Frontier-Level Red-Teaming From a Self-Hostable Open-Weight Model: Testing NVIDIA Nemotron 3.5 Super

What it is

Orca's write-up of a head-to-head test of which model should drive Agent Piercer, its internal prototype for red-teaming AI agents. The prototype chooses probes, writes attacks, runs them against a live target agent and judges whether each worked. The harness, tools, instructions, tasks and target were held constant, so the model was the only variable.

How it works

• Models: NVIDIA Nemotron 3.5 Super (120B total, 12B active parameters), Claude Opus 4.8, GPT-6 Astra and Grok 4.7.
• Nemotron deployment: the NVFP4 build, self-hosted on Amazon SageMaker on 4 × NVIDIA L40S GPUs.
• Tested: probe choice, attack writing, judging 57 real attack conversations, and a false-alarm check.
• Measured: vulnerability types found, completion of simple test prompts, how many real conversations each model judged, and agreement with the other judges.

Results the page gives

The practical point is consistency. Opus judged fewer than half the real conversations, and the page warns that a clean report may only mean the model stopped trying.

The page also says Nemotron completed authorized security-testing tasks that some proprietary models declined under default safety settings. It does not name the models or the tasks.

What to do

If you are considering an LLM-driven agent red-teamer, run any candidate model through the same harness and track two things besides findings:

• per-step completion on simple tasks
• the share of attack transcripts it actually judges

The page argues the test should rerun whenever the agent gains a new tool, prompt or data source, which is why self-hosting on infrastructure you control matters.

Caveats

• This is a vendor experiment on one prototype, which is not released ("an experiment, not a product"), against one target agent. There is no cost, latency or reproduction detail.
• The page is inconsistent on scope. Key Findings say Nemotron was tested against "five frontier models" and matched "most" on vulnerability types, but only three comparators are listed.
• No false-alarm or judge-agreement figures are given, and Grok 4.7's vulnerability count is not stated.
• Orca itself says the refusal difference "does not necessarily indicate superior underlying capabilities."