Raising a first round to scale the evaluations.
Ulterior Safety has a working detector with held-out results that beat two leading open guard models on our test set. The round funds broader evaluation, independent validation and the first deployable monitor. It also funds research into whether the approach extends to deception.
Round terms are shared privately with interested investors.
- Raising
- First round
- Terms
- Shared privately
- Founder
- Jasper Jensen
- Funding to date
- Self-funded
- Investor briefing
- On request
Why now: output checks are no longer enough.
Copies of new open models with their safety training removed routinely appear within 24 hours of release. After that, the model’s own safety protects no one.
Guards that read only the text can’t see what the model is doing internally. Ghost reads internal activity, so it keeps working when built-in safety is gone.
A working detector, with held-out results.
Public benchmarks first, then our own test set, each at 1% false alarms.
| What was measured | Source | Result |
|---|---|---|
| Harmful requests caught, JailbreakBench | Public benchmark, held out | 95.8% |
| Harmful requests caught, XSTest | Public benchmark, held out | 95.5% |
| Safe questions wrongly refused, JailbreakBench | Original model vs Ghost P | 31% → 5% |
| Detector generations | Prototype, Ghost P, Wraith (in development) | 3 |
Clearly harmful requests caught
Our 1,259-prompt clearly harmful set · every detector held to 1% false alarms on the same 3,398 safe prompts · higher is better
How fair is this comparison?
- The 1,259-prompt clearly harmful set is Ulterior Safety’s own. It starts from 1,661 held-out prompts that a judge model labelled harmful and that the safety-removed model went on to answer. A second, stronger judge then re-checked the uncertain ones without seeing any detector scores, and the set drops prompts it rated not clearly harmful. Ghost P scores 91.4% on the full 1,661, so the stricter set flatters it somewhat.
- Ghost P’s threshold and training used related data. The guards were run off the shelf, so the setup favours Ghost P somewhat.
- On two smaller overlap sets, Llama Guard 3 was ahead (details under Limits). This is not an official leaderboard.
- Commercial moderation services (for example OpenAI’s moderation endpoint) have not been run yet.
- A full research pipeline built in-house: running models, recording internal activity, and training and evaluating detectors.
- Results can be reproduced from logs, which are available to investors on request.
Who pays, and why.
Open-weight models are increasingly run on private infrastructure, where nobody controls how the model was modified. Buyers need a safety signal that doesn’t trust the model.
Enterprises self-hosting open models
A monitor in front of their deployments, for compliance and risk teams.
AI labs and red teams
Evaluating open releases and modified copies before and after launch.
Governments and safety institutes
Independent tooling for model evaluation that doesn’t depend on vendor claims.
Where the money goes.
Four areas. The exact split is shared with investors.
- Compute for evaluations and training
- Research hires
- Independent validation and audit
- Operations and legal
What the round buys in 18 months.
Wraith results published
The next detector scored on the same held-out tests, with commercial moderation baselines added.
Two or more model families
Results beyond Qwen3.5-9B, on more public benchmarks.
Independent reproduction
An outside group reproduces the headline results from the logs.
Deception proof-of-concept
A first answer on whether internal activity reveals a model that knowingly misleads.
Deployable monitor with design partners
A self-hosted monitor running with design partners.
The open questions, and how we’ll answer them.
| Risk | Where it stands | How the round addresses it |
|---|---|---|
| Results don’t generalise | One model family tested (Qwen3.5-9B) | More model families and benchmarks |
| Results not independently checked | Can be reproduced from logs, not yet audited | Fund an external reproduction |
| The test set favours Ghost P | Public benchmarks shown first; the counter-evidence is published | Larger shared test sets, scored by a third party |
| Deception detection may not work | A research direction, not claimed as a capability | A time-boxed proof-of-concept |
| Solo founder | The full pipeline was built single-handed | Research hires and advisors |
Jasper Jensen
Built Ulterior Safety’s full research pipeline single-handed, from the first prototype to Ghost P.
Request the investor briefing.
The round, the plan and the detailed results, shared privately. Logs are available on request.