Nemotron 3.5 Content Safety
NVIDIA
NVIDIA's multimodal content-safety classifier: a 4-billion-parameter fine-tune of Google's Gemma-3-4B-it with a SigLIP vision encoder at 896x896, trained as a LoRA adapter merged back into the base. It moderates inputs to and responses from both LLMs and VLMs, taking a prompt, an optional image, an optional response and an optional user-defined safety policy, and returning User Safety and Response Safety labels plus the violated Safety Categories from the Aegis Content Safety Dataset V2 taxonomy. In custom-policy mode it can emit a short reasoning trace before classifying. It unifies NVIDIA's earlier Nemotron 3 Content Safety multimodal model with the custom-policy capabilities of Nemotron Content Safety Reasoning 4B.
Strengths
- Moderates text and a single image together, covering VLM traffic as well as text-only LLMs
- Screens both sides of a turn - returns User Safety and Response Safety labels plus the violated Safety Categories
- Custom-policy mode: callers pass their own written policy and the model can emit a reasoning trace before the verdict
- Twelve declared languages: English, Arabic, German, Spanish, French, Hindi, Japanese, Thai, Dutch, Italian, Korean and Chinese
- Small enough to be practical - 4 billion parameters, tested on H100, A100 and RTX PRO 6000 BSE, and runnable under Transformers, vLLM or SGLang
- NVIDIA publishes false-positive rates on general-purpose benchmarks (MMMU 0.03, DocVQA 0.060, AI2D 0.001) rather than only harm-detection scores
- Open weights with the training dataset published alongside (nvidia/Nemotron-3.5-Content-Safety-Dataset)
Caveats
- Weakest published row by a wide margin: MM-SafetyBench prompt accuracy is 0.55, barely above chance for a binary safe/unsafe call
- Multilingual scores lag the English ones - XSafety prompt harmful F1 is 0.72 and LinguaSafe average F1 is 0.71, against 0.86 on Aegis 2.0
- The licence is compound, not plainly permissive: OpenMDW-1.1 plus Google's Gemma Terms of Use and Gemma Prohibited Use Policy, because the base model is Gemma-3-4B-it
- It flags safe content: a 0.060 false-positive rate on DocVQA means roughly 1 in 17 benign document questions is called unsafe
- Training data has known holes - annotators 'were instructed to ignore samples containing very graphic images', and all human-written prompts were English with other languages produced by Google Translate
- Handles a single image per request, and context is advertised only as 'up to 128K' with no exact token count stated
- Vendor
- NVIDIA
- License
- OpenMDW-1.1 (with Gemma Terms of Use)
- Release Date
- 2026-06-02
- Modalities
- textimage
| Benchmark | Score | Max |
|---|---|---|
| VLGuard (prompt harmful F1) | 0.9 | 1.0 |
| MM-SafetyBench (prompt accuracy) | 0.6 | 1.0 |
| XSTest (response harmful F1) | 0.9 | 1.0 |
| Aegis 2.0 (prompt harmful F1) | 0.9 | 1.0 |
| WildGuard (response harmful F1) | 0.8 | 1.0 |
| XSafety (prompt harmful F1) | 0.7 | 1.0 |
Capabilities
Resources
Pricing
Open weights on Hugging Face, self-hosted at no licence fee. NVIDIA states 'This model is ready for commercial use', with use governed by the OpenMDW License Agreement version 1.1 together with the Gemma Terms of Use and Gemma Prohibited Use Policy. Tested hardware: NVIDIA H100 80GB, A100 80GB and RTX PRO 6000 BSE.