildguard` and documents `load_wildguard()` plus `classify()`. Its only outbound links are the paper, the WildGuardMix dataset, the model, and the Safety-Eval companion repo, which it describes as holding "the details of evaluations run in the WildGuard paper". No training pipeline is offered or linked.

• https://huggingface.co/allenai/wildguard recorded 2026-08-13

  Repo shows License - apache-2.0 and a dataset tag allenai/wildguardmix, gated auto (access granted on accepting the AI2 Responsible Use policy), with safetensors and pytorch_model shards downloadable. cardData declares datasets - allenai/wildguardmix, which is the published training corpus.

• https://huggingface.co/api/datasets/allenai/wildguardmix recorded 2026-09-29

  The Hugging Face API record for the allenai/wildguardmix dataset publishes the "Dataset Card for WildGuardMix" with its training split at "train/wildguard_train.parquet" and test split at "test/wildguard_test.parquet", under the tag "license:odc-by", behind the same automatic access gate.

• https://huggingface.co/api/models/allenai/wildguard recorded 2026-09-29

  The Hugging Face API record for allenai/wildguard carries the tag "license:apache-2.0" and the training-set tag "dataset:allenai/wildguardmix", lists downloadable weight shards such as "model-00001-of-00002.safetensors", and is gated automatically: "Access to this model is automatically granted upon accepting the" AI2 Responsible Use Guidelines, with a form checkbox reading "I agree to use this model for research purposes in accordance with the AI2 Responsible Use Guidelines".

• https://pypi.org/pypi/wildguard/json recorded 2026-09-29

  The PyPI record for the wildguard package describes it as "WildGuard safety classification inference", and its README documents only loading and classifying ("Support for both VLLM and HuggingFace backends") plus a guard-filter example, linking home to the allenai/wildguard repository. Searched the package description for train, fine-tune and SFT: none, so the published code is an inference package without the training pipeline.

Adoption is measured by Hugging Face downloads for the one artifact Ai2 has declared, allenai/wildguard. No other channel is declared for the model, so this single download count is the only visible measure of its use.

• https://huggingface.co/api/models/allenai/wildguard recorded 2026-08-13

  121,205 downloads in the trailing 30 days for allenai/wildguard

WildGuard judges prompt harm, response harm and refusal in a single pass, and its card reports higher F1 than Llama Guard 2 and Aegis Guard on all three tasks. Refusal detection is what separates it from harm-only classifiers, and the card reports its widest lead there.

• https://huggingface.co/allenai/wildguard recorded 2026-09-29

  The model card describes "an open one-stop moderation model that achieves three goals" covering harm in prompts, harm in responses and refusal evaluation, with risk categories "consisting of total 13 subcategories". It reports that WildGuard "outperforms the strongest existing open-source baselines (including Llama-Guard2 and Aegis-Guard) on F1 scores across all three tasks" and "matches GPT-4 across tasks, and surpasses GPT-4 by up to 4.8% on adversarial prompt harmfulness".