Nemotron 3 Nano shows what opening an agent model really means
Nvidia is publishing weights, a model card, data, and tools around a mixture-of-experts model. “Open” is not binary: license, provenance, recipes, evaluations, and hardware dependence must be audited separately.
On December 15, 2025, Nvidia introduced Nemotron 3, a family aimed at agent systems, and released its first usable member that day: Nemotron 3 Nano. The launch release described three sizes—Nano, Super, and Ultra—alongside data and libraries. Only Nano was available; the other two belonged to a roadmap for the first half of 2026.
The story teaches something more useful than memorizing parameter counts. A model can open weights while keeping data, recipes, or infrastructure closed. It can permit research while restricting use. It can be portable in theory but dependent on one vendor in practice. The durable skill is to build an openness matrix before deciding whether a model provides real control.
Total and active are not the same number
Nemotron 3 Nano uses a hybrid architecture combining Mamba layers, Transformer attention, and mixture of experts. In an MoE model, routing activates some components for each token instead of using every parameter. Total parameters approximate stored capacity; active parameters are closer to the neural work performed in a step, although neither figure alone specifies memory, latency, or cost.
The press release describes Nano as a 30-billion-parameter model activating up to 3 billion. The technical model card specifies 30 billion total and 3.5 billion active, with six experts selected per token plus a shared expert. The difference shows that names and press figures may be rounded. Infrastructure planning should use the downloaded version's configuration, not a reconstruction from “30B-A3B.”
MoE reduces active computation, but total weights still require memory or a strategy for distribution and quantization. Cache demand also grows with context and concurrency. “Three billion active” does not make the system operationally identical to a dense model of that size.
A long window is not reliable memory
Nvidia announced a native one-million-token context. That figure describes how much material a configuration can accept, not what it recalls with uniform accuracy. Finding a fact in the middle, relating distant evidence, and following instructions without contamination are different tests. Maximum length also says nothing about GPU memory, time to first token, or response cost.
Long-context testing should place verifiable answers in different positions, add similar distractors, and ask questions requiring multiple pieces of evidence. Measure retrieval, attribution, and resistance to instructions embedded in documents. Then compare the result with a system retrieving only relevant passages. Sending everything can be simpler, but it increases attack surface, latency, and the chance that irrelevant evidence diverts the model.
An agent system should not let history grow without governance either. Each agent receives the minimum required context with provenance and permissions. A plan, tool output, and external document do not carry equal trust. The context window is transport capacity; useful memory requires selection, structured state, and verification.
The openness matrix
The first row is access: can weights be downloaded and run outside the vendor's service? Nano's card provides weights and examples for several engines. The second is license: teams must read which commercial uses, redistributions, and modifications the Nemotron license allows and which obligations remain. A visible repository is not public domain.
The third row is architecture and code. Nvidia published design details and recipes, but reproducing a model requires versions, dependencies, configuration, and resources. The fourth is data. The technical launch article said weights, data, and recipes were being opened, while the release quantified three trillion new tokens across pretraining, post-training, and reinforcement learning. The card should identify the portion applying to the exact version and any inaccessible corpus.
The fifth row is evaluation. A reproducible table needs prompts, tools, containers, limits, and dataset versions. The Hugging Face card links configurations and declares data cutoff dates, useful information for detecting temporal contamination. It remains a vendor evaluation until an outside team repeats the protocol.
The sixth row is operations. A model can run in open engines while performing best in the vendor's libraries or formats. The chosen vLLM, SGLang, or other route must be tested on actual hardware. Portability means another combination meets the service contract, not merely that it starts.
Announced performance and measured performance
Nvidia claimed up to four times the token throughput of Nemotron 2 Nano and up to 60% fewer reasoning tokens. Both “up to” figures need configuration: hardware, precision, length, concurrency, thinking mode, and stopping rule. A model generating fewer tokens can be efficient, or it can stop before completing the task.
An internal test should record input and output throughput, time to first token, total time, peak memory, energy where available, and success rate. Cost is calculated per correct task, not per token. If a cheaper configuration requires retries or extra review, inference savings may disappear.
MoE deployments should also monitor routing. Certain tasks or languages may concentrate on particular experts and alter performance. The card lists English, German, Spanish, French, Italian, and Japanese, but a support list does not establish parity. Each language needs its own samples, including tool use and structured formats.
An agent multiplies failure points
Nvidia aimed Nemotron at teams of retrievers, planners, executors, and verifiers. Separating roles can make permissions and tests clearer, but it does not create reliability automatically. Every handoff adds an interface where context can be lost, authority confused, or hostile instructions introduced.
A minimum diagram labels which agent can read data, which can write, which tools it may call, and which output requires approval. A retriever does not need file modification. A verifier should not trust the executor's summary without evidence. A planner must not elevate retrieved content into system instructions. Logs retain model version, tool inputs, and routing decisions.
Multiple models can also reduce cost. Nano may handle classification, extraction, or summarization, while a larger model receives exceptions. The router is evaluated as a classifier: false escalations raise expense; false non-escalations leave hard tasks with an insufficient model. Isolated model comparisons do not measure that system.
A roadmap is not a product
In December, Nvidia described Super as roughly 100 billion total parameters with up to 10 billion active, and Ultra as about 500 billion total with up to 50 billion active. It also projected NVFP4 precision on Blackwell. Those were planned specifications, not available artifacts. They belong in the future tense and must be checked again at release.
The distinction matters because names and plans change during development. A purchase decision should not rest on the next model's promise. Test Nano when Nano is the product; record Super and Ultra as pending options with a date, evidence, and reevaluation criterion.
Nemotron 3 Nano expanded the downloadable-model field and presented an unusual package of weights, data, tools, and documentation. That does not remove auditing; it makes auditing possible. The transferable skill is to read “open” as six rows—access, license, code, data, evaluation, and operations—and test each against the exact artifact being deployed.
This article was produced with artificial intelligence under human editorial oversight.
