What Granite Guardian 4.0 3B Toxicity Japanese is
Granite Guardian 4.0 3B Toxicity Japanese is an open-weight safety classifier developed by IBM Research. Its canonical Hugging Face identifier is ibm-granite/granite-guardian-4.0-3b-toxicity-ja. The model contains approximately 3 billion parameters and is distributed under the Apache 2.0 license.
The model belongs to the Granite Guardian 4.0 family, but it is a specialized standalone release rather than a general-purpose assistant. Its job is to inspect text and make a safety judgment. This makes it suitable for use inside a moderation or application-safety pipeline, where another model or user generates the content and Granite Guardian evaluates it.
IBM built the model from granite-4.0-micro and adapted it for Japanese safety evaluation using a Japanese-language continual-learning process and a safety LoRA adapter. The resulting adapter was merged into the base model, which is intended to simplify deployment.
What the model evaluates
The primary purpose of this release is Japanese toxicity and safety detection. It can be prompted to assess either a user prompt or an assistant response against a specified safety criterion. Supported toxicity-related categories identified in the model research include:
- Harm
- Social bias
- Jailbreak attempts
- Violence
- Profanity
- Unethical behavior
- Sexual content
In practical terms, an application might use the model before sending a Japanese user request to a conversational model, or after generation to screen the assistant’s response. It can therefore serve as a prompt filter, response checker, or one component of a broader content-moderation workflow.
This specialization is important. Granite Guardian 4.0 3B Toxicity Japanese is not presented as a general safety evaluator for every type of AI failure. The supplied model information specifically excludes RAG groundedness evaluation, context relevance, answer relevance, and agentic function-calling hallucination detection. A system that needs those checks would require a different guard model or an additional evaluation layer.
Output format and judge behavior
The intended output is JSON containing a label field whose value is either yes or no. The label represents whether the evaluated text meets the safety criterion supplied in the judging prompt.
This is a classification result, not a detailed explanation or a rewritten response. Applications should therefore treat the model as a decision component and implement their own policy for what happens after either label. For example, a system could block, queue for human review, or allow content depending on the category and the application’s risk tolerance.
The model card warns that deviations from the prescribed judge protocol may produce unexpected outputs. Developers should follow the published prompting format, validate the returned structure, and test the model with examples that reflect their own Japanese terminology, user population, and moderation policy. Although the research describes structured JSON output, it does not establish a separate hosted API JSON-mode feature.
Evaluation and main strengths
IBM’s published out-of-distribution safety results report a macro average of 0.87 for Granite Guardian 4.0 3B Toxicity Japanese. The reported Japanese averages are 0.86 for the combined prompt and response evaluation columns. The evaluation also reports strong performance on Japanese toxic prompts and improved Japanese response-toxicity detection compared with the earlier Granite Guardian variants listed in the source material.
These are provider-published evaluation results, not a guarantee of performance on every production dataset. They nevertheless indicate the model’s main advantage: it is specifically adapted for Japanese toxicity-related judgments instead of being used as an unadapted general language model. The relatively small approximately 3B-parameter size is another practical advantage for organizations that want to run a safety check locally rather than send sensitive text to a hosted service.
The model’s open-weight Apache 2.0 distribution also gives teams more deployment control than a closed moderation endpoint. They can download the model, operate it within their own infrastructure, and integrate it with Transformers or vLLM. The research does not provide a vendor-hosted per-token API for this model.
Deployment, modalities, and pricing
Granite Guardian 4.0 3B Toxicity Japanese is primarily a self-hosted model. IBM’s published examples identify the Transformers and vLLM ecosystems as supported deployment routes. vLLM can also expose a local OpenAI-compatible server, allowing applications to connect through a familiar interface while the inference remains under the operator’s control.
The model accepts text and produces text-based structured judgments. It does not provide image, audio, or video input or output according to the supplied specifications. It is not described as a tool-calling or function-calling model, and no web-search capability is specified.
No official hosted input or output price is identified. Consequently, there is no verified per-token price to compare with commercial moderation APIs. Self-hosting still has infrastructure, power, maintenance, and engineering costs, but those costs depend on the operator’s hardware and deployment design rather than on a published IBM usage tariff.
A context-length limit and maximum output-token limit are not specified in the supplied research. Users should not assume a particular window or output ceiling without checking the model’s current configuration and deployment documentation. The expected response is short, but that does not establish a formal maximum.
Capability, speed, and cost trade-offs
Granite Guardian 4.0 3B Toxicity Japanese should be evaluated as a focused safety judge, not against large general-purpose models on conversation, reasoning, or code generation. Its reasoning score and coding score in the supplied data are editorial estimates of 2 and 1 respectively; they are not IBM benchmark ratings. Those low scores reflect the model’s narrow classification role rather than a claim that it cannot follow an evaluation prompt.
The supplied editorial assessment gives the model a speed score of 8 and a cost score of 9. These are also estimates based on its approximately 3B-parameter size and local-deployment profile, not provider-published measurements. In general, a smaller specialized model can be a practical choice when an application needs to screen many pieces of text quickly and cheaply. Actual throughput will depend on hardware, quantization, batching, concurrency, and the serving configuration.
The trade-off is breadth. A larger general-purpose model may be more appropriate when the same component must understand complex instructions, generate useful explanations, perform broad multilingual reasoning, or handle tasks beyond toxicity classification. Granite Guardian is attractive when a narrow, repeatable safety decision matters more than open-ended generation.
When to choose this model
Choose Granite Guardian 4.0 3B Toxicity Japanese when the main requirement is Japanese toxicity screening and the organization can operate an open-weight model locally. It is a good fit for:
- Screening Japanese user prompts before they reach a generative model.
- Checking Japanese assistant responses after generation.
- Adding harm, bias, jailbreak, violence, profanity, unethical-behavior, or sexual-content checks to a safety pipeline.
- Keeping moderation traffic inside a controlled environment.
- Reducing inference cost for a high-volume classifier compared with using a larger general-purpose model for every check.
- Building a custom moderation workflow around a binary JSON decision.
It may not be the right choice when an application needs image, audio, or video moderation; groundedness and relevance checks for retrieval-augmented generation; function-calling or agentic-risk evaluation; or a detailed natural-language explanation of why content was flagged. It is also not a replacement for the primary conversational model that generates user-facing answers.
Limitations and implementation guidance
The model’s binary result is only one input to a safety policy. A yes/no decision does not define the correct response for every context, and the same phrase may require different handling in an educational, healthcare, customer-service, or entertainment application. Teams should establish category-specific actions and test borderline cases before relying on the model in production.
Japanese language coverage is the central specialization, but application-specific language can still affect results. Slang, dialects, euphemisms, quoted harmful content, code-switching, and adversarial prompt formatting should be included in evaluation datasets. The model card’s warning about the judge protocol also means that prompt construction and output validation are operational requirements, not optional formatting details.
Finally, the absence of documented context and maximum-output limits in the supplied information should be treated as an unresolved deployment detail. Confirm the current model configuration before selecting batch sizes or designing an input truncation policy. For systems with several safety objectives, Granite Guardian 4.0 3B Toxicity Japanese is best viewed as the Japanese toxicity component of a layered guardrail system, rather than as a universal safety solution.