Editorial disclosure: AI-assisted drafting or research support was reviewed, edited and approved by the named human author before publication.
Artificial intelligence is increasingly being designed to do more than answer questions. It is being integrated with operating systems, servers, files, networks, software installation, security functions, and administrative tools.
That changes the standard we believe should apply.
For an AI that may eventually help administer a consumer PC or server, our requirement is simple:
If we cannot meaningfully inspect what we are putting into the system, we do not want it.
That does not mean we expect to understand billions of individual model parameters. It means the model should provide enough transparency around its architecture, weights, training process, training data, fine-tuning, reinforcement learning, filtering, and evaluation that independent researchers can meaningfully investigate how it was created.
The newly released NVIDIA Nemotron 3.5 Lightning comes much closer to meeting that requirement than many other open-weight models.
NVIDIA provides downloadable weights, substantial portions of its training data, training recipes, architecture information, training software, synthetic-data information, evaluation material, and a relatively permissive license.
That is commendable.
But it still does not completely pass our test.
The Missing Pieces Matter
NVIDIA identifies private and non-public datasets used in the model's development, while portions of the complete pretraining mixture cannot presently be reconstructed entirely from publicly available material.
That does not mean Nemotron contains something malicious.
It means we cannot independently verify that it does not.
There is an important difference.
When traditional software is open-source, a qualified developer can examine its instructions. You can search for networking functions, filesystem access, credential handling, unexpected communications, or deliberately concealed operations.
AI weights do not work that way.
A model containing tens of billions of parameters does not have a convenient function named perform_hidden_behavior(). Learned behaviors are distributed throughout the model.
You can test the model extensively, but testing what a model normally does is not equivalent to knowing everything that influenced what it might eventually do.
Hidden Data Creates Unknown Behavior
If portions of the training history cannot be inspected, several possibilities cannot be completely eliminated.
A dataset could contain poisoned information. Bias could have entered during filtering. Synthetic training material could reinforce unexpected behaviors. Reinforcement learning could reward tendencies that are not obvious during routine testing.
There is also the possibility of trigger-dependent behavior.
A model could perform perfectly normally through thousands of evaluations yet behave differently when it encounters an unusual phrase, particular sequence of events, specific system state, identity, date, tool result, or combination of circumstances.
Again, this is not an allegation against NVIDIA or Nemotron.
It is the unavoidable consequence of incomplete visibility.
Copyright and Third-Party Rights
Incomplete visibility also creates a legal problem. NVIDIA's OpenMDW 1.1 license places responsibility on users to determine whether third-party rights apply to the model materials and to clear those rights where necessary. For a company integrating AI into consumer systems, that shifts an important part of the legal burden downstream.
NVIDIA is acknowledging that third-party copyrighted or otherwise protected material may be included or embodied in the model materials, while shifting the responsibility for clearing those rights onto the user.
That raises an obvious practical question: if users cannot completely inspect the material that helped create the model, how can they reliably identify everything they may be responsible for clearing?
The Risk Changes When AI Has Authority
This distinction becomes far more important when AI moves from conversation into system administration.
An AI answering a trivia question incorrectly may be annoying.
An AI with permission to manage files, configure servers, install software, modify firewall rules, access databases, administer user accounts, or communicate across a network presents an entirely different risk profile.
That is exactly why our standard for AI integration with consumer PCs and servers is higher.
The AI may reason and recommend actions, but deterministic security software should ultimately validate and execute privileged operations.
A safer architecture is:
AI reasoning → security/policy validation → approved system operation → verification and logging
rather than:
AI → unrestricted administrator access
Transparency in the underlying model becomes another layer of that defense.
A Hash Does Not Solve the Problem
Cryptographic hashes are useful. They can prove that the model on our computer is exactly the model NVIDIA published.
But that only proves:
“This is the file NVIDIA released.”
It does not prove:
“We know everything that went into creating this model.”
Verification of possession is not verification of provenance.
If portions of the training process remain unavailable, independent investigators cannot completely reconstruct the chain between raw information and the final weights.
That also makes forensic investigation more difficult. If unusual behavior appears several years later, researchers may be able to reproduce the behavior, examine the model experimentally, and study its activations—but they cannot necessarily trace that behavior through training material that was never released.
Nemotron Gets Much Closer
It would be unfair to place Nemotron 3.5 Lightning in the same category as models that simply release weights and call themselves open.
NVIDIA has released considerably more.
Architecture: Pass
Weights: Pass
Training software: Pass
Training recipes: Pass
Large portions of training data: Pass
Synthetic-data disclosure: Pass
Commercially practical licensing: Pass
Complete independently reconstructable training corpus: Does not pass
Complete end-to-end reproducibility of the released model: Does not presently pass
And because our requirement concerns the entire chain, those final two items matter.
Shall Not Pass — Yet
Our conclusion is therefore not that NVIDIA Nemotron 3.5 Lightning is unsafe.
Our conclusion is that we cannot presently demonstrate that it satisfies the level of inspectability we require before allowing an AI model to become part of software capable of administering consumer computer systems.
That distinction is important.
NVIDIA deserves credit for moving significantly closer to genuine AI transparency. In many respects, Nemotron 3.5 Lightning represents exactly the direction we would like the industry to take.
But our standard cannot change simply because a model almost reaches it.
If NVIDIA eventually releases the remaining training material—or provides a genuinely reproducible equivalent allowing independent researchers to reconstruct and audit the complete process—we would gladly reassess it.
Until then:
NVIDIA Nemotron 3.5 Lightning, shall not pass.