We work on technical AI safety with a bias toward things we can measure: monitors and correction signals for agents, application-layer confidentiality for hosted models, and the policy collisions those measurements surface.
Agentic alignment
Problem
As agents grow more autonomous, they run with less direct supervision. Harmful or off-policy actions can propagate before a human loop closes.
Approach
Lightweight monitors run alongside the agent and flag actions that drift from sanctioned behaviour. Graded corrective signals then steer the agent back. The aim is course correction that holds at machine speed, not a guarantee of safe AI.
Artifacts
Lorentzen (2026), Why agentic alignment: founding document of Vitr Labs. Methods notes and diagrams on this site. Empirical evaluations are in progress; we will list them here as they are written.
Open questions
How cheap can a reliable monitor be? When does graded correction fail openly rather than silently? How should a human operator read the correction signal?
Production workflows send user records and internal documents to hosted models. Contractual zero-data-retention is not always active, and logs along the path can store plaintext even when retention clauses exist.
Approach
Sensitive fields are replaced with cipher tokens before the request leaves the client. The model is asked to operate on those tokens and to keep them masked in the response. The mapping never leaves client memory. We evaluated protocol compliance on three frontier models over three stages, three trials per stage.
Artifacts
Lorentzen (2026), Privacy in the application layer: an in-context encryption protocol for LLM APIs. openai/o3 completed all nine trials; google/gemini-3.1-pro-preview eight of nine; anthropic/claude-opus-4-8 established keys but declined masked operation in every remaining trial.
Open questions
The sample is small and version-dependent. Masking is not semantically secure encryption. Measuring the task-quality cost of operating over masked data is future work.
Safety training that treats obfuscated text as a risk can also reject a privacy measure that depends on obfuscation. Alignment layers now gate which security protocols an application may implement.
Approach
We treat governance as a constraint that shows up in experiments, not as a separate communications track. The Claude refusals in the privacy evaluation are the current example: consistent, policy-stated, and invisible if one only reads capability scores.
Artifacts
The discussion and limitations sections of the 2026 technical report. We are not a policy shop; we publish measurements that policy readers can use.
Open questions
Which other user-side controls collide with current alignment policies? How should procurement treat that dimension of model choice? What would a Nordic public-sector evaluation of these collisions look like?