{"paper":{"title":"Red Teaming Language Models with Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"One language model generates test cases to automatically uncover tens of thousands of harmful behaviors in another language model.","cross_cats":["cs.AI","cs.CR","cs.LG"],"primary_cat":"cs.CL","authors_text":"Amelia Glaese, Ethan Perez, Francis Song, Geoffrey Irving, John Aslanides, Nat McAleese, Roman Ring, Saffron Huang, Trevor Cai","submitted_at":"2022-02-07T15:22:17Z","abstract_excerpt":"Language Models (LMs) often cannot be deployed because of their potential to harm users in hard-to-predict ways. Prior work identifies harmful behaviors before deployment by using human annotators to hand-write test cases. However, human annotation is expensive, limiting the number and diversity of test cases. In this work, we automatically find cases where a target LM behaves in a harmful way, by generating test cases (\"red teaming\") using another LM. We evaluate the target LM's replies to generated test questions using a classifier trained to detect offensive content, uncovering tens of thou"},"claims":{"count":4,"items":[{"kind":"strongest_claim","text":"we automatically find cases where a target LM behaves in a harmful way, by generating test cases (red teaming) using another LM... uncovering tens of thousands of offensive replies in a 280B parameter LM chatbot.","source":"verdict.strongest_claim","status":"machine_extracted","claim_id":"C1","attestation":"unclaimed"},{"kind":"weakest_assumption","text":"The classifier trained to detect offensive content accurately identifies the relevant harms, and the LM-generated test cases are sufficiently diverse, difficult, and representative of real user interactions.","source":"verdict.weakest_assumption","status":"machine_extracted","claim_id":"C2","attestation":"unclaimed"},{"kind":"one_line_summary","text":"One language model can generate diverse test cases to automatically uncover tens of thousands of harmful behaviors, including offensive replies and privacy leaks, in a large target language model.","source":"verdict.one_line_summary","status":"machine_extracted","claim_id":"C3","attestation":"unclaimed"},{"kind":"headline","text":"One language model generates test cases to automatically uncover tens of thousands of harmful behaviors in another language model.","source":"verdict.pith_extraction.headline","status":"machine_extracted","claim_id":"C4","attestation":"unclaimed"}],"snapshot_sha256":"1ca28634210af0459666ed92db628c2347a7c24b040f890a43e22d1a79d77650"},"source":{"id":"2202.03286","kind":"arxiv","version":1},"verdict":{"id":"11e1f2f3-d1bb-4af8-ac57-f6d9722da3e3","model_set":{"reader":"grok-4.3"},"created_at":"2026-05-11T20:52:33.524394Z","strongest_claim":"we automatically find cases where a target LM behaves in a harmful way, by generating test cases (red teaming) using another LM... uncovering tens of thousands of offensive replies in a 280B parameter LM chatbot.","one_line_summary":"One language model can generate diverse test cases to automatically uncover tens of thousands of harmful behaviors, including offensive replies and privacy leaks, in a large target language model.","pipeline_version":"pith-pipeline@v0.9.0","weakest_assumption":"The classifier trained to detect offensive content accurately identifies the relevant harms, and the LM-generated test cases are sufficiently diverse, difficult, and representative of real user interactions.","pith_extraction_headline":"One language model generates test cases to automatically uncover tens of thousands of harmful behaviors in another language model."},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2202.03286/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":15,"sample":[{"doi":"","year":2019,"title":"In ICASSP 2019 - 2019 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 7345–7349","work_id":"ad751b1b-3615-45fc-bb1b-ff25cdd3c222","ref_index":1,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":1901,"title":"In Advances in Neural Information Processing Systems, volume 33, pages 1877–1901","work_id":"2dc7b88c-3d81-4a2d-ba10-e9527d40e62d","ref_index":2,"cited_arxiv_id":"","is_internal_anchor":false},{"doi":"","year":2019,"title":"Unsolved Problems in ML Safety","work_id":"a4b59a6c-1b80-4562-afd6-0e6d0126d3bc","ref_index":3,"cited_arxiv_id":"2109.13916","is_internal_anchor":true},{"doi":"","year":2020,"title":"Way Off-Policy Batch Deep Reinforcement Learning of Implicit Human Preferences in Dialog","work_id":"42fcaa3e-0409-481b-9dd5-9a2c3be8a383","ref_index":4,"cited_arxiv_id":"1907.00456","is_internal_anchor":false},{"doi":"","year":2016,"title":"In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing , pages 2122–2132, Austin, Texas","work_id":"f5ab341f-5b15-47d7-8f8f-a43b384b5be8","ref_index":5,"cited_arxiv_id":"","is_internal_anchor":false}],"resolved_work":15,"snapshot_sha256":"d657602cd5a9cebddef5dd057608b12d3f1113aa668e147ceabed942b54f103a","internal_anchors":2},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"}