Labs · Nov 2, 2026
AI21 describes post-training Nemotron 3.5 Super VL for attack resilience
Markdown · JSON · Original source
’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect —malicious instructions planted in information an agent reads with tools—while still completing assigned tasks. They report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised with modified GRPO, an online method, and reward changes intended to limit repetitive or excessively long responses. Escape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
· Article
Source details
Original source date: Nov 2, 2026 (2026-11-02T13:35:58+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-10T10:25:11.962Z. First observed: 2026-11-03T12:48:22.253Z. Retrieved: 2026-11-03T14:46:51.541Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience. The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text.
Open question
How would the model’s reported performance translate to agents operating in real enterprise workspaces?
Source-stated
AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.
The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.
Source-stated
The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.
41-point improvement on attack resilience as compared to the base model 10-point improvement as compared to GPT-6.1 Sol 25x cheaper than GPT-6.1 Sol (cost per 1M tokens)
Source-stated
On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.
On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.
Source-stated
The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.
AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.
Escape Meridian interpretation
The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.
The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows
Source and contributor context
AI21 Labs · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Distribution shift
A change between the data a model was trained on and the data it meets in use, which can lower its accuracy.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Fine-tuning
Further training of an existing model to adapt it to a particular task or use.
Reinforcement learning
Training by trial and error, in which a system is rewarded for the outcomes its designers want.
AI21
AI21 publishes technical research and product announcements about its language models and AI systems.
Editorial provenance
Version 1. Publication ID: 91be6493-5d87-401d-873e-bdab1e6d8f5e.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T10:25:11.962Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9995cd888f016be15b9c4053e4d862f18807fc2ff3fa33a3363486f23c09380d. Source text hash: 02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e.
Revision and source-check history
Version 1 · 2026-11-10T10:25:11.962Z
AI21 describes post-training Nemotron 3.5 Super VL for attack resilience
’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect —malicious instructions planted in information an agent reads with tools—while still completing assigned tasks. They report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised with modified GRPO, an online method, and reward changes intended to limit repetitive or excessively long responses. Escape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?
Original source
· Article
Source details
Original source date: Nov 2, 2026 (2026-11-02T13:35:58+00:00).
Date basis: Date stated by the publisher.
Added to Escape Meridian: 2026-11-10T10:25:11.962Z. First observed: 2026-11-03T12:48:22.253Z. Retrieved: 2026-11-03T14:46:51.541Z.
Limits
The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience. The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text.
Open question
How would the model’s reported performance translate to agents operating in real enterprise workspaces?
Source-stated
AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.
The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.
Source-stated
The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.
41-point improvement on attack resilience as compared to the base model 10-point improvement as compared to GPT-6.1 Sol 25x cheaper than GPT-6.1 Sol (cost per 1M tokens)
Source-stated
On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.
On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.
Source-stated
The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.
AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.
Escape Meridian interpretation
The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.
The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows
Source and contributor context
AI21 Labs · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
Media declared by the original publisher; availability checked separately from the editorial reading.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Prompt injection
Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Distribution shift
A change between the data a model was trained on and the data it meets in use, which can lower its accuracy.
Benchmark
A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Fine-tuning
Further training of an existing model to adapt it to a particular task or use.
Reinforcement learning
Training by trial and error, in which a system is rewarded for the outcomes its designers want.
AI21
AI21 publishes technical research and product announcements about its language models and AI systems.
Editorial provenance
Version 1. Publication ID: 91be6493-5d87-401d-873e-bdab1e6d8f5e.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-10T10:25:11.962Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 9995cd888f016be15b9c4053e4d862f18807fc2ff3fa33a3363486f23c09380d. Source text hash: 02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e.
passed · 2026-11-10T10:25:11.962Z · anthropic/claude-opus-5.5
Publication: 91be6493-5d87-401d-873e-bdab1e6d8f5e
attribution — pass: The reading correctly names AI21's blog, its listed authors and the Alice collaborators. Results and arguments stay attributed to the authors ('They report', 'The authors argue'), and the deployment caveat is labeled as Escape Meridian's reading.
This blog is authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer, in collaboration with Alice’s Liran Cohen and Dadi Atar.
summary — pass: The reading leads with the actor and the development. It explains indirect prompt injection in plain language and calls GRPO an online reinforcement learning method. It keeps the source's thesis that resilience need not cost task completion, and it reports the figures accurately. The question is a genuine open issue. Smallest optional repair: a short gloss for 'out-of-distribution', such as 'shares no tasks or apps with training'. The reading is understandable without it.
CHASM shares no tasks or apps with the RL gyms, so it tests whether that behavior generalizes.
date — pass: The originalPublished value is 2026-11-02T13:35:58+00:00, taken from the publisher page. It matches the feed entry and comes before first observation. No conflicting earlier publication is indicated.
support — pass: The numeric claims are verbatim-supported: 41 points, 10 points, 25x per 1M tokens, CHASM 7.54 to 33.96, and 117 tasks. The SFT-then-modified-GRPO recipe and the length and repetition penalties are stated in the source. The deployment-gap point is labeled as interpretation and does not overclaim. The limitations add no unsupported facts, and no benefits or costs beyond the source are implied.
Together, AI21 and Alice improved Nemotron 3.5 Super VL’s attack resilience by 41 points above the base model and 10 points above GPT-6.1 Sol without harming overall task performance
media — pass: The selected media is the verified direct link to the original AI21 blog post, which is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
AI21 publishes technical research and product announcements about its language models and AI systems.
Explore AI21AI21 publishes technical research and product announcements about its language models and AI systems.
Explore AI21Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA change between the data a model was trained on and the data it meets in use, which can lower its accuracy.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceFurther training of an existing model to adapt it to a particular task or use.
Definition referenceTraining by trial and error, in which a system is rewarded for the outcomes its designers want.
Definition referenceAI21 publishes technical research and product announcements about its language models and AI systems.
Explore AI21A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceAI21 publishes technical research and product announcements about its language models and AI systems.
Explore AI21Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.
Definition referenceA change between the data a model was trained on and the data it meets in use, which can lower its accuracy.
Definition referenceA defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition referenceFurther training of an existing model to adapt it to a particular task or use.
Definition referenceTraining by trial and error, in which a system is rewarded for the outcomes its designers want.
Definition referenceAI21 publishes technical research and product announcements about its language models and AI systems.
Explore AI21A defined set of tests used to compare systems. Results depend on the tasks and measures selected.
Definition reference