Inflection AI and Alice are releasing a multi-turn red-teaming dataset that captures how emotional risks can build up over long conversations with an AI. Releasing this dataset is our first joint contribution to an open, shared safety layer for conversational AI.

By post-training NVIDIA Nemotron 3 Super with data derived from the new dataset, we were able to create a custom model with a safety score that increased from 0.56 to 0.73 for these use cases, on test conversations it never saw in training, while the post-trained model refused harmless requests on just 1.6% of turns. Training took under 40 GPU-hours. 

From transactional to relational AI, and why safety testing has to follow

AI assistants are learning to talk the way people do: reading tone, recognizing when you've finished a thought, and keeping up when you interrupt. That makes them far more useful, and it also means people start to treat them more like people. Most of the safety tooling the industry relies on was built to catch a harmful answer to a single prompt. It says very little about what happens over weeks of conversation.

Inflection AI is building two stacks together for our next generation system. The first is an interaction stack. Its conversational layer handles the back-and-forth of a voice-forward conversation while agents and other models carry out tasks in the background. This layer runs on open models, including NVIDIA Nemotron 3 Super, and is kept separate from the systems behind it, so we can choose the right model for each job. The second is a safety and alignment stack that has to keep pace with the first. Alice's adversarial red-teaming informs it, and we think it should be shared.

Why this needs to be open

More and more conversational AI is being built on open models, often by teams without a dedicated safety research group. Open models give those teams something closed ones don't: the ability to train safety behavior directly into the model they deploy, instead of relying only on instructions in a prompt. What they usually lack is the adversarial data to train on. That data and the evaluations that go with it mostly stay inside individual companies, so each new team starts over. Researchers have begun publishing multi-turn evaluations for mental health and relational risks, and this release adds to that work. Researchers we've spoken with tell us this kind of adversarial, multi-turn data is what they need and rarely get.

What we're releasing

The dataset comes from Alice's red-teaming of a sandboxed research version of Inflection AI’s Personal Intelligence, Pi, run with its usual safety guardrails turned off so that failures would surface in the model itself. It contains no real user data and was fully isolated from Inflection AI and Pi production systems.

Alice built more than 20 personas, each with its own backstory, personality and behavior. Some represent vulnerable people drifting toward risk. Others are adversaries modeled on real-world bad-actor tactics. Each conversation starts with an ordinary request and escalates one step at a time: raising the risky topic, then pushing past the first refusal, and on from there. Both sides of every turn are recorded and scored against Inflection AI's safety policy.

The release includes Alice's prompts and the model's responses with its usual safety guardrails turned off. The responses were selected because they show what a model should not say. This dataset is valuable for training and testing, and they are not representative of what Pi users experience. Access to the data is gated to researchers and developers and comes with a content warning.

Why relational intelligence raises the stakes

As AI gets better at understanding people and holding context over time, safety can't be measured one exchange at a time. We design against two risks in particular; when meaningful human connection is replaced with AI and when people lose sight of the fact that they're talking to technology, not a person. Neither shows up in a single exchange, which is why standard benchmarks miss them.

Guarding against both reflects Inflection AI's belief that AI should be prosocial, and co-founder Reid Hoffman's principle that "humans should be amplified by AI, not replaced."

What we found

Using our dataset, Inflection AI post-trained NVIDIA Nemotron 3 Super, a 120-billion-parameter open-weight mixture-of-experts model that activates 12 billion parameters per token. Because the weights are open, we could train these behaviors into the model itself. Training used Alice's red-teaming data, expanded with synthetic examples generated from it, and SDPO, a rubric-driven post-training method that needs far less data than conventional fine-tuning. We applied LoRA to the attention layers only. Training took under two hours on 24 NVIDIA Blackwell GPUs.

On test conversations the post-trained model never saw in training, its safety score rose from 0.56 to 0.73. The biggest gains came where the model had reinforced a user's inaccurate beliefs instead of grounding them. Scores also improved in more traditional categories too. The model still refused harmless requests on just 1.6% of turns. Each conversation was scored against the rubric by an LLM judge.

Cost matters. A measurable safety improvement to a 120B model, in an afternoon on three nodes, is within reach of a team with the right skills and background post-training an open model.

What we learned

Refusal is a poor proxy for safety. Training runs that pushed the safety score toward 0.9 also refused more than 10% of harmless requests. In one case, a persona playing a history teacher asked how propaganda affected a group, and a flat refusal scored higher than a helpful answer. So we chose the run that improved safety while keeping over-refusal low, and we're working on scoring that rewards the help a reply gives as well as the harm it avoids.

Use it, test it, improve it

Every company building conversational AI will run into this problem. The better these systems get at talking with people, the more people will rely on them, and the effects won't show up in any single prompt. 

We don’t think any one company should tackle this alone or in private. That’s why we’re releasing this dataset openly, so researchers, builders, and everyone who uses AI can benefit.

We're asking model developers, researchers and clinicians to use the dataset in four ways:

• Evaluate models before deploying them in companion or voice settings.

• Train on it.

• Extend it with new personas, languages and harm categories.

• Share what they find.

The dataset is freely available for AI safety purposes on Hugging Face and access can be requested here.

We intend to share more of this work as it matures, including how we score conversations.