Automated Red Teaming
Constitutional AI: Harmlessness from AI Feedback — inherited
A related approach (Perez et al., 2022) of using language models themselves to generate red-team prompts, noted as a future direction that CAI's non-evasiveness should make easier to scale up.
Why pay people to hunt for a model's failure modes when another model could do the searching instead? This approach does exactly that, and it is mentioned here as a promising future direction rather than something Constitutional AI actually uses.
The technique itself is explained first, then why a non-evasive model has to exist before it can work well, before connecting back to the manual red teaming it would extend.
What it is
Automated red teaming replaces the human adversary in adversarial testing with a language model that itself searches for prompts that elicit harmful, offensive, or otherwise undesired behavior from a target model. The technique predates Constitutional AI: it was introduced by Perez et al. (2022), "Red Teaming Language Models with Language Models," which the paper cites directly rather than reimplementing. Constitutional AI mentions it only in passing, as a related future direction, not as something its own experiments run (constitutional-ai, §"A Harmless but Non-Evasive (Still Helpful) Assistant", p. 4).
Why non-evasiveness has to come first
The concept's place in this corpus is defined entirely by one dependency the paper flags explicitly. Red Teaming, as run here, means paid crowdworkers manually holding adversarial conversations to bait the assistant — a process with an inherent human-labor ceiling. Automating it removes that ceiling (Red Teaming — is the manual process that scales into → Automated Red Teaming), but only if the target model is not evasive: a model trained hard for harmlessness at the cost of becoming evasive would just teach an automated red-teamer to harvest canned refusals, which reveals nothing about remaining vulnerabilities. "This should make it easier to scale up automated red teaming...since training intensively for harmlessness would otherwise result in a model that simply refuses to be helpful" (constitutional-ai, §"A Harmless but Non-Evasive (Still Helpful) Assistant", p. 4). Constitutional AI's reduced evasiveness is framed as the enabling condition for scaling this technique, not an incidental benefit. As the named child of Red Teaming, automated red teaming's contribution to the parent is exactly this: inheriting red teaming's goal of surfacing harmful behavior while replacing its throughput bottleneck. Both concepts sit inside the Sourcing and classifying harmful prompts theme, and this substitution is one instance of the Replacing the human in the loop at exactly the point it was the bottleneck connective theme's recurring pattern: an AI process taking over at precisely the point human labor was scarce.