Alice Collaborates with Inflection AI and AI21 to Demonstrate NVIDIA Nemotron Open Models Can Be Trained for Frontier Safety

Alice Collaborates with Inflection AI and AI21 to Demonstrate NVIDIA Nemotron Open Models Can Be Trained for Frontier Safety

NEW YORK, NY, Oct. 16— Alice announced the results of two collaborations focused on aligning NVIDIA Nemotron models to company-specific safety and security policies. The results demonstrate how real-world threat data can be used to train open-source models for frontier safety performance. 

 Open-source models give organizations greater control over AI behavior, allowing them to train policies into the underlying model rather than setting instructions as system prompts. To successfully train models on their policies, companies need adversarial data and expertise. Two projects demonstrate how NVIDIA’s state-of-the-art open-source model can be aligned for safer human interactions, and more secure enterprise agents. 

 “Powerful AI is being democratized. It’s now available to companies everywhere, and they want to use it safely and predictably,” said Noam Schwartz, CEO and co-founder of Alice. “These results show that with the right real-world adversarial data and training, we can teach open source models how to handle the threats and abuse they will actually face, across very different safety challenges, while keeping them as powerful. That’s the bar now: frontier-grade safety that any organization running advanced AI can actually put into practice.”

 Training safety for how people actually use AI

Inflection AI is building personal AI that empowers people and shifts interactions from transactional to relational. Allowing more natural interactions with conversational AI also increases risks which most benchmarks can’t catch. In the process of building the next generation of personal intelligence, Inflection AI fine-tuned NVIDIA Nemotron 3 Super 120B-A12B, and turned to Alice to develop red-teaming datasets aimed at reducing sycophancy and preventing the model from reinforcing unhealthy attachment over long conversations. Fine-tuning on that data raised Pi’s alignment score by 30% while keeping unnecessary refusals to just 1.6%.

 Alice created more than 20 realistic personas and used them in multi-turn red-team exercises where those risks could develop over time. The personas included vulnerable but benign users as well as adversarial users deliberately attempting to manipulate the model, drawing on Alice’s real-world knowledge of harmful and adversarial behavior.

 “As AI innovation accelerates, safety has to advance rapidly as well. It’s no longer enough to ask whether a model can identify and refuse a harmful prompt,” said Sean White, CEO of Inflection AI. “We also need to understand how AI behaves across hundreds of interactions, whether it challenges rather than simply agrees, if it supports human agency rather than dependency, and ultimately if it leaves people more capable. This work with Alice and NVIDIA demonstrates that we can train those principles into powerful open models without sacrificing what makes them useful. That’s fundamental to the kind of human-centered Personal Intelligence we’re building with Pi.”

 Security without sacrificing capability

 Alice also worked with AI21, which has trained language models since 2021 and now offers lab-as-a service for specialized intelligence. The work with them focused on a very different problem: protecting enterprise agents against indirect prompt injection. As agents gain access to company systems, data and tools, attackers can attempt to manipulate them through information the agent encounters while doing its work. Training against those attacks therefore cannot focus only on whether the model refuses a malicious instruction. A secure agent also needs to recognize the attack while continuing to complete the legitimate task.

 Alice’s reinforcement-learning environments were built to train and measure both. AI21 used them to post-train the recently released NVIDIA Nemotron 3.5 Super VL open model, increasing the model’s resilience to indirect prompt injection by 41 points, competing with GPT-6.1 Sol.

 The result shows that security and capability are not necessarily competing objectives. With the right training, models can become significantly more resilient to adversarial manipulation while maintaining task performance.

 “For most companies, the next phase of AI adoption goes beyond frontier models, to open models they own, shape and control,” said Ori Goshen, Co-founder and CEO of AI21. “Owning a model means owning how it fails, not only what it can do. We post-trained NVIDIA Nemotron 3.5 Super-VL on attack traces Alice sees in the wild, so it holds up against the attacks that actually reach enterprises while keeping the behavior it was built for.”

 “NVIDIA Nemotron provides the open weights, recipes and tooling for organizations to post-train on their own data and optimize accuracy and performance for their specific workloads,” said Joey Conway, senior director Nemotron and Software, NVIDIA. “Alice’s work with Inflection AI and AI21 shows how post-training Nemotron on real-world adversarial data delivers powerful safety and security — exactly the kind of innovation open models are meant to unlock.”

 Taken together, these collaborations demonstrate how real-world adversarial intelligence, safety datasets, expert red teaming and reinforcement-learning environments can turn open models into systems trained for the risks they will actually face. The broader opportunity is clear: powerful, customizable AI that companies can own and deploy with frontier-level safety built in.