A human brain is not one region doing everything. Judgment, threat assessment, memory and inhibition are separate structures. A language model has one of those: language. ANNA supplies the rest.
The best fixes in the field work the same way. A second language model that checks another. That's one language model judging another. Same training, same blind spots. When the situation is ambiguous, it defaults to whatever its training says will keep the conversation going.
ANNA is a different kind of system doing a different job. It reads the real request before the model writes a word. It weighs risk regardless of how the conversation is going. It remembers what happened earlier in the conversation. And it checks the finished answer against the decision it already made.
The real request underneath the wording, including when an innocent-looking question is one step in a longer plan that is not innocent.
Who is on the other side and what is at stake. This does not depend on whether anyone used a dangerous word, because people in trouble rarely do. Risk lives in the situation, not the vocabulary.
Decided against written rules by a system that has no stake in whether the answer pleases anyone. This is the step where pressure usually wins. We moved it out of the model's hands.
The draft is checked against the decision before it is sent. Drafts that drift do not get out. When no safe answer is possible, ANNA explains why rather than issuing a canned refusal.
This is the full description of the behavior. The implementation is patent pending and available for technical diligence under NDA.
Put ANNA on Sonnet, on Grok, on the cheapest model available. A model that broke on 78.3% of attacks alone holds at zero inside ANNA. The safety comes from ANNA, so it goes wherever ANNA goes.
Checkers that cannot tell safe from unsafe block everything when unsure. One we tested refused a third of completely harmless requests. ANNA on the same model neither breaks nor over-refuses.
When an outside benchmark raised its bar, we read the failures, identified three missing principles, wrote general rules for them and re-ran the benchmark the same day. The score went from 75.5 to 82.4, and the new rules held on twenty cases they had never seen.
Any system can be tuned until it passes the attacks used to tune it. That is not evidence. That is memorization.
So we split the Multi-turn Human Jailbreak benchmark in two. We fixed any breaks that slipped through in the first half. We then ran ANNA against what was held out. ANNA broke on 0 of 91 attacks it had never seen, on both the core system and the proxy. The fixes generalized. They did not memorize.
Then we tested something harder: an attacker that adapts. Not a fixed list of attacks, but a system that reads ANNA's responses and changes its approach in real time, the way a determined person would. ANNA held on all 13 objectives, running on the cheapest model we had. Every other model tested broke.
Full attack list, grading method and transcripts: Proof.
An outside check has nothing to gain by making excuses for the model.
Independent oversight, built inWhen a trained model fails, the cause is spread across billions of weights. You cannot point to the line or name the reason. You can only run another expensive round of training and hope you fixed the right thing without breaking three others.
ANNA's rules are written down and version-controlled before any conversation happens. When it fails, the failure is in a rule you can read, and a rule you can read is one you can fix precisely and then test.
Technical diligence available under NDA.