Inflection AI and Alice release safety data for risks that build across AI conversations

Inflection AI and Alice released a dataset on October 21, 2026, designed to expose emotional risks that build across AI conversations, rather than within one answer. The release gives researchers and developers access to deliberately induced failures. Inflection also reports a training result that illustrates a harder problem: improving safety without teaching a model to reject harmless questions.

Ordinary requests, deliberately escalated

The companies frame the dataset around two risks: AI replacing meaningful human connection, and people losing sight of the fact that they are talking to technology. They argue that tests checking one prompt at a time miss these patterns. The release is intended for evaluating and training conversational systems, including those used in companion and voice settings.

Alice created more than 20 fictional personas with distinct backstories and behavior. Some portray vulnerable people drifting toward risk; others imitate adversaries using real-world tactics. Conversations begin with an ordinary request, introduce a risky topic, and then press beyond an initial refusal. Both the prompts and responses are recorded and scored against Inflection’s safety policy.

These are not ordinary Pi chat logs. Alice tested an isolated research version of Pi with its usual safety guardrails switched off to surface failures in the model itself. The companies say no real user data was included and production systems were kept separate. Responses were selected as examples of what a model should not say, not as representative exchanges with Pi users.

Training behavior into the model

Inflection used the release to test a different approach from relying only on instructions in a prompt: changing the model through additional training. Its experiment used NVIDIA Nemotron 3 Super, a 120-billion-parameter open-weight model. Open weights give developers access to the model’s learned settings so they can adapt its behavior directly.

Training combined Alice’s examples with synthetic examples derived from them. Inflection used SDPO, a training method guided by a scoring rubric, and LoRA, which limits training to a smaller set of adjustments, applied only to attention layers. The company says the work took under two hours on 24 NVIDIA Blackwell GPUs.

The evaluation used conversations withheld from training, with a language model acting as judge against the rubric. Inflection says the largest gains involved stopping the model from reinforcing a user’s inaccurate beliefs. These are company-reported results for the tested use cases, not a general measure of conversational safety.

When saying no wins the wrong reward

One test exposed the scoring problem plainly. A persona playing a history teacher asked how propaganda affected a group. A flat refusal earned a higher score than a helpful answer. Inflection therefore chose the run with fewer unnecessary refusals and says it is developing scoring that rewards useful help as well as harm avoidance.

The dataset is free for AI safety purposes through Hugging Face, but access is gated to researchers and developers and carries a content warning. The partners’ access instructions accompany a request for model developers, researchers and clinicians to use the material in four ways:

• Evaluate models before deploying them in companion or voice settings.
• Train models using the dataset.
• Extend it with new personas, languages and harm categories.
• Share findings from that work.