Known attacks won’t protect you from the next one.

The last two years have made one thing clear. As AI systems move from answering questions to taking actions, the central risk is no longer that a model says something wrong. It is that a model, given real access to systems, data, and decisions, can be manipulated into doing something wrong. An instruction hidden in a document. A payload buried in a web page an agent reads. A crafted input that turns a system’s own autonomy against the people who deployed it.

The field has responded to this the way strong technical fields respond to any new class of risk: by learning to find it. And that work has been genuinely important.

Finding the weakness was the necessary first step

A serious discipline has grown up around adversarial testing of AI systems. Automated attackers that probe a model for failure modes at a scale and speed no human red team could match. Evaluation environments that let you observe how a system behaves under pressure, across scenarios, before it ever reaches production. Research teams that have turned years of experience with how bad actors adapt, evade, and escalate into a way of stress-testing models the way a real adversary would.

This is real progress, and it deserves to be recognized as such. Before you can trust a model to act, you have to be able to see how it fails. Automated adversarial testing and evaluation is how the industry moved from assuming a model was safe to measuring whether it is. That shift, from assumption to measurement, is one of the most important things to have happened in AI safety.

We build on that foundation, not against it. Measuring how a model fails under adaptive attack is where any honest robustness effort has to begin. The question is what you do with the measurement once you have it.

A measurement tells you where you stand. It does not change where you stand.

Here is the uncomfortable part, and it is the reason this problem is harder than it first appears.

Suppose you run the best automated attack in the world against a model and you get a clean, rigorous number: this is how often the model can be manipulated into acting against its purpose. That number is valuable. It tells you the model is exposed. It tells a security review the risk is real. It tells you where you stand.

It does not change where you stand.

The model is exactly as manipulable the day after the measurement as the day before. You have measured the weakness with precision, and the weakness is still there. The natural response is to build defenses around the model, filters that inspect what goes in and out, monitors that watch for known-bad behavior, guardrails that constrain what the system is allowed to do. These are useful, and they belong in any serious deployment. But they share a structural limit: they sit outside the model, reasoning about adversarial inputs with less context than the model itself has, trying to catch manipulation as it passes by. Against a determined, adaptive adversary, some of it will get through. And when it does, the model behind the wall behaves exactly as it always would, because nothing about the model changed.

Detection and defense treat the symptom. The weakness itself lives inside the model.

Known attacks are a library. The dangerous ones aren’t in it yet.

There is a deeper reason this is hard, and it goes to the nature of adversarial problems.

Much of AI security rests on knowledge of attacks that have already been seen. Years of accumulated experience with how bad actors behave, distilled into a corpus of techniques, is a real asset, and against known threats it is a formidable one. But an adversarial domain has a property that makes any such corpus, however large and however diligently maintained, a partial defense: the attacks that matter most are the ones not in it yet. Adversaries adapt on purpose. The moment a technique is catalogued, a capable attacker moves to one that isn’t. A library of known attacks, kept current by even the best research team, is by its nature a record of the past. It tells you what has been tried. It cannot tell you what will be tried next against your specific model.

This is the difference between retrieving attacks and generating them. Retrieving means drawing from a collection of what has been observed. Generating means producing a new attack against the model in front of you, one shaped to that model’s specific behavior and routing around its specific defenses, whether or not anyone has seen it before. A collection, no matter how well maintained, is retrospective. Robustness against a live adversary requires the prospective kind: an attacker that does not depend on having seen the attack before, because it invents it. A corpus built this way stays novel and diverse not because someone keeps refilling it by hand, but because it is the by-product of an adversary that keeps inventing. It compounds as a consequence of how it is produced.

Testing a model only against the catalogue of known attacks measures it against yesterday’s adversary. The one you have to survive is tomorrow’s.

The frontier is remediation, changing the model itself

This is where the field is heading next, and it is the hard part.

The durable answer to “this model can be manipulated” is not only to measure it, and not only to wrap it in defenses, but to change what the model does, to make the model itself resistant, so that when an attack reaches it, the model does not fall for it. Robustness built into the model rather than bolted around it. Measured the same way, as an attack success rate, but now as a property of the model, not a property of the perimeter.

This is genuinely difficult, which is why most of the field stops short of it. It requires more than knowing where a model fails. It requires producing the adversarial pressure that teaches the model to hold up, and doing it in a way that makes the model stronger without making it weaker at the job it was built for. Finding the weakness and fixing the weakness are different problems, and they demand different capabilities. The first is a testing problem. The second is a training problem. A field that has learned to measure robustness has done the necessary work. The teams that can also remove the weakness are operating one layer deeper.

Where we operate

vlno works at that deeper layer. We produce adversarial attacks built around a system’s real agentic scenarios, measure how a model holds up as an attack success rate, and turn that into what makes the model itself stronger, so robustness lives in the model and travels with it wherever it runs. It works alongside the detection and defense layers, not instead of them. Measurement is where we begin. Changing the model is the point.

We think the arc of this field is clear. First the industry learned to assume less and measure more. That was the right and necessary move, and the teams who drove it advanced the whole field. The next move is from measuring the weakness to removing it, from testing the model to hardening it. Robustness you can measure, and then trust. A standard every agent earns before it is allowed to act.