Last updated: 2026-07-23
Last verified: 2026-07-23
TL;DR: Nemotron 3.5 Content Safety is a 4-billion-parameter NVIDIA model for classifying text, a single image, and an optional model response under either NVIDIA’s standard taxonomy or a policy supplied by the developer. It is relevant to teams that need multilingual, multimodal moderation and can operate an open model, but it still needs testing against the organization’s own policy and failure cases.
What launched?
NVIDIA released the public Nemotron 3.5 Content Safety checkpoint in June 2026. The model combines the image-aware moderation behavior of Nemotron 3 Content Safety with the custom-policy and reasoning options of NVIDIA’s earlier safety reasoning model.
The release is more specific than a general-purpose guardrail. It accepts a user prompt, an optional image, an optional assistant response, and an optional policy definition in one request. The output can include safety labels for the input and response, violated categories under the standard taxonomy, or a concise reasoning trace when custom-policy mode is used.
What Nemotron 3.5 can evaluate
The official model card describes a Gemma 3 4B base with a 128K context window and a SigLIP vision encoder. NVIDIA lists explicit support for 12 languages and says the Gemma base contributes broader zero-shot language coverage. That makes the model a candidate for global moderation pipelines, not proof that every language or cultural context performs equally well.
- Classify a user prompt by itself or together with one image.
- Evaluate an assistant response alongside the original input.
- Apply a developer-supplied policy instead of relying only on the default taxonomy.
- Return a low-latency verdict or a reasoning trace for later audit work.
- Run through Transformers, vLLM, SGLang, or NVIDIA NIM deployment paths.
Where it fits
The clearest use case is a moderation layer around a chatbot, visual assistant, document workflow, or customer-support system that handles both text and images. A financial-services team might define rules for investment advice and personal data. A children’s product might use a different policy for age-appropriate images and conversation. The custom policy is the main reason to test this release instead of treating it as another fixed-label classifier.
Teams should keep a separate human escalation path. Safety classifiers can miss harmful material, over-block benign requests, and behave differently across languages or image types. A model verdict should feed a documented decision process rather than silently become the policy.
Access, license, and cost
The weights and NVIDIA’s multimodal safety dataset are available through Hugging Face. The model card lists OpenMDW 1.1, the Gemma Terms of Use, and the Gemma Prohibited Use Policy. Commercial teams should review all three before deployment instead of assuming that “open weights” removes license obligations.
There is no separate SaaS subscription or free-plan promise for the model itself. Downloading the checkpoint does not remove GPU, hosting, observability, or evaluation costs. NVIDIA also offers a NIM route for packaged inference, which has its own deployment and support considerations.
How to test it safely
- Build a held-out set from real policy categories, languages, image types, and borderline cases.
- Run the same set under the default taxonomy and the organization’s custom policy.
- Measure false negatives, false positives, latency, and disagreement with trained reviewers.
- Check the NIM limitation that image-only requests require an accompanying text prompt.
- Define when the application blocks, warns, logs, or escalates a verdict before production use.
Risks and limits
NVIDIA publishes benchmark results, but those numbers do not predict performance on a company’s own policy or traffic. Real moderation data contains ambiguous jokes, regional context, adversarial prompts, screenshots, low-quality images, and policy exceptions that benchmark averages can hide.
Reasoning traces can help an auditor understand a decision, but they also add latency and should not be treated as guaranteed explanations of the model’s internal process. Production teams need independent logs, appeal handling, and periodic human review.
Alternatives
Compare Nemotron 3.5 with Llama Guard, managed moderation APIs, smaller internal classifiers, and rule-based controls. The useful comparison is not one headline accuracy number. It is policy fit, language coverage, image handling, deployment control, latency, licensing, and the cost of reviewing mistakes.
Kingy AI verdict
Nemotron 3.5 is worth a controlled evaluation for teams that need multimodal moderation with organization-specific rules. Start with shadow-mode classification and human comparison. Do not make it the sole control for a regulated or customer-facing workflow until the model has been tested on representative traffic.
FAQ
What does Nemotron 3.5 Content Safety moderate?
It can classify text, one optional image, and an optional assistant response. Developers can use NVIDIA’s standard taxonomy or supply a custom policy.
Is Nemotron 3.5 Content Safety free?
The checkpoint is downloadable, but licensing, compute, hosting, and support costs still apply. Review the model card’s listed licenses before commercial use.
Can it process an image without text?
NVIDIA’s current NIM release notes say image-only requests are not supported; include a text prompt with the image.
Official links
- NVIDIA launch article
- Model card and checkpoint
- Training and evaluation dataset
- NVIDIA NIM release notes
Related Kingy AI links
Kingy Launch Brief
Put the week’s verified AI launches in your inbox.
Every Friday, the verified AI launches, apps, funding rounds, pricing changes and under-the-radar moves worth knowing—source-linked and explained in five minutes.
Free · Every Friday · Unsubscribe anytime · No daily email