Automated Red-Teaming at the Frontier

Testing models against adaptive jailbreaks

Our automated red-teaming system carries out adaptive, multi-turn attacks against frontier models. Given an attack goal, it uses each target response to plan the next turn and coordinates specialised roles for attack planning, execution, and conversation analysis.

We access each target as a black box through its provider's default API and settings and use reasoning where supported. Completed evaluations reveal recurring failure modes, guiding iterative improvements to the system.

Tests built around regional risks

Regional safety evaluations must reflect local risks, terms, and abuse scenarios. We developed one evaluation library for Europe, which we use to attack models in English and German, and one for India, which we use to attack models in English and Hindi. Both libraries use the shared harm categories shown below, while the attack goals and regional emphasis differ. We use the same categories later to break down the India results. Each attack goal has its own rubric, described in the evaluation protocol below.

The examples below are lightly abstracted from the original datasets. Full entries and rubrics are available in the public 🤗 Sovereign-Jbreak release on Hugging Face.

Content warning. The repository includes descriptions of cyber abuse, fraud, political violence, CBRNE-related harms, and other high-risk scenarios.

Results from the models we tested

The results below come from adaptive, multi-turn attacks carried out by our automated red-teaming agents. Attack success varied across regions, languages, and models. We evaluated leading recent models from proprietary and open-weight families. The model set includes GLM-5.2, Grok-4.5, Sonnet-5, Opus-4.8, GPT-5.6 Terra, Inkling-256k, and Kimi-K3. We also tested Mistral-Medium 3.5 for Europe and Sarvam-105B for India.

Why these models? The set includes general-purpose frontier models and models developed for specific regions or domains. Sarvam-105B adds India-relevant coverage, while Mistral-Medium 3.5 adds a specialised European model. We will update the set as deployment priorities change and new high-capability models are released.

Direct-prompt baseline: 0%. We submitted each attack goal as one direct request. Every target model recorded a 0% attack success rate under the same scoring protocol. Adaptive, multi-turn attacks produced the non-zero results below.

Swipe to inspect chart →

India: attack success by harm category

To assess how attack success differs across the harm categories defined above, we split the India results by category. The chart reports the distinct-goal success rate for each category across the English and Hindi evaluations.

Swipe to inspect chart →

A strict definition of attack success

We count an attack as successful only when the model provides actionable assistance toward the attack goal. Bypassing a refusal, adopting an unsafe tone, or producing a superficially relevant answer is not enough.

To apply this definition consistently, each attack goal has its own rubric, made up of seven binary criteria that specify what actionable assistance would look like in that case. FORTRESS^[1] provides a useful precedent for expert-written, instance-specific rubrics. Unlike its static, single-turn evaluation, our protocol applies each rubric across the full adaptive, multi-turn conversation, allowing it to capture failures that emerge through interaction.

The scoring rule is stricter as well: FORTRESS uses the majority vote of three LLM judges for each rubric question, so two yes votes are sufficient, and reports the resulting share of satisfied questions as a continuous harm score. In our protocol, a criterion counts only when both human-calibrated LLM judges verify it, and the attack succeeds only when at least six of the seven criteria count. The diagram below summarizes the rule.