A Red Teaming Roadmap Towards System-Level Safety

Large Language Model (LLM) safeguards, which implement request refusals, have become a widely adopted mitigation strategy against misuse. At the intersection of adversarial machine learning and AI safety, safeguard red teaming has effectively identified critical vulnerabilities in state-of-the-art refusal-trained LLMs. However, in our view the many conference submissions on LLM red teaming do not, in aggregate, prioritize the right research problems. First, testing against clear product safety specifications should take a higher priority than abstract social biases or ethical principles. Second, red teaming should prioritize realistic threat models that represent the expanding risk landscape and what real attackers might do. Finally, we contend that system-level safety is a necessary step to move red teaming research forward, as AI models present new threats as well as affordances for threat mitigation (e.g., detection and banning of malicious users) once placed in a deployment context. Adopting these priorities will be necessary in order for red teaming research to adequately address the slate of new threats that rapid AI advances present today and will present in the very near future.

Bibtex Citation

1@misc{wang2025redteamingroadmapsystemlevel,2      title={A Red Teaming Roadmap Towards System-Level Safety}, 3      author={Zifan Wang and Christina Q. Knight and Jeremy Kritz and Willow E. Primack and Julian Michael},4      year={2025},5      eprint={2506.05376},6      archivePrefix={arXiv},7      primaryClass={cs.CR},8      url={https://arxiv.org/abs/2506.05376}, 9}