What Granite Guardian 3.1 2B is designed to do
Granite Guardian 3.1 2B is a safety and risk-detection language model from IBM Research. It is fine-tuned from Granite 3.1 2B Instruct, but its role is different from that of a general instruction-following model. Its job is to inspect text and structured evaluation context, then return a risk judgment rather than carry on an open-ended conversation.
The model can be placed before a generative model to screen incoming prompts, after one to review generated answers, or inside a larger retrieval-augmented generation (RAG) or agent workflow. The published model repository is ibm-granite/granite-guardian-3.1-2b. IBM released it on December 18, 2024 under the Apache 2.0 license.
Which risks can it detect?
Granite Guardian supports predefined risk-detection configurations associated with IBM’s AI Risk Atlas. These configurations let an application select the type of judgment it needs instead of treating every input as a single, generic moderation problem.
- Harmful content: screening for broad harmful or unsafe material.
- Jailbreak attempts: identifying prompts designed to bypass a model’s safety instructions.
- Social bias: checking for problematic bias-related content.
- Violence, profanity, and sexual content: detecting specific content categories.
- Unethical behavior: identifying content associated with unethical requests or responses.
- RAG relevance: checking whether retrieved context is relevant to the user’s question.
- RAG groundedness: checking whether an answer is supported by the supplied context rather than unsupported invention.
- Answer relevance: evaluating whether the response adequately addresses the request.
- Function-calling hallucinations: inspecting proposed agent tool calls for invalid arguments, fabricated information flows, syntactic or semantic errors, or actions that do not follow from the request and available tool definition.
In the recommended inference setup, the model produces textual risk labels such as Yes or No, with probability information available through the inference procedure. The exact interpretation depends on the selected risk definition and the prompt format used by the application.
How it fits into an AI application
A useful way to understand Granite Guardian is as a checkpoint in an existing AI pipeline. For input screening, an application sends the user’s prompt to the guardian before forwarding it to a larger language model. If the result indicates a selected risk, the application can block, route, or request a safer reformulation.
For output screening, the guardian evaluates a generated answer before it is shown to the user. In a RAG workflow, the evaluation can include the question, retrieved passages, and candidate answer. This enables separate checks for whether the passages are relevant, whether the answer is supported by them, and whether the answer addresses the question.
For agents, Granite Guardian can inspect proposed function calls and the information exchanged between a model and its tools. It can identify calls with incorrect arguments or calls that are not justified by the user’s request or the tool definition. It does not autonomously execute tools; it evaluates the proposed interaction.
Technical profile and limits
| Specification | Details |
|---|---|
| Provider | IBM Research |
| Model family | Granite Guardian |
| Release date | December 18, 2024 |
| Architecture | Decoder-only Granite causal language model |
| Model size | Approximately 2 billion parameters; current repository metadata identifies the checkpoint in a 3B model-size class |
| Configured context length | 131,072 tokens |
| Primary input | Text and evaluation context supplied by the application |
| Primary output | Textual risk judgments and probability information through the recommended procedure |
| Language documented by IBM | English |
| License | Apache 2.0 |
| Maximum output tokens | Not published in the supplied research |
The 131,072-token figure comes from the published model configuration’s maximum position embeddings. It describes the configured context capacity, not a guarantee that every safety-evaluation prompt will be practical or equally accurate at that length. The supplied research does not provide a separate maximum output-token limit.
The model is text-only in both practical purpose and output modality. It does not natively generate or analyze images, audio, or video. Its output is a classification or risk assessment about supplied text and structured data.
Deployment and integration
Granite Guardian 3.1 2B is distributed as open weights through Hugging Face. The model card documents loading it with Hugging Face Transformers using AutoTokenizer and AutoModelForCausalLM. It also documents serving options involving vLLM and SGLang, along with local deployment using compatible quantization and application tools.
This deployment model is important for organizations that need to keep prompts, retrieved documents, or agent traces within their own infrastructure. The supplied research does not list a provider-hosted API price for this checkpoint. Input and output prices are therefore not available, and operating cost depends on the hardware, serving stack, throughput, and deployment configuration selected by the user.
Main strengths
- Small dedicated footprint: a compact safety model can be easier to run beside a larger generative model than another large general-purpose model.
- Open licensing: the Apache 2.0 license and downloadable checkpoint support local experimentation and self-hosted integration, subject to the license and the user’s own review requirements.
- Broad predefined coverage: the model addresses content safety as well as RAG relevance, groundedness, answer relevance, and function-calling reliability.
- Useful at several pipeline stages: it can screen prompts, review outputs, validate retrieved-context workflows, and inspect proposed tool calls.
- Probability information: the recommended inference procedure can provide more than a simple displayed label, allowing an application to design its own thresholding behavior.
Its editorial profile favors speed and operating cost over broad reasoning or coding ability: the supplied comparative data rates speed at 8 out of 10 and cost at 9 out of 10. These are editorial estimates, not IBM benchmarks or provider-published performance guarantees.
Limitations and trade-offs
Granite Guardian is not a replacement for a general-purpose language model. It is specialized for risk classification and should not be selected when the primary requirement is extended conversation, creative generation, software development, or autonomous task completion. The supplied comparative data rates its reasoning at 3 out of 10 and coding at 1 out of 10; these scores are editorial assessments rather than standardized benchmark results.
The model’s decisions also depend on configuration. A risk definition, prompt template, threshold, and surrounding application logic all affect how results should be interpreted. A binary Yes or No judgment should not automatically be treated as a complete safety decision. Teams should test representative examples from their own domain, measure false positives and false negatives, and retain human review for high-impact decisions.
It has no native tool execution capability, even though it can inspect proposed function calls. It also has no documented provider pricing, maximum output limit, batch API, caching feature, or managed API availability in the supplied research. Streaming is listed as supported in the comparative model data, but the checkpoint remains primarily a self-hosted model rather than a general cloud endpoint.
Current availability
The open-weight Hugging Face checkpoint remains separately downloadable from IBM’s Granite organization. This should be distinguished from IBM’s managed watsonx.ai catalog. IBM lifecycle information identifies the related ibm/granite-guardian-3-2b managed foundation-model entry as deprecated on July 9, 2025 and withdrawn from the multitenant watsonx.ai lifecycle on October 8, 2025. That managed-service status does not mean the open-weight Granite Guardian 3.1 2B repository has been removed.
Users evaluating the model should therefore decide first whether they need a downloadable checkpoint or a managed provider endpoint. The former remains the relevant route for local and self-hosted use; the supplied research does not verify current managed-endpoint access for this specific checkpoint.
When to choose Granite Guardian 3.1 2B
Choose Granite Guardian 3.1 2B when a system needs a relatively small, open-weight model dedicated to safety and reliability checks. It is particularly suitable for:
- screening prompts for harmful content or jailbreak attempts;
- checking generated answers before delivery;
- testing whether RAG context is relevant and whether an answer is grounded in that context;
- reviewing agent function calls for hallucinated or invalid tool interactions; and
- running guardrail inference locally where self-hosting, licensing, or data control matter.
A larger general-purpose model may be more appropriate when the task requires nuanced open-ended reasoning, coding, generation, or broader multilingual behavior. A specialized policy engine or human review process may be more appropriate when decisions have legal, employment, medical, financial, or other high-impact consequences. Granite Guardian can serve as one layer in those systems, but its compact size and classification role should not be mistaken for comprehensive judgment.