{"id":"fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa","title":"AI21 describes post-training Nemotron 3.5 Super VL for attack resilience","argument":"AI21’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect prompt injection—malicious instructions planted in information an agent reads with tools—while still completing assigned tasks.\n\nThey report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an out-of-distribution benchmark with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised fine-tuning with modified GRPO, an online reinforcement learning method, and reward changes intended to limit repetitive or excessively long responses.\n\nEscape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?","topicIds":["intelligence-and-discovery","institutions-and-trust"],"domain":"science","claimType":"attributed reading","limits":"The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience. The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text.","speaker":{"name":"AI21 Labs","roleAtSource":"Article author"},"source":{"title":"Post-training case study: Reaching frontier-level attack resilience with Alice | AI21","publisher":"AI21","format":"Article","url":"https://www.ai21.com/blog/ai21-alice-case-study/","publishedAt":"2026-11-02T13:35:58+00:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.","excerpt":"The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.","excerpt":"41-point improvement on attack resilience as compared to the base model\n10-point improvement as compared to GPT-6.1 Sol\n25x cheaper than GPT-6.1 Sol (cost per 1M tokens)","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.","excerpt":"On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.","excerpt":"AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.","excerpt":"The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","checkedAt":"2026-11-03T14:46:51.541Z","items":[{"type":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","attribution":"AI21","basis":"publisher-embed","availability":"verified","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GPT-6.1 Luna to surpassing GPT-6.1 Sol in quality at a fracti…","verifiedAt":"2026-11-03T14:46:51.736Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the model’s reported benchmark performance translate to agents operating in real enterprise workspaces?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"AI21 describes post-training Nemotron 3.5 Super VL for attack resilience","summary":"AI21’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect prompt injection—malicious instructions planted in information an agent reads with tools—while still completing assigned tasks.\n\nThey report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an out-of-distribution benchmark with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised fine-tuning with modified GRPO, an online reinforcement learning method, and reward changes intended to limit repetitive or excessively long responses.\n\nEscape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?","question":"How would the model’s reported benchmark performance translate to agents operating in real enterprise workspaces?","claims":[{"text":"AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.","excerpt":"The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.","support":"source-stated"},{"text":"The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.","excerpt":"41-point improvement on attack resilience as compared to the base model\n10-point improvement as compared to GPT-6.1 Sol\n25x cheaper than GPT-6.1 Sol (cost per 1M tokens)","support":"source-stated"},{"text":"On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.","excerpt":"On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.","support":"source-stated"},{"text":"The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.","excerpt":"AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.","support":"source-stated"},{"text":"The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.","excerpt":"The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows","support":"interpretation"}],"limitations":["The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience.","The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text."],"mediaId":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","correctionReason":null,"id":"fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa","publicationId":"91be6493-5d87-401d-873e-bdab1e6d8f5e","version":1,"sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","sourceTitle":"Post-training case study: Reaching frontier-level attack resilience with Alice | AI21","publisher":"AI21","publishedAt":"2026-11-02T13:35:58+00:00","originalPublished":{"value":"2026-11-02T13:35:58+00:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-03T12:48:22.253Z","createdAt":"2026-11-10T10:25:11.962Z","historical":true,"entityIds":["ai21"],"topicIds":["intelligence-and-discovery","institutions-and-trust"],"media":[{"id":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","kind":"article","url":"https://www.ai21.com/blog/ai21-alice-case-study/","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-03T14:46:51.736Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"7d994900a8c4fb1848edd8a1df464bfe3c8d13c332be56eef75691877e6b320e","kind":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GP","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-03T14:46:51.736Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1793717211736},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","checkedAt":"2026-11-03T14:46:51.541Z","items":[{"type":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","attribution":"AI21","basis":"publisher-embed","availability":"verified","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GPT-6.1 Luna to surpassing GPT-6.1 Sol in quality at a fracti…","verifiedAt":"2026-11-03T14:46:51.736Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","confidence":0.9500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"b7a4163385f4d9686cf9a4ad43cd37fd20509b2bab511ce0f767ddcf517b7dff","decidedAt":"2026-11-03T14:46:53.467Z"},"provenance":{"textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observationId":"9995cd888f016be15b9c4053e4d862f18807fc2ff3fa33a3363486f23c09380d","retrievedAt":"2026-11-03T14:46:51.541Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"c2557ec1-6820-4372-8490-2ba2ca385704"},"reviewer":{"model":"gpt-6-luna","runId":"7771762f-2b2c-4751-8e14-d1e8c7417749"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T10:25:11.962Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"AI21 Labs","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"AI21 Labs","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"AI21 Labs","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","locator":"document/html[1]/head[0]/script[59]@2308.@graph[0].author"},"assertionId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-03T14:46:51.541Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","contentSha256":"4cf976e89e532e149ab8feae2c18b3a391a1bbb6d3ff1fe634e564ca31236831","textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observedAt":"2026-11-03T14:46:51.541Z"}}],"participationCoverage":{"total":2,"returned":1,"complete":false,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","snapshotId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7","contentSha256":"4cf976e89e532e149ab8feae2c18b3a391a1bbb6d3ff1fe634e564ca31236831","textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observedAt":"2026-11-03T14:46:51.541Z","basis":"publisher-page-metadata","sourceLinks":2,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa/source"}},"canonicalUrl":"https://escapemeridian.com/readings/ai21-describes-post-training-nemotron-3-5-super-vl-for-attack-fb839f87","formats":{"html":"/readings/ai21-describes-post-training-nemotron-3-5-super-vl-for-attack-fb839f87","markdown":"/readings/ai21-describes-post-training-nemotron-3-5-super-vl-for-attack-fb839f87.md","json":"/readings/ai21-describes-post-training-nemotron-3-5-super-vl-for-attack-fb839f87.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-prompt-injection","name":"Prompt injection","explanation":"Hidden instructions placed in a document, email or web page that try to take control of an AI system reading it.","referenceUrl":"https://en.wikipedia.org/wiki/Prompt_injection"},{"id":"term-distribution-shift","name":"Distribution shift","explanation":"A change between the data a model was trained on and the data it meets in use, which can lower its accuracy.","referenceUrl":"https://en.wikipedia.org/wiki/Domain_adaptation"},{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"},{"id":"term-fine-tuning","name":"Fine-tuning","explanation":"Further training of an existing model to adapt it to a particular task or use.","referenceUrl":"https://developers.google.com/machine-learning/glossary#fine-tuning"},{"id":"term-reinforcement-learning","name":"Reinforcement learning","explanation":"Training by trial and error, in which a system is rewarded for the outcomes its designers want.","referenceUrl":"https://developers.google.com/machine-learning/glossary#reinforcement-learning-rl"}],"entities":[{"id":"ai21","name":"AI21","kind":"organization","context":"AI21 publishes technical research and product announcements about its language models and AI systems.","referenceUrls":["https://www.ai21.com/blog/"],"path":"/entities/ai21","json":"/entities/ai21.json","markdown":"/entities/ai21.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa","revision":"91be6493-5d87-401d-873e-bdab1e6d8f5e","revisionKind":"publication-id","title":"AI21 describes post-training Nemotron 3.5 Super VL for attack resilience","url":"https://escapemeridian.com/readings/ai21-describes-post-training-nemotron-3-5-super-vl-for-attack-fb839f87"},"source":{"type":"source","id":"https://www.ai21.com/blog/ai21-alice-case-study/","revision":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","revisionKind":"sha256-source-text","title":"Post-training case study: Reaching frontier-level attack resilience with Alice | AI21","url":"https://www.ai21.com/blog/ai21-alice-case-study/"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa","title":"AI21 describes post-training Nemotron 3.5 Super VL for attack resilience","argument":"AI21’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect prompt injection—malicious instructions planted in information an agent reads with tools—while still completing assigned tasks.\n\nThey report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an out-of-distribution benchmark with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised fine-tuning with modified GRPO, an online reinforcement learning method, and reward changes intended to limit repetitive or excessively long responses.\n\nEscape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?","topicIds":["intelligence-and-discovery","institutions-and-trust"],"domain":"science","claimType":"attributed reading","limits":"The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience. The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text.","speaker":{"name":"AI21 Labs","roleAtSource":"Article author"},"source":{"title":"Post-training case study: Reaching frontier-level attack resilience with Alice | AI21","publisher":"AI21","format":"Article","url":"https://www.ai21.com/blog/ai21-alice-case-study/","publishedAt":"2026-11-02T13:35:58+00:00","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.","excerpt":"The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.","excerpt":"41-point improvement on attack resilience as compared to the base model\n10-point improvement as compared to GPT-6.1 Sol\n25x cheaper than GPT-6.1 Sol (cost per 1M tokens)","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.","excerpt":"On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.","excerpt":"AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Source-stated"},{"text":"The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.","excerpt":"The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows","url":"https://www.ai21.com/blog/ai21-alice-case-study/","relationship":"Escape Meridian interpretation"}],"sourceMedia":{"status":"found","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","checkedAt":"2026-11-03T14:46:51.541Z","items":[{"type":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","attribution":"AI21","basis":"publisher-embed","availability":"verified","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GPT-6.1 Luna to surpassing GPT-6.1 Sol in quality at a fracti…","verifiedAt":"2026-11-03T14:46:51.736Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How would the model’s reported benchmark performance translate to agents operating in real enterprise workspaces?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"AI21 describes post-training Nemotron 3.5 Super VL for attack resilience","summary":"AI21’s blog, authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer in collaboration with Alice’s Liran Cohen and Dadi Atar, describes post-training Nemotron 3.5 Super VL in Alice’s simulated enterprise workspaces. The authors argue that agents can resist attacks such as indirect prompt injection—malicious instructions planted in information an agent reads with tools—while still completing assigned tasks.\n\nThey report that the model’s attack-resilience score rose 41 points above the base model and 10 points above GPT-6.1 Sol, at 25 times lower cost than GPT-6.1 Sol. On CHASM, an out-of-distribution benchmark with 117 attack tasks, its score rose from 7.54 to 33.96. The authors describe a training recipe combining supervised fine-tuning with modified GRPO, an online reinforcement learning method, and reward changes intended to limit repetitive or excessively long responses.\n\nEscape Meridian’s reading is that these results concern benchmark tasks, including simulated Slack and GitHub workspaces; the post does not establish how well the model would resist attacks in deployed enterprise systems. How would its reported benchmark performance translate to agents operating in real enterprise workspaces?","question":"How would the model’s reported benchmark performance translate to agents operating in real enterprise workspaces?","claims":[{"text":"AI21 and Alice post-trained Nemotron 3.5 Super VL using Alice’s simulated enterprise environments, targeting resistance to attacks alongside task completion.","excerpt":"The goal is to produce agents that score highly on both resistance to attacks and task completion – so that one aspect does not come at the expense of the other.","support":"source-stated"},{"text":"The authors report a 41-point attack-resilience improvement over the base model, a 10-point improvement over GPT-6.1 Sol, and 25-times lower cost than GPT-6.1 Sol.","excerpt":"41-point improvement on attack resilience as compared to the base model\n10-point improvement as compared to GPT-6.1 Sol\n25x cheaper than GPT-6.1 Sol (cost per 1M tokens)","support":"source-stated"},{"text":"On CHASM, which the post describes as an out-of-distribution benchmark, the post-trained model scored 33.96, compared with 7.54 for the base model.","excerpt":"On CHASM, the post-trained model scores 33.96, up from 7.54 for the base model: about 4.5 times higher on environments and attack types it never saw in training.","support":"source-stated"},{"text":"The training recipe used supervised fine-tuning followed by modified GRPO, with reward adjustments intended to address reward variation and response length.","excerpt":"AI21’s FDR team achieved these results by designing a custom training recipe that sequentially applied on-policy SFT, followed by a modified GRPO (online RL) technique.","support":"source-stated"},{"text":"The reported benchmark results do not by themselves establish how the model would perform against attacks in deployed enterprise systems.","excerpt":"The second is CHASM, Alice’s Enterprise Indirect Prompt Injection (IPI) benchmark, designed as an out-of-distribution gym comprising 117 attack tasks across enterprise workflows","support":"interpretation"}],"limitations":["The post reports results from validation environments and CHASM, not from deployed enterprise systems; it does not establish real-world attack resilience.","The cost comparison is stated as 25 times cheaper than GPT-6.1 Sol per 1M tokens, but the post does not provide the underlying cost figures in the supplied text."],"mediaId":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","correctionReason":null,"id":"fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa","publicationId":"91be6493-5d87-401d-873e-bdab1e6d8f5e","version":1,"sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","sourceTitle":"Post-training case study: Reaching frontier-level attack resilience with Alice | AI21","publisher":"AI21","publishedAt":"2026-11-02T13:35:58+00:00","originalPublished":{"value":"2026-11-02T13:35:58+00:00","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-11-03T12:48:22.253Z","createdAt":"2026-11-10T10:25:11.962Z","historical":true,"entityIds":["ai21"],"topicIds":["intelligence-and-discovery","institutions-and-trust"],"media":[{"id":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","kind":"article","url":"https://www.ai21.com/blog/ai21-alice-case-study/","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-03T14:46:51.736Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."},{"id":"7d994900a8c4fb1848edd8a1df464bfe3c8d13c332be56eef75691877e6b320e","kind":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GP","provenance":"publisher_page","verification":{"status":"verified","checkedAt":"2026-11-03T14:46:51.736Z","method":"publisher_association_and_head","contentType":"image/png","cacheUntil":1793717211736},"recommendationReason":"Observed on the acquired publisher source; availability checked."}],"sourceMedia":{"status":"found","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","checkedAt":"2026-11-03T14:46:51.541Z","items":[{"type":"image","url":"https://www.ai21.com/wp-content/uploads/2026/11/Figure-1-2-1536x1047.png","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","attribution":"AI21","basis":"publisher-embed","availability":"verified","label":"Figure 1: Our training recipe lifted Nemotron 3.5 Super VL from comparable in quality and cost to GPT-6.1 Luna to surpassing GPT-6.1 Sol in quality at a fracti…","verifiedAt":"2026-11-03T14:46:51.736Z"}],"note":"Media declared by the original publisher; availability checked separately from the editorial reading."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"c98e87b604f4425173238da3f6f0faf31f3616c244ad57f0b135303ffe74a7dd","confidence":0.9500000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"b7a4163385f4d9686cf9a4ad43cd37fd20509b2bab511ce0f767ddcf517b7dff","decidedAt":"2026-11-03T14:46:53.467Z"},"provenance":{"textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observationId":"9995cd888f016be15b9c4053e4d862f18807fc2ff3fa33a3363486f23c09380d","retrievedAt":"2026-11-03T14:46:51.541Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"c2557ec1-6820-4372-8490-2ba2ca385704"},"reviewer":{"model":"gpt-6-luna","runId":"7771762f-2b2c-4751-8e14-d1e8c7417749"}},"audit":{"status":"passed","reviewedAt":"2026-11-10T10:25:11.962Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"AI21 Labs","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"AI21 Labs","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"AI21 Labs","status":"stated","provenance":{"basis":"article-jsonld","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","locator":"document/html[1]/head[0]/script[59]@2308.@graph[0].author"},"assertionId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-03T14:46:51.541Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7","sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","contentSha256":"4cf976e89e532e149ab8feae2c18b3a391a1bbb6d3ff1fe634e564ca31236831","textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observedAt":"2026-11-03T14:46:51.541Z"}}],"participationCoverage":{"total":2,"returned":1,"complete":false,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://www.ai21.com/blog/ai21-alice-case-study/","snapshotId":"ee53e58595a261ad70a7ed8e7ed6362db27716ca4900d6e9fd3984d9f12d62e7","contentSha256":"4cf976e89e532e149ab8feae2c18b3a391a1bbb6d3ff1fe634e564ca31236831","textHash":"02fcb095d6082b545a406ca87ac497ce35efdadd6c2bd74b5b7d18f9a04bb09e","observedAt":"2026-11-03T14:46:51.541Z","basis":"publisher-page-metadata","sourceLinks":2,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/fb839f87921731feaaf42097bcdd4da4a48d2df5f3ae3c3ad3e72258875668aa/source"}}}],"audits":[{"publicationId":"91be6493-5d87-401d-873e-bdab1e6d8f5e","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly names AI21's blog, its listed authors and the Alice collaborators. Results and arguments stay attributed to the authors ('They report', 'The authors argue'), and the deployment caveat is labeled as Escape Meridian's reading.","excerpt":"This blog is authored by Assaf Gerner, Guy Rephaeli, Asaf Karnieli, Guy Freund, Shaked Meirom and Joanna Kramer, in collaboration with Alice’s Liran Cohen and Dadi Atar."},{"dimension":"summary","status":"pass","explanation":"The reading leads with the actor and the development. It explains indirect prompt injection in plain language and calls GRPO an online reinforcement learning method. It keeps the source's thesis that resilience need not cost task completion, and it reports the figures accurately. The question is a genuine open issue. Smallest optional repair: a short gloss for 'out-of-distribution', such as 'shares no tasks or apps with training'. The reading is understandable without it.","excerpt":"CHASM shares no tasks or apps with the RL gyms, so it tests whether that behavior generalizes."},{"dimension":"date","status":"pass","explanation":"The originalPublished value is 2026-11-02T13:35:58+00:00, taken from the publisher page. It matches the feed entry and comes before first observation. No conflicting earlier publication is indicated.","excerpt":null},{"dimension":"support","status":"pass","explanation":"The numeric claims are verbatim-supported: 41 points, 10 points, 25x per 1M tokens, CHASM 7.54 to 33.96, and 117 tasks. The SFT-then-modified-GRPO recipe and the length and repetition penalties are stated in the source. The deployment-gap point is labeled as interpretation and does not overclaim. The limitations add no unsupported facts, and no benefits or costs beyond the source are implied.","excerpt":"Together, AI21 and Alice improved Nemotron 3.5 Super VL’s attack resilience by 41 points above the base model and 10 points above GPT-6.1 Sol without harming overall task performance"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original AI21 blog post, which is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-10T10:25:11.962Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}