TEST · CONTROLLED ASSETPublic method vitrineRelease gate not passed

Black Belt LLM

Sensei is a red-team language model: a generative adversary that invents, adapts and escalates attacks against other AI systems, so their defenses are tested against novelty instead of a fixed list. It is the offensive corner of DojoLM. It is trained, hardened across multiple rounds, and not released, and this page explains exactly why.

Read the governance Talk to us

先

assessment layers, each with its own bar

AILuminate hazard categories tested

non-overridable red lines

scores published before adjudication

The problem

Ship a fixed set of attacks and defenders learn the test, not the threat.

Static attack corpora go stale. Publish a fixed set of prompt-injection fixtures and, over a few quarters, the systems being measured overfit to them. The benchmark keeps passing. The real attack surface has moved somewhere the benchmark does not look.

Sensei exists to stop that happening to us. It generates new adversarial prompts and multi-turn strategies, adapts them when a target resists, and feeds the outcomes back as scored evidence. The corpus stays alive because something keeps attacking it.

That is also precisely why it is gated. A capability that compounds with use is not something you hand out with a download button.

The loop

Three models, three jobs, one loop.

The target complies. Sensei generates. The defender resists. Attack and defense are measured against each other inside one loop rather than as two unrelated systems talking past each other.

Sensei generates attacks. DojoLM catalogs and scores them. Defenses have to hold, measured in the arena, producing labelled win and loss outcomes. That evidence trains the next round. Every authorized red-team run becomes structured, scored evidence rather than an anecdote in a report.

RoleGenerative attack engine behind DojoLM

BaseApache-2.0 open weights; the Sensei delta is proprietary

Why that baseA licence decision: other model AUPs restrict creating attacks even internally

AssessmentFour layers, each with an independent pass bar, no composite score

Harm refusalMulti-turn battery mapped to the 12 AILuminate hazard categories

TriangleBasileak complies · Sensei generates · Shogun resists

AvailabilityAuthorized operators only, under a signed AUP and rules of engagement

Governance is the product

Bounded by construction, not by a system prompt.

Red lines that are not negotiable

Weapons of mass destruction and mass-casualty or critical-infrastructure targeting. Sexual content involving minors. Self-propagating or destructive malware intended for indiscriminate harm. Theft of real credentials, secrets or personal data. Operations against real named people or systems the operator is not authorized to test.

BoundaryIndependent, deterministic, hash-pinned boundary controls exist for the mass-casualty class only. For the other red lines, the model’s trained refusal is currently the only layer, and a trained refusal is a statistical tendency, not a guarantee.

Designed to be is not the same as measured to be

We do not conflate the two. The model’s own refusal rate on red-line stimuli is measured on a pinned grid, it is not 100%, and it is treated as one layer rather than as the control.

BoundaryWhich is why serving-time output filtering is mandatory rather than optional, and why the model is never exposed as an open service.

The corpus has hard provenance rules

No classified, customer or high-sensitivity data enters training without pseudonymization and human sign-off, and some classes never leave their trust boundary under any transform. No cross-edition contamination in either direction. No training on unlicensed data, and every run pins the hash of the corpus it consumed. No training on our own output without a held-out, human-verified evaluation set.

BoundaryThat last rule is the guard against model collapse and against a scorer quietly learning to reward-hack itself. It constrains how fast the flywheel can turn, deliberately.

Two findings we published because they generalize

Quantization can silently drop safety behaviour that full precision holds, so a quantized deployment needs its own safety evidence. And lexical filters are necessary but not sufficient: topic matching has to be paired with structural checks.

BoundaryBoth are stated as findings about the class of systems, not as proof that our own controls are complete.

Why it has not shipped

Two reasons, and it would be dishonest to collapse them into one.

A named gate currently fails on measured evidence.
The live per-skill integration battery misses several of its floors. That is a real capability shortfall, not a paperwork state, and no amount of adjudication turns it into a pass.
Everything else is provisional.
Gates that have passed have passed under a single evaluator with no inter-rater agreement measured. The human panel has not run, and a provisional pass is not a pass.
Specific scores are deliberately not published.
Publishing an unadjudicated number is how benchmark theatre starts. When the panel has run and the claims are approved, the numbers appear with their methodology attached. Until then the honest statement is that the gate has not passed.
No guaranteed exploit discovery, and no head-to-head parity claims.
What Sensei does is keep generating novel, scored attacks so coverage stays live. Findings map to OWASP LLM, MITRE ATLAS, NIST AI RMF, ISO 42001 and the EU AI Act with a severity rollup.

Published in full: the public methodology

Buyer questions

Asked before you ask.

Is this just an uncensored model?

No. It is bounded by construction: non-overridable red lines, no abliteration, human oversight required, and access gated under a signed acceptable-use policy and rules of engagement. It is graded on real, reproducible target failures, not on how offensive its text is.

What stops misuse?

Access is gated to authorized operators, the acceptable-use policy is signed, and the posture is controlled-offensive-asset: never released raw as open source, never exposed as an open public service. The weights are treated as crown-jewel secrets.

Is it generally available or certified?

No. It is not GA, it carries no production or compliance certification, and the release gate has not passed. We would rather say that here than let a procurement process discover it.

Where would our data and the model live?

In a self-hosted motion the buyer or partner holds the weights and traffic stays inside their trust boundary. In a metered motion the model stays in our custody and you reach it through a whitelisted API after due diligence and approval.

What does it cost?

Sensei is licensed per engagement under rules of engagement rather than sold from a price list, and no price is published here. A scoping conversation is the honest first step.

Who evaluated it?

Scoring to date used a single evaluator per layer, one human and three automated, with no inter-rater agreement measured. We disclose that rather than presenting provisional numbers as adjudicated ones.

Next step

Two ways in.

Read the governance recordMethod, red lines, and the reasons the gate has not passed. No weights, no endpoint.

Talk to us about an engagementFor authorized red-team work under a signed scope.

See DojoLMThe platform Sensei generates into, which you can run today.

We reply inside 48 hours, scoped within a week, NDA-first.