NVIDIA Nemotron 3: Multimodal and Multilingual AI Security

Nemotron 3: A Breakthrough in Multimodal Content Safety

The rapid proliferation and increasing sophistication of language models (LLMs) and vision-language models (VLMs) have revolutionized artificial intelligence applications, ranging from productivity enhancement to creative content generation. AI agents today perform increasingly complex tasks, often interacting with screenshots, PDFs, diagrams, memes, and mobile photos in real conversations, frequently in multiple languages. However, as these models become more integrated into critical workflows and user-facing applications, the demand for robust safety mechanisms for content has significantly increased.

Previous safety models, which were solely text-based and primarily trained on English data, struggled with non-English and multilingual queries, often lacking cultural nuances. To address this, NVIDIA has created the multimodal and multilingual content safety model Nemotron 3. It was trained using innovative multilingual safety data that is culturally aligned, sourced from the Nemotron Safety Guard Dataset v3. A multilingual safety model trained on this data has demonstrated superior performance on multilingual benchmarks.

Why is Multimodal Content Safety Important?

The complexity of multimodal input—such as text associated with an image—poses significant challenges for safety models, as meaning is often non-additive. For example, an image of a harmless household object (like a common kitchen knife) paired with the text "it's a great tool for cooking" is safe, but the same image paired with the text "I will use it to harm someone" constitutes a clear violation of policies requiring immediate moderation.

Multimodal and multilingual content safety is challenging because it requires understanding cultural and linguistic context, especially in multimodal AI. A safety model must not only handle multiple languages but also recognize how language and cultural context can alter the safety status of a text-image pair. For instance, a prompt containing an image of a traditional religious symbol such as the Swastika associated with text describing a celebration might be perfectly acceptable in one language and culture (like Indian), but when paired with the same image and text in another language (like German) that carries a history of intergroup conflict, the combination could be interpreted as incitement to hatred or discrimination, necessitating immediate moderation. This sensitivity to cultural nuances is crucial for accurate content safety models deployed globally.

How the Model Works

Nemotron 3 Content Safety is built on the Gemma‑3 4B‑IT base model, which offers robust multimodal reasoning, instruction tracking, a 128K context window, and support for over 140 languages. NVIDIA has refined this base using a LoRA adapter, adding targeted safety classification behavior while keeping the model lightweight and efficient.

When a user provides text, an image, or both, the model encodes the visual and linguistic features jointly and provides a concise safety judgment. If an assistant response is included, the model evaluates the combined interaction to determine if the response is safe in context, allowing it to detect violations that only arise from the interaction between the request, the image, and the output.

It supports two inference modes:

• Safe/unsafe classification by default with low latency for user input and assistant output. An example of output in this mode is:

  • User safety: safe
  • Response safety: unsafe

• Rich category output containing a list of violated safety categories when this information is relevant for another downstream application. An example of output in this mode is:

  • User safety: safe
  • Response safety: unsafe
  • Safety categories: Violence, Criminal planning/Confessions

The safety categories follow the taxonomy of the Aegis AI Content Safety Dataset v2, which is closely aligned with the ML Commons safety taxonomy and allows for comparison between open and closed guard systems.

How Nemotron 3 Content Safety Was Built

The Nemotron 3 content safety model was constructed on a solid multimodal-multilingual foundation and refined on culturally diverse and human-annotated multimodal and multilingual datasets, including text, real-world images, screenshots, documents, and targeted synthetic examples.

Our global training data mix consists of:

• Multilingual content safety data from the Nemotron Content Safety Dataset v3. The non-English data from this set was sampled from the "adapted" or culturally nuanced subset. The data was sampled to have a proportionally distributed representation across all safety categories as well as a representation of safe and unsafe data.

• Multimodal content safety data collected and annotated by humans in English by NVIDIA and translated into multiple languages using Google Translate.

• Safe multimodal data including images of scanned documents, papers, graphs, etc., as well as prompts seeking information from these images sourced from the Nemotron VLM Dataset v2.

• Synthetic data generated to achieve a more diverse dataset.

The above data mix ensures multilingual and domain-specific coverage across various categories of harm such as harmful language, self-harm, harassment, privacy violations, jailbreak patterns, and region-specific security policies. All text data originally in English has been translated into 12 different languages—English, Arabic, German, Spanish, French, Hindi, Japanese, Thai, Dutch, Italian, Korean, and Chinese—reflecting the multilingual environments in which modern LLMs and enterprise agents operate. We randomly remove safety categories from about 25% of the training data in conjunction with the chain toggle /no_categories. This teaches the model to ignore the generation of safety categories if this toggle is activated.

The mix ensures that the model generalizes across both modalities and languages, which other comparable safety systems struggle to achieve.

Synthetic Data Generation (SDG)

Synthetic Data Generation (SDG) has been used to complement data from human sources. SDG has contributed in several ways:

• Increasing response diversity by generating outputs from various LLMs or prompting an LLM or VLM to adopt a different persona when generating a response.

• Rephrasing responses for greater cultural relevance.

• Rephrasing human-generated prompts by modifying the dialect or tone of English.

• Creating "jailbreak" prompts or images.

• Generating various types of refusals.

Additionally, SDG has been essential for acquiring highly specific data that would be difficult to obtain from human sources, such as cases where safe inputs (prompts and images) led to unsafe responses. Open models like Mixtral 8x 22B, Gemma 3-27B, and Microsoft Phi-4 have been integrated into our SDG pipeline.

It is important to note that synthetic data represents only about 10% of the total training data; the majority comes from human sources, including manually written prompts and real images.

NVIDIA has long invested in open technologies for LLM safety and guardrails. The Nemotron 3 content safety model is the next iteration of NVIDIA's open content safety models leveraging previous work done in this area.

Nemotron 3 Content Safety has been evaluated on established open multimodal and multilingual benchmarks, including Polyguard, RTP-LX, VLGuard, MM SafetyBench, and Figstep. These benchmarks test scenarios that real agents face: mixed-language conversations, screenshots with embedded text, visually motivated security risks, and cases where meaning only changes when text and images are considered together.

Through these benchmarks, the model offers industry-leading accuracy for its size. In multimodal harmful content tests, it achieved an average accuracy of 84%, outperforming comparable open safety models.

Conclusion

The Nemotron 3 content safety model is available on Hugging Face, making it easy to add multimodal and multilingual safety to your AI applications. Developers can load the model via standard transformers or vLLM interfaces and perform safety checks on text, images, or both together.

The model can be deployed within an agent loop for synchronous moderation, used in batch pipelines for document or image review, or integrated as a safety layer in custom services, helping teams provide accurate and real-time multimodal moderation across global user bases.