The rapid proliferation and increasing sophistication of LLMs and vision-language VLMs have revolutionized AI applications, from enhancing productivity to generating creative content. AI agents today are performing increasingly difficult tasks and sometimes work with screenshots, PDFs, diagrams, memes, and mobile photos that appear in real conversations—and sometimes in multiple languages. Nonetheless, as these models grow to be more integrated into critical workflows and human-facing applications, the imperative for robust content safety mechanisms has grown exponentially.
Earlier safety models, which were text-only and mainly trained on English data, struggled with non-English and multilingual prompts, often missing cultural nuances. To handle this, NVIDIA created the multimodal, multilingual Nemotron 3 Content Safety model. It was trained using the novel, culturally aligned multilingual safety data from the Nemotron Safety Guard Dataset v3. A multilingual safety model trained on this data has demonstrated superior performance on multilingual benchmarks.
Why is multimodal content safety vital?
The complexity of multimodal input—corresponding to text paired with a picture—presents significant challenges for safety models, because the meaning is commonly non-additive. For example, a picture of a benign household object (like a standard kitchen knife) paired with the text “that is an amazing tool for cooking” is secure, but the identical image paired with the text “I will use this to harm someone” becomes a transparent policy violation requiring immediate moderation.
Multimodal-multilingual content safety is difficult since it requires understanding cultural and linguistic context, especially in multimodal AI. A security model must not only process multiple languages but in addition recognize how language and cultural context can alter the protection status of a prompt-image pair. For instance, a prompt containing a picture of a conventional religious symbol corresponding to the Swastika paired with text describing a celebration is likely to be perfectly acceptable in a single language and culture (corresponding to Indian), but when paired with an analogous image and text in a unique language (corresponding to German) that carries a history of inter-group conflict, the mix may very well be interpreted as incitement to hate speech or discrimination, requiring immediate moderation. This sensitivity to cultural nuance is critical for accurate, globally deployed content safety models.
How the Model Works
Nemotron 3 Content Safety is built on the Gemma‑3 4B‑IT vision‑language foundation model, which provides strong multimodal reasoning, instruction following, a 128K context window, and support for over 140 languages. NVIDIA positive‑tuned this base using a LoRA adapter, adding targeted safety classification behavior while keeping the model lightweight and efficient.
When a user provides text, a picture, or each, the model encodes the visual and language features jointly and outputs a concise safety judgment. If an assistant response is included, the model evaluates the combined interaction to find out whether the response is secure in context, enabling it to catch violations that arise only from the interplay between request, image, and output.
It supports two inference modes:
- Default low‑latency secure/unsafe classification for the user input and an assistant output. A sample output on this mode is:
User Safety: secure Response Safety: unsafe
User Safety: secure Response Safety: unsafe Safety Categories: Violence, Criminal Planning/Confessions
Safety categories follow the Aegis AI Content Safety Dataset v2 taxonomy that’s closely aligned with the ML Commons safety taxonomy and enables comparison across open and closed guard systems.
How Nemotron 3 Content Safety Was Built
Nemotron 3 Content Safety model was built on a robust underlying multimodal-multilingual base model and fine-tuned on culturally diverse multilingual and human-labeled multimodal datasets consisting of text, real‑world images, screenshots, documents, and targeted synthetic examples.
Our overall training data mix consists of:
- Multilingual content safety data from Nemotron Content Safety Dataset v3. The non-English data from this dataset were sampled from the “adapted” or culturally nuanced subset. The info was sampled to have a proportionally distributed representation across all safety categories in addition to representation from secure and unsafe data.
- Multimodal content safety data collected and human-annotated in English by NVIDIA and translated into multiple languages using Google Translate.
- Secure multimodal data consisting of images from scanned documents, papers, charts, graphs, etc., together with prompts looking for information from those images from the Nemotron VLM Dataset v2.
- Synthetic data generated to get a more diversified dataset.
The above data mix ensures multilingual and domain‑specific coverage across various harm categories corresponding to harmful language, self‑harm, harassment, privacy violations, jailbreak patterns, and region‑specific safety policies. All English-only text data was translated in 12 different languages – English, Arabic, German, Spanish, French, Hindi, Japanese, Thai, Dutch, Italian, Korean, and Chinese—mirroring the multilingual environments by which modern LLMs and enterprise agents operate. We remove safety categories from about 25% of the training data randomly along with the string toggle /no_categories. This teaches the model to skip the generation of safety categories if this toggle is turned on.
The mix ensures the model generalizes across each modalities and languages, something other comparable safety guards struggle with.
Synthetic data generation (SDG)
Synthetic Data Generation (SDG) was utilized to complement the human-sourced data. SDG contributed in several ways:
- Increasing the range of responses by generating outputs from various LLMs or prompting an LLM or VLM to adopt a unique persona when generating a response.
- Rephrasing responses for greater cultural relevance.
- Rephrasing human-generated prompts by altering the English dialect or tone.
- Creating “jailbreak” prompts or images.
- Generating diverse kinds of refusals.
Moreover, SDG was instrumental in acquiring highly specific data that might be difficult to acquire from human sources, corresponding to instances where secure inputs (prompts and pictures) resulted in unsafe responses. Open models like Mixtral 8x 22B, Gemma 3-27B, and Microsoft Phi-4 were integrated into our SDG pipeline.
It’s important to notice that synthetic data makes up only about 10% of the full training data; the bulk is sourced from humans, including manually written prompts and real images.
NVIDIA has long invested in open technologies for LLM safety and guardrails. The Nemotron 3 Content Safety model is the subsequent iteration of open content safety models from NVIDIA utilizing the prior work done in content safety.
Benchmarking
Nemotron 3 Content Safety was evaluated on established open multimodal and multilingual benchmarks, including Polyguard, RTP-LX, VLGuard, MM SafetyBench, and Figstep. These benchmarks test the scenarios real agents encounter: mixed‑language conversations, screenshots with embedded text, visually driven safety risks, and cases where meaning shifts only when text and pictures are considered together.
Across these benchmarks, the model delivers industry‑leading accuracy for its size. In multimodal harmful‑content tests, it achieved 84% accuracy on average, outperforming comparable open safety models.
This advantage carries through multilingual evaluations as well. The model maintains strong, consistent accuracy across 12 languages, including languages where many safety systems degrade sharply. This reflects each its multilingual training data and its ability to interpret image‑embedded text across languages. Moreover, the model shows strong zero-shot generalization across other languages corresponding to Portuguese, Swedish, Russian, Czech, Polish and Bengali.
Accuracy alone isn’t enough for agentic systems; safety checks must run without slowing the agent’s loop. Nemotron 3 Content Safety is optimized for low‑latency inference and shows roughly half the latency of larger multimodal safety models across mean, median, and P99 measurements. This permits real‑time use in planning loops, tool‑calling, and interactive applications—even on 8GB+ VRAM GPUs.
Taken together, the benchmarks show a model that’s accurate, multilingual, multimodal, and fast enough for real‑world deployment inside modern AI agents and safety‑critical workflows.
Getting Began
The Nemotron 3 Content Safety model is available on Hugging Face, making it easy so as to add multimodal and multilingual safety to your agentic AI applications. Developers can load the model through standard transformers or vLLM interfaces and run safety checks over text, images, or each together.
The model may be deployed inside an agent loop for synchronous moderation, utilized in batch pipelines for document or image review, or integrated as a security layer in custom services—helping teams ship accurate, real‑time multimodal moderation across global user bases.
In April, this model can even be available as a production‑ready NVIDIA NIM, giving developers a pre‑packaged, security‑hardened, GPU‑optimized inference microservice so you possibly can skip the low‑level model‑serving plumbing and ship reliable, scalable AI features to production much faster.
