GuardZoo (Zero-Shot) - Unsafe F1: leaderboard
Safety classification by guard models on GuardZoo (Mo et al., 2026): conversations, prompts and agent trajectories pooled from nine safety datasets and relabeled under one 15-category taxonomy by three-LLM agreement or expert adjudication. Guard models run zero-shot on the in-domain test split (20% of the seven in-domain sources), and the score is the F1 of the unsafe class in percent, higher is better.
Metric: F1 of the unsafe class (%; GuardZoo in-domain test split, relabeled under the 15-category taxonomy; zero-shot guard models). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 9 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Qwen3Guard-8B | 80.23 | |
| 2 | Qwen3Guard-4B | 79.04 | |
| 3 | ShieldGemma 9B | 75.61 | |
| 4 | ShieldGemma 2B | 75.13 | |
| 5 | Llama Guard 3 8B | 69.87 | |
| 6 | Qwen3Guard-0.6B | 68.83 | |
| 7 | LlamaGuard 2 8B | 65.52 | |
| 8 | ShieldGemma 27B | 55.3 | |
| 9 | Llama Guard 3 1B | 25.2 |
Interactive version: theaggregate.ai/benchmark?slug=guardzoo-zero-shot-unsafe-f1 · How It Works · Data refreshed daily, snapshot 2026-11-12.