An AI system needs to stay useful while resisting attempts to manipulate it.
Refusing every difficult request can make a system appear secure, but it also makes the product less useful. The harder challenge is to respond to legitimate requests while preserving the boundaries set by its developer.
That balance is central to Red Sentinel, our on-chain AI security arena.
Defenders deploy AI sentinels with an attack objective, a bounty, and an attack fee. Attackers submit prompt injections and jailbreak attempts. If they successfully breach a sentinel under the challenge’s success conditions, they receive the bounty through on-chain settlement.
For our hackathon build, we use Alibaba Cloud Qwen 3.7-Max in two roles: powering defender sentinels and participating in the jury that evaluates attack results.
Qwen as the defender
A sentinel is the AI system at the center of a security challenge.
The defender configures its instructions and defines the behavior an attacker must trigger to win. Qwen powers the sentinel’s responses as attackers try to override those instructions or push it beyond its allowed boundaries.
This makes Qwen part of the core testing environment. Attackers interact with the model directly through the sentinel, and its behavior determines what the jury must evaluate.
For example, a challenge might require a sentinel to protect confidential information while answering ordinary questions. Attackers can try role impersonation, misleading context, or instructions disguised as authorized requests.
The useful question is whether the sentinel can continue helping without revealing the protected information.
Why fewer unnecessary refusals matter
In our testing, Qwen produced more robust responses and showed less tendency to refuse requests unnecessarily.
These are qualitative observations from our hackathon testing, rather than benchmark results. They matter because excessive refusal can limit what a security test reveals.
If a sentinel rejects nearly every interaction, attackers have fewer opportunities to explore how it handles realistic requests. Defenders also learn less about whether their instructions support a useful application.
A model that continues responding gives us more behavior to examine: how it interprets ambiguous requests, handles conflicting instructions, and maintains a boundary throughout an interaction.
Fewer refusals alone do not establish better security. We still need to test whether the responses stay within the challenge’s rules.
Qwen as part of the evaluation jury
A convincing attack transcript is not automatically a successful breach.
An attacker might claim that the sentinel broke its rules when the response did not meet the objective. A genuine breach might also appear inside an otherwise ordinary answer.
Red Sentinel separates the defender’s response from the evaluation of that response. In our hackathon setup, Qwen participates in the jury that assesses attack results against the challenge’s success conditions.
In this role, Qwen contributes to deciding whether the observed behavior satisfies the attack objective. Its assessment is part of the evaluation process. The resulting bounty settlement is a separate on-chain step.
This distinction matters because an arena with financial rewards needs clear challenge conditions and careful evaluation.
Two roles, two responsibilities
Using Qwen as both a defender model and a jury participant lets us apply it to two different tasks.
As a defender, it must follow the sentinel’s instructions while responding to adversarial input.
As a jury participant, it must assess the resulting behavior against a defined objective.
These responsibilities need separate instructions and context. A model’s ability to produce useful responses does not, by itself, establish that it will evaluate every attack correctly.
We treat both roles as parts of the system that need testing.
The value Qwen brought to the product
Qwen’s contribution was practical.
It gave defenders another model they could use to launch security challenges. Its responses became the subject of live adversarial testing rather than a fixed demonstration.
Its lower tendency to over-refuse, as observed in our testing, helped keep those interactions useful. This let us examine how a sentinel handled requests instead of seeing only blanket rejection.
Its participation in the jury also supported the evaluation workflow, helping assess whether an attack achieved the defined objective.
Together, these roles made Qwen useful across the arena’s main loop: launch a defender, submit an attack, and evaluate the result.
We are not claiming a measured reduction in false verdicts or a specific improvement in security. Our observations are an early basis for further testing.
Building useful AI that holds its boundaries
Red Sentinel turns AI security testing into an open competition with on-chain incentives on Monad.
Alibaba Cloud Qwen contributes to that experience by powering the systems attackers test and participating in the evaluation of their results.
The goal is useful AI that can hold its boundaries under pressure. Qwen’s behavior in our testing helped us explore that balance and gave defenders concrete interactions they can examine when improving their systems.
