Implement · NVIDIA Nemotron 3

Can you run it?

Ownership levelPartialnone·limited·partial·substantial·fullAnalytical input C · 66/100

This page is a projection of the one entry record, the Reliability and Data control factors that Implement covers. The full verdict is set by all four factors together, floor-weighted so the weakest caps the whole.

Which domain expands which factor

AssessUse & modify + Transparency
ImplementData control + Reliability
UseReliability
SupportTransparency

Install & run

Download the ungated safetensors from the verified nvidia org on Hugging Face and serve with vLLM, SGLang, Ollama, llama.cpp or NVIDIA NIM. Pick the variant to fit your hardware (Nano or Super), pin the exact revision, and verify checksums before loading.

Hardware & VRAM requirements

Nano (30B / 3.5B active) runs on modest single-GPU hardware; Super (120B / 12B) is a mid-tier multi-GPU target. Official BF16, FP8 and NVFP4 quantizations are published for each. Size against the specific variant; exact per-GPU VRAM is not restated here.

Serving stacks

Broad support: vLLM, SGLang, Ollama, llama.cpp and NVIDIA's own NIM self-hosted microservices. NIM runs on your own infrastructure, so data stays in your enclave; it is deployment tooling, not a hosted provider.

Safe-deployment controls & Deployment Ceiling

Deployment Ceiling: T3 (bounded autonomous), conditional. Because there is no published model-level safety evaluation, the controls are your responsibility to assemble. NVIDIA ships the pieces at the family level: a downloadable guard classifier (Nemotron-3-Content-Safety), the NeMo Guardrails toolkit for input, output and action rails, and the garak red-team scanner. Reaching T2 needs the guard classifier plus input/output rails; T3 additionally needs deterministic action limits, a kill switch, and red-team sign-off. The conditions: run garak (or equivalent) for your own use case, and note that the guard-classifier scores are NVIDIA self-reported. The irrevocable licence carries no field-of-use restriction. Complete the pre-deployment gate in the safe-deployment playbook.

Available quantizations

NVIDIA publishes official BF16, FP8 and NVFP4 variants for both models alongside the base safetensors, so a low-precision path is first-party rather than community-only.

Fine-tuning & adaptation

Runnable training and fine-tuning recipes are released on GitHub (Pretrain -> SFT -> RL), and the post-training data is CC-BY-4.0, so adaptation is genuinely accessible. Note the reproducibility caveat: the recipes "train exclusively on the open-sourced subset of training data", so results differ from the tech-report benchmarks that used additional proprietary data.

API / OpenAI-compatible integration

Serve behind vLLM/SGLang or NVIDIA NIM for OpenAI-compatible endpoints. A hosted build.nvidia.com preview API exists for evaluation, but treat it as an evaluation surface only: it does not store content at session end, yet reserves use of content "to improve NVIDIA products and services, including AI models".

How this scores

The ownership factors this domain covers, drawn from the one entry record.

ReliabilityIs it reliable and good enough for the job?

Moderate

Operational is strong (4: broad serving, official quantizations, a small portable Nano), but safety is only 3: there is no published model-level safety evaluation or independent red-team, so misuse control is a gap you must fill yourself with the downloadable guard stack. Under the ownership rule a safety score of 3 caps this factor at moderate, however capable the models are.

How this scores (AOI sub-dimensions)

Operational4/5how practical it is to run, serve and maintain in productionBroad, mature serving story: vLLM, SGLang, Ollama, llama.cpp and NVIDIA's own NIM self-hosted microservices, with official BF16 / FP8 / NVFP4 quantizations and, crucially, a genuinely small Nano (30B / 3.5B active) that runs on modest hardware.

Safety3/5whether misuse risks are evaluated and guardrails are providedA safety-tuned release (Nemotron-SFT-Safety post-training data plus keyword/regex filtering) with a genuinely downloadable, multi-domain companion guard classifier (Nemotron-3-Content-Safety, 23 categories / 12 languages) and the Apache-2.0 NeMo Guardrails and garak tooling at the family level.

Doesn't extract your dataDoes running it keep your knowledge and data yours?

Strong

Self-hosted via NIM, the weights and inference run on your own infrastructure and data never leaves your enclave, and the licence claws back no rights - the grant is explicitly IRREVOCABLE, terminating only on the licensee's own IP litigation. That is the strong case for a self-hostable model.

How this scores

Not a scored AOI dimension. For a self-hosted model, data-control is a structural property of running the weights yourself, strong by default unless the model phones home or the licence claws back rights. For a hosted API this factor is the retention + train-on-inputs + residency read, scored from the binding terms.

What this means for adoptionYou get unusually strong transparency for an open model - ungated weights, a white paper, runnable recipes and CC-BY post-training data - and, on the corrected licence reading, a clean irrevocable grant with no field-of-use restriction, so self-hosting keeps your data and rights yours. Ownership stays partial, not substantial, because the corpus is only partly released (not reproducible), the non-OSI licence with its attribution notice and output-reaching termination holds use-and-modify at moderate, and the absence of a published model-level safety evaluation holds reliability at moderate. Self-host via NIM, assemble the downloadable guard stack, and red-team for your own use case.

Sources

The same evidence records as the entry sheet. Read means the text was verified; unverified means it is known to exist but not yet read.

Model cardread2026-08-03

Nemotron 3 Super and Nano model cards on the verified nvidia HF org: Super 120B/12B, Nano 30B/3.5B active; hybrid Mamba-Transformer LatentMoE + MTP; up to 1M context; ~25T training tokens; ungated safetensors with BF16/FP8/NVFP4 variants; both cards state "a family of open models with open weights, training data, and recipes"; licence tag nvidia-nemotron-open-model-license.

Licenceread2026-08-03

NVIDIA Nemotron Open Model License (v.

Documentationread2026-08-03

Training data + recipes are PARTIALLY released: post-training datasets (Nemotron-Post-Training-v3, e.g.

Technical_reportread2026-08-03

Nemotron 3 White Paper (arXiv 2512.20856), read (abstract): hybrid Mamba-Transformer LatentMoE, up to 1M context, NVFP4 training for Super/Ultra.

Model cardread2026-08-03

Safety, read: no published model-level safety evaluation or independent red-team for Super/Nano (base cards carry only a keyword/regex data-filter note; white paper safety section is a contributor list).

Documentationread2026-08-03

Verified nvidia org on Hugging Face; Super and Nano weight repos are ungated safetensors with published BF16/FP8/NVFP4 quantization variants; some training DATASETS are gated but the WEIGHTS are not.

Terms of serviceread2026-08-03

NVIDIA NIM is self-hosted deployment tooling ("data never leaves your secure enclave"), so NVIDIA is not an AOI inference-provider entry and self-hosting supports data control.

Third-party analysisread2026-08-03

NVIDIA is NOT a signatory to the EU GPAI Code of Practice (EU signatory list), and no NVIDIA training-content summary or copyright policy for Nemotron was located on the NVIDIA trust centre.