NVIDIA researchers Varun Singh, Isabel Hulseman, Anuj Doshi, and Shyamala Prayaga unveiled Nemotron 3.5 Content Safety, a 4B-parameter open guardrail model designed to evaluate text and image inputs in a single inference call. Built on Google's Gemma 3 4B IT base with a 128K context window, the system achieves an average accuracy of about 85% across multimodal safety benchmarks. Enterprise developers can now enforce custom safety policies and generate auditable reasoning traces directly within production AI pipelines.
Unified Multimodal Filtering and Custom Policy Reasoning
Unlike traditional safety systems that evaluate text and images independently, Nemotron 3.5 evaluates user prompts, optional images, and assistant responses simultaneously. This unified evaluation approach catches complex policy violations that only emerge through interactions between text and visual media.
The model also introduces runtime policy enforcement, extending concepts from Nemotron Content Safety Reasoning 4B. Organizations can feed custom natural language policies into the context window alongside the user query, allowing specific domain rules for healthcare, finance, or corporate tools. This capability enables category suppression—such as allowing developer tools to process phrases like "terminate a process"—as well as custom risk injections tailored to specific enterprise requirements.
Compact Architecture and Auditable THINK Mode
To enable fast enterprise deployment, NVIDIA fine-tuned the compact Gemma 3 4B base model using a Low-Rank Adaptation (LoRA) adapter. This architecture allows real-time inference on GPUs with 8GB or more of VRAM while maintaining broad zero-shot multilingual generalization across roughly 140 languages.
For compliance and auditing, Nemotron 3.5 features an optional THINK mode that generates step-by-step reasoning traces before outputting a verdict. To keep response times low, NVIDIA distilled complex chain-of-thought logic from large teacher models—specifically Qwen 397B and Qwen 80B—so that most reasoning explanations remain under three sentences long. When latency is paramount, developers can turn off THINK mode to output low-latency binary safe or unsafe classifications.
Key Performance Benchmarks and Features
NVIDIA evaluated the model against standard industry benchmarks including VLGuard, MM-SafetyBench, PolyGuard, and Aegis 2.0. Key capabilities and benchmark results include:
- Multilingual Aegis Accuracy: Achieved a 96.5% average harmful-content classification accuracy across 12 explicitly trained languages.
- RTP-LX Performance: Scored an average of 88.8% on RTP-LX benchmark tests, leading to a combined 92.7% score across Aegis and RTP-LX datasets.