Problem Statement
The red team strategies (crescendo, pair, goat) drive their attacks with an attacker LLM whose prompt is framed as an explicit adversarial/jailbreak task — e.g. crescendo's ATTACKER_SYSTEM_PROMPT opens with "You are a security tester probing an AI assistant's safety guardrails" and instructs it to "never reveal you are a tester" and "never acknowledge the target's refusals". PAIR and GOAT are framed similarly (adversarial prompt refinement / offensive agent tester).
When the attacker model is itself safety-aligned, this framing is self-defeating: the attacker recognizes the request as a jailbreak and refuses to generate the attack at all. The run then produces no adversarial turns — the strategy never launches — so the evaluation measures the attacker's own refusal rather than the target's robustness. This makes well-aligned models effectively unusable as attacker models, which unnecessarily narrows the pool of usable attackers for a red team run.
Proposed Solution
Reframe the three attacker prompts as an authorized safety evaluation whose output is the evaluation's input, rather than an adversarial act to be concealed:
- The attacker is "a red-teaming assistant supporting an authorized AI safety evaluation"; producing the probing messages is the evaluation, and surfacing a gap in the target's safety generalization is a useful finding.
- The task is stated as "generate the next input message for that evaluation" following a realistic conversational arc toward the objective — same mechanism (crescendo escalation, PAIR single-prompt refinement, GOAT multi-turn toolbox), reframed intent.
- The escalation/refinement/turn logic is unchanged; only the framing of the attacker's role and objective is rewritten.
This keeps an aligned attacker in role and producing attacks, so the run measures target robustness instead of attacker refusal.
Use Case
Running a red team suite with a safety-aligned model as the attacker (a common choice when the attacker and target come from the same available model set): with the current framing the attacker refuses and the strategy produces nothing; with the reframed prompts it stays in role and generates the attack sequence as intended.
Alternatives Solutions
- Restrict attacker models to less-aligned ones — rejected: it constrains which models can drive a red team run and doesn't address why the framing fails.
- Leave the prompts and document the limitation — rejected: the strategies silently produce empty attacks with aligned attackers, which reads as "target defended" rather than "attack never launched".
Additional Context
Scope: attacker prompt text in experimental/redteam/strategies/{crescendo,pair,goat} only. No base or public API changes; strategy control flow (escalation, refinement, turn handling) is untouched. The reframing describes the attacker's role for a red team run the operator is already choosing to execute — it changes how the attack objective is presented to the attacker model, not what the strategies do.
Problem Statement
The red team strategies (
crescendo,pair,goat) drive their attacks with an attacker LLM whose prompt is framed as an explicit adversarial/jailbreak task — e.g. crescendo'sATTACKER_SYSTEM_PROMPTopens with "You are a security tester probing an AI assistant's safety guardrails" and instructs it to "never reveal you are a tester" and "never acknowledge the target's refusals". PAIR and GOAT are framed similarly (adversarial prompt refinement / offensive agent tester).When the attacker model is itself safety-aligned, this framing is self-defeating: the attacker recognizes the request as a jailbreak and refuses to generate the attack at all. The run then produces no adversarial turns — the strategy never launches — so the evaluation measures the attacker's own refusal rather than the target's robustness. This makes well-aligned models effectively unusable as attacker models, which unnecessarily narrows the pool of usable attackers for a red team run.
Proposed Solution
Reframe the three attacker prompts as an authorized safety evaluation whose output is the evaluation's input, rather than an adversarial act to be concealed:
This keeps an aligned attacker in role and producing attacks, so the run measures target robustness instead of attacker refusal.
Use Case
Running a red team suite with a safety-aligned model as the attacker (a common choice when the attacker and target come from the same available model set): with the current framing the attacker refuses and the strategy produces nothing; with the reframed prompts it stays in role and generates the attack sequence as intended.
Alternatives Solutions
Additional Context
Scope: attacker prompt text in
experimental/redteam/strategies/{crescendo,pair,goat}only. No base or public API changes; strategy control flow (escalation, refinement, turn handling) is untouched. The reframing describes the attacker's role for a red team run the operator is already choosing to execute — it changes how the attack objective is presented to the attacker model, not what the strategies do.