# Red Teaming Language Models with Language Models

**Authors:** Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, Geoffrey Irving  
**arXiv:** [2202.03286](https://arxiv.org/abs/2202.03286)  
**Date:** 2022-02-07  
**Summary page:** https://www.summarizepaper.com/en/paper/2202.03286v1/

## Key points

- Language Models (LMs) have the potential to harm users in unpredictable ways
- Previous approaches for testing LMs relied on expensive manual generation of test cases by human annotators, limiting diversity and number of test cases
- Authors propose a three-stage approach for finding failing test cases automatically:
- Use a "red" LM to generate test cases
- Utilize target LM to generate outputs for each test case
- Employ a red team classifier to identify harmful outputs from generated test cases
- Automated approach compared with prior work using human annotators or adversarial examples
- Method uncovers systematic harmful behaviors of LMs and is more controllable than previous methods
- Advantages of red teaming over blue teaming discussed (fixing failures preemptively)
- Red teams can operate before adversaries, improving LM behavior on failing test cases and making deployed LMs harder to exploit
- Automated red teaming with LMs offers a promising tool for identifying and addressing diverse harmful behaviors before impacting users

## Summary

This paper addresses the challenge of deploying Language Models (LMs) due to their potential to harm users in unpredictable ways. Previous approaches relied on human annotators to manually generate test cases, which is expensive and limits the diversity and number of test cases. In this work, the authors propose a three-stage approach for finding failing test cases automatically. Firstly, they use a "red" LM to generate test cases. Then, they utilize the target LM to generate outputs for each test case. Finally, they employ a red team classifier to identify harmful outputs from the generated test cases. The authors compare their automated approach with prior work that used human annotators or adversarial examples. They demonstrate that their method uncovers systematic ways in which LMs behave harmfully and is more controllable than previous methods. Additionally, they discuss the advantages of red teaming over blue teaming (fixing failures preemptively). Red teams can operate before adversaries and improve LM behavior on failing test cases, making deployed LMs harder to exploit. Overall, this paper highlights the effectiveness of using automated red teaming with LMs to identify and address diverse harmful behaviors before impacting users. The proposed approach offers a promising tool for improving LM behavior and ensuring user safety.