NVIDIA Introduces Nemotron 3.5 to Moderate AI

NVIDIA introduces Nemotron 3.5 Content Safety, an open model that analyzes text, images, and assistant responses to detect risks according to each company's rules. It is designed to review content in real time without requiring massive infrastructure.

One review for text, image, and response

The model can receive three elements within the same context window: the user's message, an optional image, and the response generated by the assistant. It then issues a combined verdict on the safety of the entire interaction.

This makes it possible to detect problems that could go unnoticed when reviewing each part separately. For example, an apparently harmless request can become dangerous when combined with a specific image, or a response can add harmful instructions that were not in the original message.

Nemotron 3.5 also retains a 128,000-token context window, a measure of how much information it can process in a single input. The model is based on Gemma 3 4B IT, with 4 billion parameters, and uses a LoRA adapter to add safety capabilities while remaining relatively compact.

Custom safety policies

The main difference from Nemotron 3 is that a company can provide its own rules alongside each query. Not all applications face the same risks: a financial chatbot, a healthcare platform, a code editor, and a children's app need different policies.

With these instructions, a company can:

• Disable categories that are not relevant to its product.
• Create custom categories for regulatory or internal risks.
• Explain in natural language how edge cases should be interpreted.

This means a development tool could avoid flagging the phrase finish a process as violence, while a financial service could apply specific controls against fraud or unauthorized advice.

The model follows the Aegis 2.0 taxonomy, with 13 main categories and 10 subcategories. This makes it easier to compare its results with other moderation systems evaluated under the same standard.

Three ways to use it

Nemotron 3.5 offers three output modes:

• A quick safe or unsafe verdict.
• The verdict together with the detected categories.
• A reasoning mode that adds a brief explanation before the final decision.

The third mode might indicate, for example, that a request asks to buy a controlled substance and that the response includes specific steps for obtaining it. NVIDIA says these traces are usually less than three sentences long because they are generated and summarized before being added to the model.

This can be useful in regulated sectors. A human team can review why content was blocked, identify systematic errors, and adjust the company's policy. The tradeoff is higher latency, so the reasoning mode can be reserved for audits and asynchronous reviews, while the quick mode handles immediate decisions.

Multilingual coverage and results

Explicit training covers 12 languages: English, French, Spanish, German, Chinese, Japanese, Korean, Arabic, Hindi, Russian, Portuguese, and Italian. The model also inherits Gemma 3's generalization capabilities across approximately 140 languages, although not all have the same level of specific training.

In tests published by NVIDIA, the model achieves:

• An approximate average of 85% accuracy across the multimodal and multilingual evaluation set.
• 96.5% average accuracy on Multilingual Aegis for 12 languages.
• An 88.8% average on RTP-LX.
• A combined average of 92.7% across Aegis and RTP-LX.
• Up to three times lower latency than another multimodal safety model in one of the tests.

These figures are results from benchmarks selected by NVIDIA, not a guarantee that the model will always be correct in production. Moderation still requires oversight, especially in languages with less data and in ambiguous cases.

A model and its training data

NVIDIA is releasing Nemotron 3.5 Content Safety under the NVIDIA Open Model License for research and commercial use, together with part of the dataset used to train it. The model supports transformers, vLLM, and SGLang, and is also available as a GPU-optimized service through NVIDIA NIM.

The dataset includes multilingual data, images, documents, charts, and custom policy examples. According to NVIDIA, 99% of the training images are real photographs, although licensing restrictions prevent the company from publishing all of that material. Synthetic data accounts for approximately 10% of the total volume and is used mainly to expand examples of attacks and uncommon situations.

For you, the most important change is not simply that another model can classify harmful content. It is that moderation can move closer to each product's actual rules, across multiple languages and with images included. You will need to watch whether those explanations remain consistent, whether custom policies reduce false positives, and how the model performs outside controlled benchmarks.