Training a General Purpose Automated Red Teaming Model
For LLM safety researchers, this provides a more general and adaptable automated red teaming method that does not require task-specific evaluators.
The paper proposes a pipeline for training a red teaming model that generalizes to arbitrary adversarial goals, including unseen objectives, without relying on a pre-existing evaluator. Finetuning Qwen3-8B with this pipeline substantially improves attack generation for both in- and out-of-domain goals.
Automated methods for red teaming LLMs are an important tool to identify LLM vulnerabilities that may not be covered in static benchmarks, allowing for more thorough probing. They can also adapt to each specific LLM to discover weaknesses unique to it. Most current automated red teaming methods are intended for tackling safety and content moderation. Thus, they make use of content safety models as evaluators and optimize for circumventing them, and as such, have not been tested with other adversarial intents not typically captured by these. We propose a pipeline for training a red teaming model that can generalize to arbitrary adversarial goals, including objectives it has not been directly trained on, and that does not depend on the existence of a pre-existing evaluator available at training time. We demonstrate that finetuning small models, such as Qwen3-8B, using this pipeline results in a substantial improvement in their ability to generate attacks for both in and out of domain adversarial goals.