Implement · NVIDIA Nemotron 3 Ultra

Can you run it?

Ownership levelSubstantialnone·limited·partial·substantial·fullAnalytical input C · 63.6/100

This page is a projection of the one entry record, the Reliability and Data control factors that Implement covers. The full verdict is set by all four factors together, floor-weighted so the weakest caps the whole.

Which domain expands which factor

AssessUse & modify + Transparency
ImplementData control + Reliability
UseReliability
SupportTransparency

Install & run

Download the ungated safetensors from the verified nvidia org on Hugging Face and serve with vLLM, SGLang or NVIDIA NIM on a multi-node cluster. Pin the exact revision and verify checksums before loading.

Hardware & VRAM requirements

Ultra is frontier-scale: 550B total / 55B active needs a multi-GPU / multi-node cluster. Official BF16 and NVFP4 quantizations reduce the footprint but do not remove the multi-node requirement. Plan sharding topology and memory before load; exact per-GPU VRAM is not restated here.

Serving stacks

vLLM, SGLang and NVIDIA's own NIM self-hosted microservices. NIM runs on your own infrastructure, so data stays in your enclave. Ecosystem breadth is narrower than the smaller Nemotron 3 text models, which is part of why operational sits at 3.

Safe-deployment controls & Deployment Ceiling

Deployment Ceiling: T3 (bounded autonomous), conditional. Because there is no model-level safety evaluation, the controls are your responsibility to assemble: a downloadable guard classifier (Nemotron-3-Content-Safety), the NeMo Guardrails toolkit for input, output and action rails, and the garak red-team scanner. The conditions: run garak (or equivalent) for your own use case, and for EU high-stakes use treat systemic-risk status as unresolved (training compute undisclosed). The OpenMDW licence imposes no field-of-use restriction. Complete the pre-deployment gate in the safe-deployment playbook.

Available quantizations

NVIDIA publishes official BF16 and NVFP4 variants of Ultra alongside the base safetensors, so a low-precision path is first-party rather than community-only.

Fine-tuning & adaptation

A representative training recipe (Pretrain -> SFT -> MOPD -> Quant) is released with CC-BY post-training data, so adaptation is realistic. Reproduction is not: the intermediate checkpoints the recipe depends on are not open-sourced, and the 1M-context phase is excluded because its data is not open. Adapt from the released checkpoint rather than expecting a full re-run.

API / OpenAI-compatible integration

Serve behind vLLM/SGLang or NVIDIA NIM for OpenAI-compatible endpoints. A hosted build.nvidia.com preview API exists for evaluation, but treat it as an evaluation surface only: it does not store content at session end, yet reserves use of content "to improve NVIDIA products and services, including AI models".

How this scores

The ownership factors this domain covers, drawn from the one entry record.

ReliabilityIs it reliable and good enough for the job?

Moderate

Operational is 3 (runs on mainstream stacks with official quantizations, but is a multi-node-only 550B model with no small-variant drop-in) and safety is 3 (no dedicated model-level safety evaluation, so misuse control is a gap you must fill yourself). Under the ownership rule, a safety score of 3 caps this factor at moderate.

How this scores (AOI sub-dimensions)

Operational3/5how practical it is to run, serve and maintain in productionRuns on mainstream stacks (vLLM, SGLang, NVIDIA NIM) with official BF16 / NVFP4 quantizations and documented hardware expectations.

Safety3/5whether misuse risks are evaluated and guardrails are providedA safety-tuned release (post-training safety data plus keyword/regex filtering) with the downloadable family guard stack - the Nemotron-3-Content-Safety classifier, the Apache-2.0 NeMo Guardrails toolkit and the Apache-2.0 garak scanner - genuinely attributable to Ultra.

Doesn't extract your dataDoes running it keep your knowledge and data yours?

Strong

Self-hosted via NIM, the weights and inference run on your own infrastructure and data never leaves your enclave, and the OpenMDW grant claws back no rights - it is 'without restriction' with only a defensive termination. That is the clearest strong case for data control in the family.

How this scores

Not a scored AOI dimension. For a self-hosted model, data-control is a structural property of running the weights yourself, strong by default unless the model phones home or the licence claws back rights. For a hosted API this factor is the retention + train-on-inputs + residency read, scored from the binding terms.

What this means for adoptionUltra is the one Nemotron 3 release whose ownership reaches substantial: the OpenMDW 'deal without restriction' grant makes use-and-modify strong, self-hosting via NIM makes data control strong, and the open_weights_recipe transparency is strong - so you can use it, see it and keep your data outright. It stops short of full because reliability is only moderate: there is no dedicated model-level safety evaluation, and at 550B / 55B active it is a multi-node deployment. Self-host, assemble the downloadable guard stack, red-team for your own use case, and treat EU systemic-risk status as unresolved until NVIDIA discloses training compute.

Sources

The same evidence records as the entry sheet. Read means the text was verified; unverified means it is known to exist but not yet read.

Model cardread2026-08-03

Nemotron 3 Ultra model card on the verified nvidia HF org: 550B total / 55B active; Mamba2-Transformer hybrid LatentMoE + MTP; up to 1M context; ~20T training tokens; ungated safetensors with BF16/NVFP4 variants; card states "open models with open weights, training data, and recipes"; licence tag openmdw-1.1.

Licenceread2026-08-03

OpenMDW License Agreement v1.1, read: "permission is hereby granted, free of charge, to deal in the Model Materials without restriction, including under all copyright, patent, database, and trade secret rights"; "Model Materials" covers weights, data, documentation and software.

Documentationread2026-08-03

Ultra training recipe at github.com/NVIDIA-NeMo/Nemotron (docs/nemotron/ultra3, Pretrain -> SFT -> MOPD -> Quant), read: described as "a representative single pass"; the "intermediate checkpoints it depends on have not been open-sourced" and the "1M-context LC phase is not included because its data ...

Technical_reportread2026-08-03

Nemotron 3 White Paper (arXiv 2512.20856), read: Ultra is a Mamba2-Transformer hybrid LatentMoE, up to 1M context.

Model cardread2026-08-03

Safety, read: no dedicated model-level safety evaluation for Ultra (white paper safety section is a contributor list; safety appears only as post-training data curation - Nemotron Content Safety v2 + Gretel refusal data + keyword/regex filtering).

Documentationread2026-08-03

Verified nvidia org on Hugging Face; the Ultra weight repo is ungated safetensors with published BF16/NVFP4 quantization variants.

Terms of serviceread2026-08-03

NVIDIA NIM is self-hosted deployment tooling ("data never leaves your secure enclave"), so NVIDIA is not an AOI inference-provider entry and self-hosting Ultra supports data control.

Third-party analysisread2026-08-03

NVIDIA is NOT a signatory to the EU GPAI Code of Practice (EU signatory list), and no NVIDIA training-content summary or copyright policy for Nemotron was located.