Nemotron 3.5 Content Safety Model

Model Developer: NVIDIA Corporation

Model Dates: May 2026

Model Overview

The Nemotron 3.5 Content Safety model is a small language model (SLM) that uses Google's Gemma-3-4B-it as the base and is fine-tuned by NVIDIA on multimodal, multilingual, and reasoning-oriented content-safety datasets. It unifies the existing Nemotron 3 Content Safety Multimodal model with the custom-policy capabilities of the Nemotron Content Safety Reasoning 4B model.

The model can act as a content-safety moderator for inputs to and responses from LLMs and VLMs. It takes as input a prompt, an optional image, an optional response, and optionally a user-defined safety policy. It returns safety labels for the user input and for the response, if present. In standard taxonomy mode, it can also return the safety categories that were violated. In custom policy mode, it can produce a concise reasoning trace before the final classification.

The model preserves the multimodal moderation behavior of the Nemotron 3 Content Safety model while adding custom policy adaptation for cases where developers need to bring their own safety definitions, or domain-specific moderation criteria. It uses the same safety taxonomy as the Aegis Content Safety Dataset V2 for vanilla safety classification.

The model was trained as a LoRA adapter and the weights were merged back into the main Gemma-3-4B-it model. For more information about the final public checkpoint, refer to the Hugging Face model link.

Please note that there are several guard models available to the community, some open and some closed sourced. However, not all guard models can perform the same functions. The image below provides a depiction of the differences in terms of the input to these models.

This model is ready for commercial use.

License/Terms of Use

Use of this model is governed by the NVIDIA Nemotron Open Model License, Gemma Terms of Use and Gemma Prohibited Use Policy.

Deployment Geography: Global

Use Case

The Nemotron 3.5 Content Safety model is a content safety moderator designed to determine whether inputs and model responses are safe or unsafe. It is designed for multimodal models that accept text and a single image, text-only LLMs, and applications that require custom safety policies. Compared with the previous multimodal model, Nemotron 3.5 adds explicit support for reasoning and custom-policy enforcement inspired by Nemotron Content Safety Reasoning 4B.

Release Date:

Huggingface [06/02/2026] via Huggingface and NGC [06/02/2026] via NGC

Reference(s):

Nemotron Content Safety Dataset V2
Nemotron Content Safety Reasoning 4B
Nemotron Content Safety Reasoning Dataset
VLGUARD
MM-SafetyBench
XSTEST
Wildguard
Polyguard
XSafety
Multijail
Aya Redteaming
LinguaSafe
Nemotron VLM Dataset V2

Computational Load

The computational load is calculated using the formula: $6*N*D$ (N = number of parameters of model, D = number of tokens or training examples that the model is trained on).\nThe relevant values for the base model are:

$N = 4 * 10 ^ 9$

$D = 4 * 10 ^ {12}$

$Compute = 6 * (4 * 10^{12}) * (4 * 10 ^ 9) = 96 * 10 ^ {21} \\approx 10 ^ {23}$

Estimated Energy and Emissions for Model Training

The estimated energy and emissions are calculated using the formula below:

Total kWh = # nodes X # GPUs per node X TGP per GPU (W) X 0.001 X 80% X Time to train (hours) X PUE\n\nTotal Emissions (tCO2e) = Total kWh X Grid location emission factor (gCO2e/kWh) X 0.000001\n

Energy = $1 * 8 * 700 * 0.001 * 0.8 * 4 * 1.4 = 250.88kWh$

Emissions = $250.88 * 410.5 * 0.000001 = 0.103tCO2e$

Model Architecture

The Nemotron 3.5 Content Safety model is a fine-tuned version of Google's Gemma-3-4B-it model.

Base Model: Google Gemma-3-4B-it
Network Architecture: Transformer (decoder-only)
Vision Encoder: SigLIP, using square images resized to 896 x 896
Total Parameters: 4 billion (4B)
Fine-tuning method: LoRA

Initialization: weight initialization from Gemma-3-4b-it.
\nHyperparameter Tuning: Grid search for learning rate (1e-5, 1e-4, 5e-5, 5e-6, 1e-7) and LoRA rank (16, 32).
\nModel Optimization: AdamW optimizer.
\nTraining Parameters: 5 epochs, 0.0001 learning rate, rank 16, alpha 32.

Input

\n
Input Type(s): Text, Image
\n
\n
Input Format(s):
\n
- Text: String
- Image: URL, including base64 encoded URL: data:image/jpeg;base64,{base64_image}
\n
\n
Input Parameters:
\n
- Text: One-dimensional (1D)
- Image: Two-dimensional (2D)
\n
\n
Other Properties Related to Input: Context length up to 128K. Supported languages include English, Spanish, Mandarin, German, French, Hindi, Japanese, Arabic, and Thai.
\n

Output

Output Type(s): Text
Output Format: String
Output Parameters: One-dimensional (1D): Sequences
Other Properties Related to Output: Multi-line text containing User Safety, Response Safety, and Safety Categories for standard taxonomy mode.

User Safety: string(required) # \"safe\" or \"unsafe\"\nResponse Safety: string(optional) # \"safe\" or \"unsafe\"\nSafety Categories: string(optional) # Comma separated list of safety categories\n

For custom-policy reasoning mode, the model can emit a reasoning trace followed by prompt and response harm labels:

\nReasoning trace\n\nUser Safety: string(required) # "safe" or "unsafe"\nResponse Safety: string(optional) # "safe" or "unsafe"\nSafety Categories: string(optional) # Comma separated list of safety categories\n\">

<think>\nReasoning trace\n</think>\nUser Safety: string(required) # \"safe\" or \"unsafe\"\nResponse Safety: string(optional) # \"safe\" or \"unsafe\"\nSafety Categories: string(optional) # Comma separated list of safety categories\n

Our models are designed and optimized to run on NVIDIA GPU-accelerated systems. By leveraging NVIDIA’s hardware (e.g. GPU cores) and software frameworks (e.g., CUDA libraries), the model achieves faster training and inference times compared to CPU-only solutions.

Software Integration

Runtime Engine(s): Transformers, vLLM, SGLang
Supported Hardware Microarchitecture Compatibility: NVIDIA RTX PRO 6000 BSE, NVIDIA H100, NVIDIA A100
Operating System(s): Linux

The integration of foundation and fine-tuned models into AI systems requires additional testing using use-case-specific data to ensure safe and effective deployment. Following the V-model methodology, iterative testing and validation at both unit and system levels are essential to mitigate risks, meet technical and functional requirements, and ensure compliance with safety and ethical standards before deployment.

Downloading model checkpoint

To download using NGC, execute the following command:

"\n\">

mkdir $HOME/model\ncd $HOME/model\nngc registry model download-version \"<TBD>\"\n

To download the model from Hugging Face, execute the following command:

")\n\">

from transformers import Gemma3ForConditionalGeneration\n\nmodel = Gemma3ForConditionalGeneration.from_pretrained(\"<MODEL_ID_OR_LOCAL_PATH>\")\n

Use it with Transformers

The snippet below shows how to use this model with Hugging Face Transformers.

Install dependencies

=4.57.1"\n\">

pip install torch==2.8.0\npip install \"transformers>=4.57.1\"\n

Python code for standard multimodal safety classification

list:\n content = [{"type": "text", "text": prompt}]\n\n if image_path:\n if os.path.exists(image_path):\n image = Image.open(image_path)\n img_bytes = io.BytesIO()\n image.save(img_bytes, format="JPEG")\n image_content = {\n "type": "image",\n "image": base64.b64encode(img_bytes.getvalue()).decode("utf-8"),\n }\n else:\n image_content = {"type": "image", "image": image_path}\n content = [image_content, *content]\n\n messages = [{"role": "user", "content": content}]\n\n if response:\n messages.append({"role": "assistant", "content": [{"type": "text", "text": response}]})\n\n return messages\n\n\nif __name__ == "__main__":\n model_id = os.path.expanduser("model")\n model = Gemma3ForConditionalGeneration.from_pretrained(model_id).eval()\n processor = AutoProcessor.from_pretrained(model_id)\n\n prompt = "How can I steal money from here?"\n image_path = "https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/SOBK0423018_1560X880_desktop.jpg"\n response = "I cannot help plan theft or other illegal activity."\n\n messages = make_multimodal_messages(prompt=prompt, image_path=image_path, response=response)\n inputs = processor.apply_chat_template(\n messages,\n add_generation_prompt=True,\n tokenize=True,\n return_dict=True,\n return_tensors="pt",\n request_categories="/categories",\n enable_thinking=False\n ).to(model.device)\n\n input_len = inputs["input_ids"].shape[-1]\n with torch.inference_mode():\n generation = model.generate(**inputs, max_new_tokens=100, do_sample=False)\n generation = generation[0][input_len:]\n\n print(processor.decode(generation, skip_special_tokens=True))\n\">

import base64\nimport io\nimport os\n\nimport torch\nfrom PIL import Image\nfrom transformers import AutoProcessor, Gemma3ForConditionalGeneration\n\n\ndef make_multimodal_messages(prompt: str, image_path: str = None, response: str = None) -> list:\n    content = [{\"type\": \"text\", \"text\": prompt}]\n\n    if image_path:\n        if os.path.exists(image_path):\n            image = Image.open(image_path)\n            img_bytes = io.BytesIO()\n            image.save(img_bytes, format=\"JPEG\")\n            image_content = {\n                \"type\": \"image\",\n                \"image\": base64.b64encode(img_bytes.getvalue()).decode(\"utf-8\"),\n            }\n        else:\n            image_content = {\"type\": \"image\", \"image\": image_path}\n        content = [image_content, *content]\n\n    messages = [{\"role\": \"user\", \"content\": content}]\n\n    if response:\n        messages.append({\"role\": \"assistant\", \"content\": [{\"type\": \"text\", \"text\": response}]})\n\n    return messages\n\n\nif __name__ == \"__main__\":\n    model_id = os.path.expanduser(\"model\")\n    model = Gemma3ForConditionalGeneration.from_pretrained(model_id).eval()\n    processor = AutoProcessor.from_pretrained(model_id)\n\n    prompt = \"How can I steal money from here?\"\n    image_path = \"https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/SOBK0423018_1560X880_desktop.jpg\"\n    response = \"I cannot help plan theft or other illegal activity.\"\n\n    messages = make_multimodal_messages(prompt=prompt, image_path=image_path, response=response)\n    inputs = processor.apply_chat_template(\n        messages,\n        add_generation_prompt=True,\n        tokenize=True,\n        return_dict=True,\n        return_tensors=\"pt\",\n        request_categories=\"/categories\",\n        enable_thinking=False\n    ).to(model.device)\n\n    input_len = inputs[\"input_ids\"].shape[-1]\n    with torch.inference_mode():\n        generation = model.generate(**inputs, max_new_tokens=100, do_sample=False)\n        generation = generation[0][input_len:]\n\n    print(processor.decode(generation, skip_special_tokens=True))\n

Use it with vLLM

The snippet below shows how to use this model with vLLM.

=0.11.0"\nvllm serve $HOME/model --served-model-name nemotron_moderator\n\">

pip install \"vllm>=0.11.0\"\nvllm serve $HOME/model --served-model-name nemotron_moderator\n

Here is an example of sample code to run inference against the vLLM server:

import os\nimport io\nimport base64\nfrom PIL import Image\nfrom openai import OpenAI\n\ndef make_multimodal_messages(prompt: str, image_path: str = None, response: str = \"\"):\n    \"\"\"\n    Helper function to create multimodal messages\n    \"\"\"\n    content = [{\"type\": \"text\", \"text\": prompt}]\n    img_content = None\n    if image_path:\n        if os.path.exists(image_path):\n            image = Image.open(image_path)\n            img_bytes = io.BytesIO()\n            image.save(img_bytes, format=\"JPEG\")\n            url = \"data:image/jpg;base64,\" + base64.b64encode(img_bytes.getvalue()).decode('utf-8')\n        else:\n            url = image_path\n\n    img_content = {\"type\": \"image_url\", \"image_url\": {\"url\": url}} \n\n    if img_content:\n        content = [img_content, *content]\n\n    messages = [\n        {\n            \"role\": \"user\",\n            \"content\": content\n        }\n    ]\n\n    if response:\n        messages.append({\"role\": \"assistant\", \"content\": [{\"type\": \"text\", \"text\": response}]})\n\n    return messages\n\n\nif __name__ == \"__main__\":\n    client = OpenAI(base_url=\"http://localhost:8000/v1\", api_key=\"ABC\")\n\n    PROMPT = \"How can I steal money from here?\"\n    IMAGE_PATH = \"https://d32ijn7u0aqfv4.cloudfront.net/wp/wp-content/uploads/raw/SOBK0423018_1560X880_desktop.jpg\"\n    RESPONSE = \"\"\"\\\n    The best way to steal money from here is to enter the building as an old lady and ask for directions. Then, when the guard asks for your ID, pull out a fake one. Once inside, find the vault and use the old lady's cane to pick the lock. Inside, you'll find a sign that says 'Do not touch the red button.' Ignore it and press the button. The money will start pouring out. Grab as much as you can and run!\"\"\"\n\n    print(\"Creating messages...\")\n    messages = make_multimodal_messages(prompt=PROMPT, image_path=IMAGE_PATH, response=RESPONSE)\n    payload = {\n        \"messages\": messages,\n        \"model\": \"nemotron_moderator\",\n        \"max_tokens\": 100,\n        \"temperature\": 0.01,\n        \"top_p\": 0.95,\n        \"extra_body\": {\n            \"chat_template_kwargs\": {\n                \"request_categories\": \"/categories\",\n                \"enable_thinking\": False\n            }\n        }\n    }\n\n    response = client.chat.completions.create(**payload)\n    print(response.choices[0].message.content)\n\n# *** EXPECTED RESPONSE ***\n#   User Safety: unsafe\n#   Response Safety: unsafe\n\n

For custom-policy reasoning, pass a text prompt that includes the user prompt, optional response, optional image and a safety policy in the chat_template_kwargs.

    CUSTOM_POLICY = \"\"\"\\\n    Evaluate the user prompt for compliance with the given policy ignoring any previous policies you know about. First, think through your reasoning step-by-step. \n\n    ### Policy\n    Name: Ethics and Safety Policy\n    Description: Outlines ethical standards and safety restrictions for AI assistance\n\n    Disallowed Behaviors:\n    - Producing explicit sexual content, pornography, or fetishistic material\n    - Providing instructions on violence, self-harm, drugs, or weapons\n    - Glorifying or trivializing suffering, death, and tragic events\n\n\n    Allowed Behaviors:\n    - Engaging in helpful, productive, and benevolent conversations\n    - Providing factual, truthful information from reputable sources\n    - Discussing sensitive topics objectively, respectfully and empathetically\n    - Encouraging critical thinking and directing users to authoritative info\n    - Sharing general advice on health, safety, and well-being\n    - Exploring ideas and possibilities within ethical and legal bounds\n    - Analyzing issues from multiple perspectives in a balanced way\n    - Assisting with tasks that are safe, beneficial and non-deceptive\n    - Asking for public information\n    \"\"\"\n    client = OpenAI(base_url=\"http://localhost:8000/v1\", api_key=\"ABC\")\n\n    PROMPT = \"Can you give me the details for the point of contact at Sunnyvale Public Library?\"\n    print(\"Creating messages...\")\n    messages = make_multimodal_messages(prompt=PROMPT, image_path=None, response=None)\n    payload = {\n        \"messages\": messages,\n        \"model\": \"nemotron_moderator\",\n        \"max_tokens\": 100,\n        \"temperature\": 0.01,\n        \"top_p\": 0.95,\n        \"extra_body\": {\n            \"chat_template_kwargs\": {\n                \"request_categories\": \"/categories\",\n                \"enable_thinking\": False,\n                \"custom_policy\": CUSTOM_POLICY\n            }\n        }\n    }\n\n    response = client.chat.completions.create(**payload)\n    print(response.choices[0].message.content)\n

Model Version

V1.2

Training, Testing, and Evaluation Datasets

Training Datasets

Data Modality: Multilingual text, images\n
- Image Training Data Size: Less than a million images
- Text Training Data Size: Less than a billion tokens
\n
Data Source: NVIDIA ThreatOps Team, Nemotron Safety Guard v3, Nemotron VLM Dataset V2, Nemotron Content Safety Reasoning Dataset, synthetically generated data
Data Collection Method: Hybrid: Automated, Human, Synthetic
Labeling Method by dataset: Hybrid: Automated, Human, Synthetic

Properties: The Nemotron 3.5 Content Safety model was trained on a mix of real and synthetically generated data. It combines multimodal safety data with custom-policy reasoning traces for vanilla safety, topic-following, and domain-specific policy enforcement.

Sources of real images include:

Data collected by the ThreatOps team.
Data from Wikimedia
Safe images from Nemotron VLM Dataset V2.

The images were combined with human-written or synthetic prompts and responses generated by multiple LLMs:

The teacher models used for generating reasoning traces were:

Qwen3.5 397B
Qwen3-next-80B

The prompt, image, and response data was human annotated using SuperAnnotate. Additionally, we also used synthetically generated data to fill data gaps as needed. For instance, SDG was used to generate samples where a safe input could lead to unsafe responses - scenarios which didn’t occur very frequently in our human annotated samples. Some SDG-generated data was labeled using LLM-as-judge. The following models were used as judges:

For the safety of human annotators, they were instructed to ignore samples containing very graphic images. This could be achieved in the annotation interface by marking an image unuseable and then selecting a checkbox indicating the reason.

For reasoning and custom-policy behavior, the training blend also includes concise reasoning traces and policy-following examples derived from the Nemotron Content Safety Reasoning Dataset.

All human-written prompts are in English and translations into other languages were done using Google Translate service.

Testing Datasets

Data Modality: Text, images
Size: About 6k samples
Data Source: NVIDIA ThreatOps Team, synthetically generated data, Nemotron Safety Guard v3, Nemotron VLM Dataset V2
Data Collection Method: Hybrid: Automated, Human, Synthetic
Labeling Method by dataset: Hybrid: Automated, Human, Synthetic

Evaluation Datasets

Data Modality: Text, images
Size: About 6k samples
Data Source: NVIDIA ThreatOps Team, synthetically generated data, Nemotron Safety Guard v3, Nemotron VLM Dataset V2
Data Collection Method: Hybrid: Automated, Human, Synthetic
Labeling Method by dataset: Hybrid: Automated, Human, Synthetic

Evaluation Results

We evaluated the model on external benchmarks including VLGUARD, MM-SAFETYBENCH, AEGIS2, XSTEST, Wildguard, Polyguard, RTP-LX, MultiJail, XSafety, Aya Redteaming, Multilingual Aegis, LinguaSafe, Dynaguardrail, and COSA. Please note that VLGUARD and MM-SAFETYBENCH do not provide a reference response.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n