AI21 and Inflection retrain NVIDIA Nemotron on Alice’s attack data

What Alice, AI21 and Inflection announced

On 15 October 2026 Alice, an AI safety and security company based in New York and Tel Aviv, announced the results of two projects in which other AI companies retrained NVIDIA’s open Nemotron models on its safety data. AI21 Labs used Alice’s training environments to make Nemotron 3.5 Super VL harder to hijack through indirect prompt injection. Inflection AI, the company behind the Pi assistant, used Alice’s red-team conversations to make Nemotron 3 Super 120B-A12B less sycophantic in long chats.

The headline numbers are a 41-point gain in resistance to indirect prompt injection for the AI21 model, and a 30 percent higher alignment score for Inflection’s model with unnecessary refusals held at 1.6 percent. Both figures come from the companies’ own tests. Ynet, which covered the work on 18 October, noted that the results “have not been independently verified.”

Nemotron 3.5 Super VL is the open multimodal model NVIDIA released on Hugging Face the same day, a 120-billion-parameter mixture-of-experts model with 12 billion active parameters aimed at enterprise agents. AI21 published its own account alongside Alice’s, describing the security work as one of three specialised models it built on that base in about three weeks.

How AI21 trained an agent to ignore planted instructions

Indirect prompt injection is an attack in which the malicious instruction does not come from the user. It sits inside content the agent reads while doing its job, such as a message, a file, an issue or a pull request, and tries to get the agent to break its own rules. Our explainer on prompt injection covers the basic mechanics. The hard part for defenders is that a safe agent cannot simply refuse anything suspicious; it has to spot the attack and still finish the legitimate task.

Alice’s technical write-up says it built reinforcement-learning “gyms” that mimic enterprise workspaces, with tool use, cloned interfaces and web apps, and planted attacks modelled on ones it has seen in the wild. The data it gave AI21 covered full tool use across third-party services such as Slack and GitHub, with attacks hidden in messages, files, repositories and pull requests, plus 200 tasks mixing attack and benign cases so the model would not learn to refuse legitimate requests.

Alice gives two examples. In one, an agent is asked to remind staff to reset their passwords, but the reset link points to a lookalike credential-stealing site. In another, a sales-operations agent is told to follow onboarding instructions from a vendor email synced into Slack, and the email asks it to export the company’s whole Salesforce contacts database to an outside address. The environments use dual verifiers that check both that the agent avoided the attack and that it still completed the task, which Alice says reduces reward hacking.

AI21 says its researchers first measured Nemotron 3.5 Super on Alice’s gym, then used supervised fine-tuning and direct preference optimisation to lift the baseline and diversify its answers, and finally added GRPO, an online reinforcement-learning method. The result, in both companies’ words, was a 41-point improvement in attack resilience “without harming overall task performance.” Alice says that puts the model ahead of DeepSeek V4.1 Flash, GPT-5.6 Terra and GPT-6.1 Sol on resistance to indirect prompt injection; AI21’s post names GPT-6.1 Sol.

How Inflection tackled sycophancy in Pi

Inflection’s project targeted a softer failure. Chat assistants that people talk to for hours can drift into agreeing with everything a user says, or into encouraging emotional dependence. Single-prompt safety tests rarely catch that, because the problem builds up over a conversation.

According to the announcement, Alice wrote more than 20 realistic personas, from vulnerable but benign users to adversarial ones deliberately trying to manipulate the model, and ran them through multi-turn red-team exercises. Inflection fine-tuned Nemotron 3 Super 120B-A12B on the resulting data. The companies say Pi’s alignment score rose by 30 percent while unnecessary refusals stayed at 1.6 percent, meaning the model rarely turned down requests it should have answered.

“It’s no longer enough to ask whether a model can identify and refuse a harmful prompt,” Inflection chief executive Sean White said in the release. “We also need to understand how AI behaves across hundreds of interactions, whether it challenges rather than simply agrees, if it supports human agency rather than dependency.” The release does not define the alignment score or say whether the 30 percent is a relative or absolute change.

The same base model, two more jobs

AI21’s post places the Alice work in a broader pitch: companies should own specialised models rather than rent general ones. It describes two other Nemotron 3.5 Super projects run by its forward-deployed researchers over the same three weeks.

For Gong, the revenue software company, AI21 post-trained the model for Gong’s Data Extractor, an agent that pulls deal and account fields out of calls, emails and meetings at a scale of tens of millions of interactions a month. Using supervised fine-tuning and direct preference optimisation, AI21 says Gong’s own evaluations found the result matched Claude Opus 5.5 on speed and accuracy at “a small fraction of the cost.”

For Deel, the payroll and HR platform, AI21 used expert-verified data and benchmarks from Emet by Deel and a two-step recipe of supervised fine-tuning followed by self-distillation policy optimisation. It reports 72 percent accuracy on Emet’s eight-country payroll benchmark, 8 points above Claude Opus 5.5, at 33 times lower cost per query. As with the security model, these are vendor-reported numbers on benchmarks chosen for the task.

Who Alice is

Alice, formerly known as ActiveFence, started out policing fraud, extremism and coordinated manipulation on large online platforms. In August it raised $140 million in a round led by Apax Digital, according to Ynet, and said it was approaching $100 million in annual recurring revenue. It says it works with eight of the 10 leading foundation-model labs and AI-native companies, and names Anthropic, Google and NVIDIA among its customers and partners.

Its main asset is a proprietary dataset of adversarial behaviour it calls Rabbit Hole, built from years of watching how attackers operate online. AI21’s post says the data also draws on more than 150 staff security researchers and expert-network members. The Nemotron projects show Alice selling that data as training material, not only as a test suite.

Why training safety into the weights matters

The argument both companies make is that open-weight models let organisations train their own policies into the model instead of relying on system prompts, tool definitions or a separate filter. “Owning a model means owning how it fails, not only what it can do,” AI21 chief executive Ori Goshen said.

That cuts both ways. Ynet points out that the same flexibility “places more responsibility on companies to identify security weaknesses.” Microsoft and NVIDIA made a similar point when they published a taxonomy of 30 risks for enterprises deploying open-weight models. Training-time hardening is also not the only approach on offer: OpenRouter’s Armor beta screens agent tool calls at runtime, and many teams will want both.

For enterprises weighing an open model for agents that read email, documents or code, the practical message is that prompt-injection resistance can be improved with what Alice calls “relatively small, high-quality datasets” and a short training run, if the data reflects real attacks. NVIDIA’s Joey Conway described the projects as “exactly the kind of innovation open models are meant to unlock.”

Limitations and what to watch

The numbers are hard to interpret. Neither Alice nor AI21 says what scale the 41 points sit on, what the baseline was, or how many attacks were tested, and the comparison with frontier models appears to rely on Alice’s own environments. Inflection’s alignment score is undefined. Nothing shows how the models handle attack styles outside the training distribution, which is where prompt injection usually succeeds.

Neither announcement says the retrained models will be released, so outside researchers cannot test them for now. The announcements are partly marketing for Alice’s data business and AI21’s lab-as-a-service offering, and the Gong and Deel results rely on evaluations those customers or their partners built.

Worth watching: whether Alice or AI21 publish benchmark details or a paper, whether independent red teams test the hardened Nemotron, whether Inflection ships the fine-tuned model in Pi, and whether NVIDIA folds similar safety data into future Nemotron releases.