Alice helps train NVIDIA Nemotron models for safety

Alice has collaborated with Inflection AI and AI21 to train NVIDIA Nemotron open models for safety and security tasks. The work focused on reducing harmful model behaviour without weakening performance.

The collaborations covered two use cases for NVIDIA's open-weight models. One examined personal AI behaviour over long conversations; the other tested defences against indirect prompt injection attacks on enterprise AI agents.

Alice used its adversarial database to post-train and fine-tune NVIDIA Nemotron models with data drawn from real-world threats and misuse patterns. With Inflection AI, it worked to address sycophancy and unhealthy attachment in personal AI. With AI21, it aimed to improve resilience against hidden malicious instructions embedded in emails, documents and other external sources.

In the Inflection AI project, the companies used NVIDIA Nemotron 3 Super 120B-A12B. Alice developed red-teaming datasets to test how a model behaves across repeated interactions, particularly when users may be vulnerable or may try to manipulate the system over time.

Alice created more than 20 personas for multi-turn red-team exercises, including benign but vulnerable users and adversarial users, to capture a broader range of conversational risks than single-prompt safety tests.

According to released figures, fine-tuning on that data increased Pi's alignment score by 30% while keeping unnecessary refusals at 1.6%. Pi is Inflection AI's personal AI product.

"Powerful AI is being democratized. It's now available to companies everywhere, and they want to use it safely and predictably," said Noam Schwartz, Chief Executive Officer and co-founder of Alice. "These results show that with the right real-world adversarial data and training, we can teach open source models how to handle the threats and abuse they will actually face, across very different safety challenges, while keeping them as powerful. That's the bar now: frontier-grade safety that any organization running advanced AI can actually put into practice."

Inflection AI said the work reflects a broader shift in safety testing, from identifying obviously harmful prompts to measuring behaviour across long exchanges. That is particularly relevant for personal AI products designed to sustain more relational interactions with users.

"As AI innovation accelerates, safety has to advance rapidly as well. It's no longer enough to ask whether a model can identify and refuse a harmful prompt," said Sean White, Chief Executive Officer of Inflection AI. "We also need to understand how AI behaves across hundreds of interactions, whether it challenges rather than simply agrees, if it supports human agency rather than dependency, and ultimately if it leaves people more capable. This work with Alice and NVIDIA demonstrates that we can train those principles into powerful open models without sacrificing what makes them useful. That's fundamental to the kind of human-centered Personal Intelligence we're building with Pi."

Enterprise security

The second project, with AI21, addressed indirect prompt injection, in which attackers conceal malicious instructions inside data sources that an AI agent processes while carrying out a task. The threat has drawn growing attention as AI agents gain access to internal systems, files and tools inside companies.

Alice built reinforcement-learning environments to train models not only to spot attacks, but also to continue legitimate tasks. That distinction matters because enterprise users typically want an agent to remain useful rather than reject any workflow that appears risky.

AI21 used those environments to post-train NVIDIA Nemotron 3.5 Super VL. The companies said the work improved the model's resilience to indirect prompt injection by 41 points, with performance they described as competing with GPT-6.1 Sol.

"For most companies, the next phase of AI adoption goes beyond frontier models, to open models they own, shape and control," said Ori Goshen, co-founder and Chief Executive Officer of AI21. "Owning a model means owning how it fails, not only what it can do. We post-trained NVIDIA Nemotron 3.5 Super-VL on attack traces Alice sees in the wild, so it holds up against the attacks that actually reach enterprises while keeping the behavior it was built for."

The projects also reflect a wider industry push towards open-weight models that can be adapted internally, rather than relying only on system prompts or external guardrails. Supporters of that approach argue it gives organisations more direct control over how a model responds in specific domains, including safety, compliance and security.

NVIDIA said Nemotron is designed to let organisations post-train models on their own data using its tooling and training recipes. It presented the Alice work as an example of how model builders can adapt open models to particular risk profiles.

"NVIDIA Nemotron provides the open weights, recipes and tooling for organizations to post-train on their own data and optimize accuracy and performance for their specific workloads," said Joey Conway, Senior Director of Nemotron and Software at NVIDIA. "Alice's work with Inflection AI and AI21 shows how post-training Nemotron on real-world adversarial data delivers powerful safety and security - exactly the kind of innovation open models are meant to unlock."