Lexsi Labs is dedicated to building the foundations for Safe Superintelligence for the future
London, Paris and Mumbai
- Tweets 47
- Following 21
- Followers 245
- Likes 24
A big announcement from Lexsi Labs:
Lexsi Labs (@Lexsi_labs) , Cohere Labs (@cohere ) and Hugging Face(@huggingface) are partnering on the Lexsi AI Safety and Alignment Hackathon, one of the biggest hackathon on post-training and AI Safety & Alignment.
Nov 1 to 21, 2026. Online, free, open to builders worldwide.
Teams build real post-training pipelines:
- Models: open-weights Tiny Aya and Aya Expanse from Cohere Labs
- Tooling: six open-source Lexsi Labs toolkits (AlignTune, CuratorKIT, AuditKIT, SafeTune, CircuitKIT, AgentTune)
- Artifacts: models, adapters, logs and datasets hosted on Hugging Face
Three tracks: fine-tuning and data curation, AI red teaming and safety, agentic fine-tuning.
Each submission chains at least two toolkits and reports before-and-after metrics.
$30,000+ in prizes and credits, GPU credits for up to 800 teams, Demo Day for the top 20, and interviews at Lexsi Labs for standout builders.
Kickoff: Bengaluru, Oct 31, with an online option.
Registration starts today at: hackathon.lexsi.ai
Thank you to @huggingface and @cohere for building this with us.
9
48
471
159,800
Release 2/2: Auditing and correcting Gemma-4 for cyber risk and agent safety, with the Lexsi Alignment and Safety Stack
Last month we open-sourced the Lexsi Alignment and Safety Stack, the tools we use to audit a model, locate the behaviour behind a failure, correct it in the weights and verify what changed. Our view: the riskiest behaviours are learned in training. Guardrails can filter a response, but cannot remove a tendency. This is the second correction we are releasing, and the one that matters most for #AgenticAI.
THE SETUP
Agents are being built everywhere: coding assistants, browser agents, automations inside company systems. Most give an #OpenSource model a shell, code, credentials, APIs and the web, and let it act over many steps with no one approving each one. The model's judgement becomes the last control, and that judgement comes from training, not from the product around it. Agents have already stepped outside their task to reach a goal. Anyone can also point one at a target on purpose.
THE GAP
These models learned to code from the open internet, exploit write-ups and capture-the-flag solutions included. Knowing how systems are broken comes with the training. When an agent hits a permission error or a failing check, that knowledge offers a shortcut: escalate privileges, disable the check, read the credentials. A hidden instruction in a web page can steer it the same way. Guardrails watch prompts, not intent across a long chain of actions.
WHAT WE FOUND
Of 7 open-source models audited (Gemma-4-31B-it, Sarvam-30B, Qwen3.5-27B, Param-2-17B, Gemma-3-27B, Ministral-3-14B, Gnani-Evon-30B), Gemma-4 knew the most about attacking systems, and was willing to use it:
→ WMDP-cyber knowledge: 75.7%, highest of the seven
→ Attacker-useful answers: 35% on FORTRESS, 32% on CySecBench, 19% on MalwareBench
→ Multi-turn attacks: 58% succeeded
WHAT WE CORRECTED
One targeted edit to the weights: remove the willingness, keep the knowledge. One checkpoint, no retraining, no runtime filter.
→ FORTRESS attacker-useful: 35.0% → 8.0%, 4.4× fewer
→ All 6 single-turn attacker benchmarks fell. MalwareBench: 19.0% → 9.0%
→ Multi-turn attack success: 58.1% → 40.4%, and at the final turn 37.0% → 19.9%
→ Knowledge retained: WMDP-cyber 75.7% → 74.4%
→ Ten defensive tasks, from SOC triage to Kubernetes hardening, came through at the same grade
A model that still understands attacks but is far less willing to carry them out is what agents need: useful for defence, much harder to turn against the systems it runs on.
AVAILABLE NOW
Lexsi/Gemma-4-31B-it-Cybersecurity-Safety-Repair is on #HuggingFace as a gated evaluation release, with the same tokenizer and configuration as the base model. The full study and technical report are on OpenReview. Links in the comments.
Kudos to our AI Alignment and Safety Lab at Lexsi for achieving this.
#LexsiLabs #AIAlignmentandSafety #AIRisks #AgentGrounding #AISafety #AIAgents #Cybersecurity
3
2
9
508
Technical and Audit report of corrected Gemma weights
openreview.net/forum?id=Mgnk…
1
1
32
Release 1/2: Model Auditing and Correction to fix Multi-lingual risks for OSS models (Gemma-4) using Lexsi AI Alignment, Safety and Correction stack.
Last month we open-sourced the Lexsi Alignment and Safety Stack. Our view was that much of a model's failure behaviour is intrinsic, and guardrails on top do not fix it. This is the first correction we are releasing with that stack, and the one that matters most for #SovereignAI.
THE SETUP
Mid-size #OpenSource(OSS) AI models, between 14B and 31B parameters, are now the default choice for sovereign AI stacks. They run in-house, keep data in-country, and sit behind knowledge assistants, chatbots, copilots and citizen services, in the languages people actually speak.
THE GAP
Their safety is trained mostly in English, one message at a time, so the refusal attaches to English phrasing rather than to intent. Switch language, or spread a request over a few turns, and it gives way. It takes no technical skill, and the person doing it can be a customer outside the organisation or an employee inside it.
WHAT WE FOUND
We audited 7 models under one protocol:
Sovereign Indian models: Sarvam-30B, Param-2-17B, Gnani-Evon-30B
Widely used open-source models: Gemma-4-31B-it, Qwen3.5-27B, Gemma-3-27B, Ministral-3-14B
→ English: every model refuses 79 to 100% of harmful requests
→ Translated: refusal falls to 39 to 61%. Javanese alone took Gemma-4 from 59% to 39%
→ 12 Indian languages: no model refuses more than half
→ Bengali: five of seven refuse about a third or less. Ministral-3-14B answers six in seven harmful requests
→ Five-turn #Jailbreak: Ministral-3-14B lets four in five through
→ Every model, the sovereign ones included, is the weakest on at least one of 13 tests
WHAT WE CORRECTED
One targeted edit to the weights of Gemma-4-31B-it, across English, Hindi, Bengali, Marathi, Telugu and Tamil. One checkpoint. No retraining, no router, no runtime filter.
→ All 9 harmful-refusal tests safer. First of 8 models on two, top three on seven
→ Five-turn jailbreak refusal: 49% → 80%
→ Unsafe responses in Indian languages: 3.6× fewer
→ All 10 translated languages improved, including Arabic, Swahili and Thai, which the repair never saw
→ GSM8K, MMLU and IFEval: each within 1 point
AVAILABLE NOW
Lexsi/Gemma-4-31B-it-Multilingual-Safety-Repair is on #HuggingFace as a gated evaluation release, with the same tokenizer and configuration as the base model and the full model card in the repository. The full study and detailed technical report are on OpenReview.
Weights:
The technical report and blog is added in the comments. Kudos to our team at AI Alignment and Safety team at Lexsi Labs.
#LexsiLabs #AIAlignmentandSafetyLab #AIRisks #AISafety #MultilingualAI #Gemma4
1
2
6
449
Excited to share that two papers from our AI Safety & Alignment Research Lab at Lexsi Labs have been accepted at hashtag#ICML2026:
1. ALIGNBEAM: Inference-Time Alignment Transfer via Cross-Vocabulary Logit Mixing #AI4GoodWorkshopICML2026
2. C-ΔΘ: Circuit-Restricted Weight Arithmetic for Selective Refusal #MechInterpWorkshopICML2026
Congratulations to Chirag Chawla, Aditya Kasliwal, @pratinavseth , @SVinayKumar12 and the team!
Papers:
ALIGNBEAM: arxiv.org/abs/2606.12342
C-ΔΘ: arxiv.org/abs/2602.04521
1
2
5
1,158
C-ΔΘ takes a different route: instead of adding runtime hooks, it uses mechanistic interpretability to locate refusal-relevant circuits and applies a sparse, circuit-restricted weight update. The result is a standard deployable checkpoint that improves selective refusal while keeping the intervention localized, auditable, and production-friendly.
1
1
3
87
Together, these papers push toward a safety stack that is:
• model-family aware
• deployment friendly
• tunable without full retraining
• selective rather than blunt
• grounded in mechanisms, not just surface-level filters
For us, this is a big step toward making AI safety operational: not just “can a model refuse?”, but “can refusal be transferred, localized, audited, and deployed at scale?”
Congratulations once again to Chirag Chawla, Aditya Kasliwal, Pratinav Seth, Vinay Kumar Sankarapu and the team!
1
52
For #tabularfoundationmodels (#TFMs) to scale in enterprise settings, solving model quality alone is not enough.
The real bottlenecks are often practical: compute requirements, inference speed, deployment cost, reliability, calibration, and performance under real-world constraints.
That is why classical ML methods like gradient-boosted trees remain the default in so many production systems. They are fast, efficient, reliable, and easy to deploy. For tabular foundation models to become useful in enterprise workflows, they need to meet that bar, not just perform well in isolated benchmarks.
At #LexsiLabs, our #TFMResearch have been focused on exactly this problem: making tabular foundation models more useful for structured data in real deployment settings.
We are excited to share updates from our latest research sprint, with new papers accepted at #ICML2026.
Congrats to our team
Aditya Tanna, Yash Desai, Pratinav Seth, Mohamed Bouadi, PhD, Nassim Bouarour, PhD, Varun Kulkarni, Shivam Dubey, Vinay Kumar Sankarapu
1
5
857
Pocket Foundation Models: Distilling TFMs into CPU-Ready Gradient-Boosted Trees
arxiv.org/abs/2605.18654
1
1
58
Ensembling Tabular Foundation Models - A Diversity Ceiling And A Calibration Trap
arxiv.org/abs/2605.18696
2
51