NVIDIA Nemotron 3.5 Content Safety Release

TL;DR

NVIDIA announced Nemotron 3.5 Content Safety, a single 4B-parameter model that unifies multimodal input, multilingual reach, custom enterprise policy enforcement, and auditable reasoning in one inference call.

Unified Multimodal Evaluation

Nemotron 3.5 evaluates a user prompt, an optional image, and an optional assistant response together as a single context window to produce a coherent safety verdict over the combined input. This joint evaluation closes the gap where policy violations only emerge from the interaction between text and image, or between request and response, which were missed when scoring each modality independently.

Global Language Coverage

Nemotron 3.5 retains explicit training in twelve languages—English, French, Spanish, German, Chinese, Japanese, Korean, Arabic, Hindi, Russian, Portuguese, and Italian—while inheriting zero-shot generalization across roughly 140 additional languages from the Gemma 3 base model. Deployments in low-resource markets benefit from this transfer without needing separate fine‑tuning.

Custom Policy Enforcement

The model accepts a custom policy specification alongside the input and reasons over that policy when producing its verdict, rather than relying solely on a built‑in taxonomy. This enables enterprises to suppress irrelevant categories, inject proprietary risk categories, and adapt safety behavior to domain‑specific rules such as those for healthcare, finance, or children’s apps.

Reasoning Traces (THINK Mode)

When THINK mode is enabled, Nemotron 3.5 outputs a step‑by‑step reasoning trace before delivering a final safe/unsafe label and optional violated categories. An example trace format is:

[step-by-step reasoning trace]

User Safety: unsafe
Response Safety: unsafe
Safety Categories: Criminal Planning/Confessions, Controlled Substances

If latency is critical, THINK mode can be disabled to return to the same low‑latency binary verdict available in Nemotron 3.

Safety Dataset

NVIDIA is releasing the Nemotron 3.5 Content Safety Dataset, which is multimodal, multilingual, and includes the safety reasoning traces used to train the model. The dataset combines real‑photograph multimodal data, multilingual text safety data, safe VLM data, reasoning traces derived from larger teacher models, topic‑following data, and a small portion of synthetic data for jailbreak diversification.

Model Architecture

Nemotron 3.5 Content Safety is built on Google Gemma 3 4B IT (4B parameters) with a 128K context window, strong vision‑language reasoning, and broad multilingual coverage. A LoRA adapter fine‑tunes the base model to install targeted safety classification behavior while keeping the model compact for real‑time deployment on 8GB+ VRAM GPUs. The model supports three output modes: low‑latency binary verdict, binary verdict with categories, and THINK mode (reasoning + verdict).

Reasoning

Reasoning provides the context, customization, and accountability required for production AI systems, especially in regulated environments. It enables dynamic interpretation of custom policies, delivers auditable justifications for compliance logging and human review, and reveals edge‑case interpretations to inform policy iteration. Condensing reasoning traces into concise summaries limits output tokens and maintains efficiency, a technique carried over from the Nemotron Content Safety Reasoning 4B model.

Latency

In the default (no THINK) mode, latency is unchanged from Nemotron 3. Enabling THINK mode adds inference time proportional to trace length, but this overhead is predictable and can be budgeted separately—for example, by running THINK‑mode evaluation asynchronously in an audit pipeline while the default mode handles real‑time decisions. Compared to an alternative multimodal safety model, Nemotron 3.5 achieves 3x lower end‑to‑end latency on a multimodal benchmark and generates up to 50% fewer tokens when reasoning is enabled.

Addressing the Benchmark Gap

Existing multimodal safety benchmarks suffer from text‑only coverage, reliance on synthetic images (typically SDXL) that lack real‑world texture, and licensing restrictions that prevent redistribution of real photographs. These gaps mean benchmark results may not reflect production difficulty. NVIDIA’s training data uses real images and culturally nuanced multilingual prompts to mitigate some gaps for model training, but the evaluation gap remains an open problem for the broader safety research community.

Getting Started

Nemotron 3.5 Content Safety is available on Hugging Face under the NVIDIA Open Model License for research and commercial use, together with the training dataset. It supports Transformers, vLLM, and SGLang, and is offered as a production‑grade NVIDIA NIM (nvcr.io/nim/nvidia/nemotron-3.5-content-safety:2.0.5-variant) on build.nvidia.com. The model can also be accessed via inference platforms including Baseten, Eigen AI, DeepInfra, OpenRouter, and Vultr. For custom policy workflows, NVIDIA provides a Claude‑ and Codex‑compatible skill for generating custom policies and cookbooks showing how to use the model.