训练通用红队模型，能应对未预设的攻击目标。
Training a General Purpose Automated Red Teaming Model
- 构建无需预设评估器的红队训练流水线
- 小模型微调后对内外域攻击效果显著提升
- 适合安全测试、漏洞挖掘等场景使用
自动化红队方法是识别大模型潜在漏洞的重要工具，可弥补静态基准覆盖不足的问题，并能针对特定模型发现其独特弱点。当前多数自动化红队方法聚焦于安全与内容审核场景，依赖内容安全模型作为评估器，优化目标为绕过这些模型，因而未在其他非典型对抗意图下进行测试。本文提出一种红队模型训练流水线，使其具备泛化能力，可应对任意对抗目标（包括未直接训练过的任务），且不依赖训练时存在的预设评估器。实验表明，使用该流程微调Qwen3-8B等小型模型，显著提升了其在域内和域外对抗目标下的攻击生成能力。
原文摘要 · Abstract (English)
Automated methods for red teaming LLMs are an important tool to identify LLM vulnerabilities that may not be covered in static benchmarks, allowing for more thorough probing. They can also adapt to each specific LLM to discover weaknesses unique to it. Most current automated red teaming methods are intended for tackling safety and content moderation. Thus, they make use of content safety models as evaluators and optimize for circumventing them, and as such, have not been tested with other adversarial intents not typically captured by these. We propose a pipeline for training a red teaming model that can generalize to arbitrary adversarial goals, including objectives it has not been directly trained on, and that does not depend on the existence of a pre-existing evaluator available at training time. We demonstrate that finetuning small models, such as Qwen3-8B, using this pipeline results in a substantial improvement in their ability to generate attacks for both in and out of domain adversarial goals.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。