Introducing Shield 1.1

Shield 1.1 is Shield Large with a retrained language model. We trained it further on newly labeled text of the kind agents read (tool results, MCP tool descriptions, agent skills, web pages and agent traces), and it now runs unquantized. The model ID is still shield-large, requests and responses are unchanged, and it stays included in every paid ZeroLeaks plan.

On the benchmark from the Shield 1 model card, Shield Large's overall score rises from 90.4% to 91.5%, and it is higher in each of the five categories.¹ Pooled over the headline sets, it flags 84.8% of attacks, against 84.5% for Shield 1, and 4.1% of benign texts, against 5.4%.

We also used this benchmark (43 sets, 35 of which count toward the score) to choose between training rounds, so it is not unseen data for this model. We report it because it is the yardstick from Shield 1's launch. A fresh held-out test will follow.

What changed

Shield Large combines two models: a Qwen3-1.7B classifier, which we call its language model, and Shield Base. Its score is 0.6 times the language model's probability plus 0.4 times Shield Base's, and it flags a text when that score reaches 0.5 or when Shield's rules match. Shield 1.1 keeps the combination, the threshold and the rules. Two things changed.

A retrained language model. We continued training Shield 1 Large's own language model rather than starting over. Two frontier language models from different providers labeled the new corpus, and we kept a text only where both agreed. The corpus includes 39,618 generated records built for agents: attacks hidden in skill files, tool outputs, MCP descriptions, web pages and agent traces. Each attack comes with two benign copies of the same text, one left as it was and one where the inserted passage is harmless or quotes the attack as data.

Blind AI reviewers re-labeled random samples of the generated data. They are AI agents, and they did not see the accepted labels or the labeling models' answers. Both batches passed the 95% bar, the second with one AI reviewer instead of two. The 2025 and 2026 public sources had no separate audit. The model card addendum lists each audit.

New data alone made the model forget. Our first round improved agent attacks and false alarms, but it missed hundreds more jailbreaks and non-English attacks than the original did, most of them Chinese. Three changes fixed that. Training mixes in a replay of Shield 1 Large's own training data. The original model acts as a teacher, but a guard stops it from pulling any trusted benign text toward "attack", which protects false alarms. And the model we serve is an equal-weight average of the original and retrained weights, a setting we fixed in advance of the evaluation reported here.

Unquantized serving. Shield 1 Large runs its language model as a 4-bit build. Shield 1.1 runs it unquantized. On the same hardware, it answers short texts in about half the time Shield 1 Large took, and long texts in roughly the same time.³

Where the gain comes from

Running the original Shield 1 language model unquantized already raises the overall score from 90.4% to 91.0%.⁴ That is about half of Shield 1.1's gain (53%); training adds the rest. The split differs a lot by category:

Training did most of its work on agent attacks and multilingual text. On agent attacks, Shield Large with the retrained model scores 2.1 points above the unquantized original. On prompt injection, jailbreaks and false alarms, most of the gain comes from running unquantized. On jailbreaks (−0.3 points), the retrained model is slightly below the unquantized original, though Shield Large with it still scores above Shield 1 Large as deployed.

False alarms fell on all six datasets in the false-alarm category:

One benign-only dataset outside that category moved the other way: on Turkish over-refusal prompts (multilingual), Shield 1.1 flags 4.2% of benign texts, against 3.7% for Shield 1 Large.

Regressions

Shield 1.1 is better on average, not on every dataset. It scores higher than Shield 1 Large on 25 of the 35 headline datasets, the same on 2, and lower on 8: Lakera b3 agent benchmark, MCPTox, promptprotection agent flows, Turkish over-refusal prompts, HackAPrompt 2.0 (Pliny track), AgentInjectionBench, ChangeMore (Chinese) and Kubernetes manifests. On those eight, Shield 1 Large is the better model. The largest drop is on the Lakera b3 agent benchmark, from 68.4% to 65.2%. Shield 1 Large will not stay selectable, so if your traffic looks like these datasets, test Shield 1.1 on it before relying on the change.

Agent attacks are still the weakest category, at 81.9%. On four datasets, all in agent attacks, Shield 1.1 scores below 70%: DTap malicious skills (62.6%), RTC-Bench computer-use injections (64.6%), Lakera b3 agent benchmark (65.2%) and DTap tool-description injections (67.0%). The model card addendum lists every dataset.

Comparison with other detectors

We ran 14 other detectors on the same 43 sets with the same scorer, each at its default setting: GPT-6.1 Sol as a judge, paid guardrail services and open models.⁵ Shield 1.1 has the highest overall score of the 16 detectors, at 91.5%, ahead of GPT-6.1 Sol as a judge (89.0%) and of Jev by TypeSafe (84.6%), the strongest of the rest.

Shield 1.1 does not lead every category. GPT-6.1 Sol as a judge is the better detector for agent attacks and prompt injection: it scores 93.3% on agent attacks and 98.8% on prompt injection, against 81.9% and 96.8% for Shield 1.1. It needs a language-model call for every text. NVIDIA NemoGuard leads the false-alarm category, at 100.0% against 95.6% for Shield 1.1, but it catches only 2.0% of attacks, against 84.8%.

Pooled over every text, Shield 1.1 catches 84.8% of attacks and flags 4.1% of benign texts. GPT-6.1 Sol as a judge catches 78.7% of attacks and flags 3.5% of benign texts.

How we measured

We scored Shield 1.1 the way the Shield 1 model card scores every detector: balanced accuracy on each dataset (the share of attacks flagged, the share of benign texts left alone, or the mean of the two on mixed datasets), averaged within each category, then across the five categories. Every dataset was first published in 2025 or 2026. We screened the new training data and the replayed Shield 1 data against the benchmark texts with exact and near-duplicate matching, and removed what overlapped.

Before the first training round, we fixed the rule a new language model had to meet to replace the old one. Under that rule, Shield Large had to score higher than Shield 1 Large in every category, and at least 0.005 higher overall, on both training seeds. Four earlier candidates failed it. We looked at the benchmark after each of those rounds, so the benchmark helped choose the training changes.

A separate development panel of 13,754 texts in 104 datasets, screened against both the benchmark and the training data, then confirmed the blend weight we had fixed in advance. The seed we ship was chosen on that panel, by a rule that uses only the panel but was written on 27 October 2026, after both seeds' benchmark scores were known. The seed it chose scores slightly lower on the benchmark than the other one.

To separate what training did from what running unquantized did, we also scored the original Shield 1 language model unquantized, in the same runtime as Shield 1.1.

Get started

If you already call shield-large, there is nothing to change. Otherwise, create a key in Shield in your dashboard and point the OpenAI client at Shield:

import OpenAI from "openai";

const shield = new OpenAI({
  apiKey: process.env.ZEROLEAKS_API_KEY,
  baseURL: "https://api.zeroleaks.ai/v1",
});

const { results } = await shield.moderations.create({
  model: "shield-large",
  input: toolResult,
});

if (results[0].flagged) {
  // Apply your application's policy before the agent reads this text.
}

Check results[0].flagged, and read shield.coverage for long inputs: a clean verdict on a long document doesn't mean every token was scored. The quickstart covers all four tiers.

Availability

From Thursday, 29 October 2026, shield-large serves Shield 1.1 on every paid ZeroLeaks plan, at the same price as Shield 1 Large and with no new key. Shield (small) and Shield Base are unchanged, Shield Tiered gets Shield 1.1 on the texts it escalates to Shield Large, and the free Shield tier works as before. Data handling is unchanged too: paid requests retain no submitted content.

The verdicts on some texts will change. Across the 22,001 texts in the headline sets, Shield 1.1 gets 414 right that Shield 1 Large got wrong, and 249 wrong that Shield 1 Large got right. If your application's policy was tuned on Shield 1 Large's verdicts, check it on your own traffic.

Shield Large's weights are not published. The small Shield model's weights remain available for noncommercial use under CC BY-NC 4.0.

The model card addendum has every dataset, the training data and its audits, and the known failure modes; for everything that did not change, it points to the Shield 1 model card. The technical report describes the method and each training round, including the ones that failed.