4B Nemotron 3.5 Content Safety Resolves AI Moderation Black Box

On June 4, 2026, NVIDIA released Nemotron 3.5 Content Safety, a 4-billion-parameter multimodal small language model engineered specifically for enterprise AI moderation. Built by fine-tuning Google’s Gemma-3-4B-it foundation model with merged LoRA adapters, the model unifies text and image input moderation into a single inference pass. For organizations running complex workflows, this provides a low-latency guardrail capable of catching safety violations that only emerge through the interaction of text and visual data.

Architecture and Performance

The model processes a 128K token context window containing the user prompt, optional images, and assistant responses. NVIDIA optimized the architecture for sub-second execution across Hopper, Blackwell, and Ada Lovelace microarchitectures. Benchmarks running on NVIDIA L4 GPUs via vLLM demonstrate throughput of approximately 68 tokens per second with a typical latency of 0.32s.

This tight execution window allows developers to deploy it inline as a filter without introducing blocking delays to the primary application pipeline. By routing traffic through a dedicated 4B model, engineering teams can offload the heavy AI inference overhead of safety checks from larger, frontier-class models.

Custom Policy Reasoning and Taxonomy

Nemotron 3.5 Content Safety classifies inputs across 23 categories based on the Aegis v2 taxonomy, covering vectors like malware generation, criminal planning, and PII exposure. It explicitly handles 12 languages while inheriting zero-shot capabilities for approximately 140 languages from its Gemma 3 base.

The most significant shift from traditional moderation endpoints is the inclusion of a togglable reasoning mode. Enterprises can input custom safety guidelines in natural language, and the model outputs an auditable explanation alongside its verdict. Because the model outputs reasoning traces, developers can debug why specific prompts trigger flags rather than guessing against a black-box system. This dual-use design allows it to function both as an active production guardrail and as an automated “judge” for evaluating AI output from other internal systems.

Ecosystem Availability

NVIDIA published the model weights and the accompanying Nemotron-3.5-Content-Safety-Dataset under the NVIDIA Open Model License. The release launched with broad Day Zero support across the inference ecosystem, including platforms like Vultr, DeepInfra, Baseten, and OpenRouter. It is also available as a production-ready NVIDIA NIM microservice on build.nvidia.com. The moderation model debuted alongside the massive Nemotron 3 Ultra 550B LatentMoE architecture and Nemotron 3.5 ASR.

If you are implementing safety filters in an enterprise environment, routing moderation to a specialized 4-billion-parameter model provides a highly scalable architecture. The low latency and transparent reasoning capabilities make it practical to enforce custom compliance policies directly in the request path.