AgenticRed: Optimizing Agentic Systems for Automated Red-teaming

TL;DR

AgenticRed is introduced, an automated pipeline that leverages LLMs'in-context learning to iteratively design and refine red-teaming systems without human intervention, and highlights automated system design as a powerful paradigm for AI safety evaluation that can keep pace with rapidly evolving models.

Abstract

While recent automated red-teaming methods show promise for systematically exposing model vulnerabilities, most existing approaches rely on human-specified workflows. This dependence on manually designed workflows suffers from human biases and makes exploring the broader design space expensive. We introduce AgenticRed, an automated pipeline that leverages LLMs' in-context learning to iteratively design and refine red-teaming systems without human intervention. Rather than optimizing attacker policies within predefined structures, AgenticRed treats red-teaming as a system design problem. Inspired by methods like Meta Agent Search, we develop a novel procedure for evolving agentic systems using evolutionary selection, and apply it to the problem of automatic red-teaming. Red-teaming systems designed by AgenticRed consistently outperform state-of-the-art approaches, achieving 96% attack success rate (ASR) on Llama-2-7B (36% improvement) and 98% on Llama-3-8B on HarmBench. Our approach exhibits strong transferability to proprietary models, achieving 100% ASR on GPT-3.5-Turbo and GPT-4o-mini, and 60% on Claude-Sonnet-3.5 (24% improvement). This work highlights automated system design as a powerful paradigm for AI safety evaluation that can keep pace with rapidly evolving models.

Figures (10)

• Figure 1: Caution: Content is synthetic, fictional, and non-actionable; examples are included solely to illustrate safety failure modes. Comparison of other red-teaming paradigms and AgenticRed. Prior methods typically rely on (1) predefined attack strategies, (2) reinforcement-learning–fine-tuned attacker models, or (3) fixed-structure agentic systems. In contrast, AgenticRed performs evolutionary search over agentic system workflows: candidate red-teaming systems are generated, evaluated against a target model, and retained the best candidate system each generation.
• Figure 2: Comparison of AgenticRed's evolutionary structure vs. Meta Agent Search. We apply AgenticRed to the red-teaming domain by ① creating an archive of domain-specific expert systems, ② imposing an evolutionary pressure mechanism by picking the fittest system in each generation, and ③ providing domain-specific guidance and helper functions to interact with the target model and the judge function.
• Figure 3: Performance increases with AgenticRed pipeline on open-weight models.
• Figure 4: Code snippets produced by AgenticRed. Left: Reward shaping. Center: Refusal suppression. Right: Crossover over elites.
• Figure 5: AgenticRed generalizes to alternative target LLM, attacker LLM, and meta agent LLM. (a) ASR of AgenticRed targeting Llama-2-7B over 10 generations, using Vicuna-13B-v1.5 as attacker model. (b) ASR of AgenticRed targeting Llama-3-8B over 10 generations. (c) ASR of AgenticRed targeting Llama-2-7B over 10 generations, using DeepSeek-R1 as the meta agent.