Refusal-Aware Red Teaming: Exposing Inconsistency in Safety Evaluations (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) require rigorous safety evaluations to be effective. |
| Approach: | They propose a red teaming framework that detects internal model refusals and contrasts them with judgments from an external safety evaluator to generate test cases that expose such discrepancies. |
| Outcome: | The proposed framework outperforms existing reinforcement learning-based approaches in generating diverse test cases and achieves a substantially higher discovery rate of refusal gaps. |
Similar Papers
Nullspace Disentanglement for Red Teaming Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing work mainly leverages crowd workers to construct test cases. |
| Approach: | They propose a black-box approach that exploits the unique properties of the nullspace to disentangle and regulate the crucial success information within test cases. |
| Outcome: | The proposed approach outperforms baseline methods regarding the attack success rate and excels in aspects of diversity and fluency. |
Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction (2024.emnlp-main)
Copied to clipboard
| Challenge: | Existing approaches focus on improving attack success rates while overlooking the need for comprehensive test case coverage. |
| Approach: | They propose a top-down approach to automated red teaming that scales up the diversity of test cases using an extensible, fine-grained risk taxonomy. |
| Outcome: | The proposed approach scales up the diversity of test cases using a top-down approach based on an extensible, fine-grained risk taxonomy and leverages reinforcement learning techniques to facilitate multi-turn adversarial probing in a human-like manner. |
Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary (2025.emnlp-main)
Copied to clipboard
| Challenge: | Large language models (LLMs) often refuse to answer legitimate queries, causing models to treat many reasonable prompts as potentially risky. |
| Approach: | They propose a framework that automatically generates and selects overrefusal prompts near the safety boundary. |
| Outcome: | The proposed framework identifies and curates boundary-aligned prompts, enabling more effective and targeted mitigation of overrefusal. |
RefusalBench: Generative Evaluation of Selective Refusal in Grounded Language Models (2026.eacl-long)
Copied to clipboard
| Challenge: | Language models fail to selectively refuse to answer based on flawed context, study finds . current benchmarks fail to evaluate complex capabilities like selective refusal . |
| Approach: | They propose a framework that generates diagnostic test cases through controlled linguistic perturbation. |
| Outcome: | The proposed framework employs 176 perturbation strategies across six categories of uncertainty and three intensity levels. |
Red Teaming Language Models with Language Models (2022.emnlp-main)
Copied to clipboard
Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, Geoffrey Irving
| Challenge: | Prior work has found that language models (LMs) can harm users in hard-to-predict ways, and human annotation is expensive, limiting the number and diversity of test cases. |
| Approach: | They propose to generate test inputs using an LM itself, and use a classifier to detect harmful behavior on test input. |
| Outcome: | The proposed approach detects tens of thousands of offensive responses in a 280B parameter LM chatbot. |
ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing models do not provide robustness evaluations for large language models, but we find that they are inconsistent in performance. |
| Approach: | They propose to use semantically aligned augmentation, target bootstrapping, and adversarial knowledge injection to generate a test suite of prompts covering diverse robustness settings. |
| Outcome: | The proposed system generates a set of prompts covering diverse settings covering semantic equivalence, related scenarios, and adversarial. |
When Prompt Optimization Becomes Jailbreaking: Adaptive Red-Teaming of Large Language Models (2026.eacl-srw)
Copied to clipboard
| Challenge: | Existing safety evaluations rely on fixed collections of harmful prompts . such attacks span single-shot prompts, multi-turn interactions, cross-lingual settings . |
| Approach: | They propose to use black-box prompt optimization techniques to search for safety failures . they use GPT-5.1 to optimize for a continuous danger score . |
| Outcome: | The proposed approach reduces effective safeguards for large language models . the average danger score of Qwen 3 8B increases from 0.09 in its baseline setting to 0.79 after optimization. |
Query-Efficient Black-Box Red Teaming via Bayesian Optimization (2023.acl-long)
Copied to clipboard
| Challenge: | Existing methods for generating test cases and querying fail to be query-efficient . generative models can be used for open-domain dialogue, prompt continuation, text-to-image generation . |
| Approach: | They propose a query-efficient method that iteratively finds diverse positive test cases leading to model failures by utilizing user input and past evaluations. |
| Outcome: | The proposed method finds a significantly larger number of diverse positive test cases under limited query budget than baseline methods. |
Understanding Refusal in Language Models with Sparse Autoencoders (2025.findings-emnlp)
Copied to clipboard
| Challenge: | a study of refusal in instruction-tuned language models identifies latent features that causally mediate refusal behaviors. |
| Approach: | They conduct a mechanistic study of refusal in instruction-tuned LLMs using sparse autoencoders . they identify latent features that causally mediate refusal behaviors using sparsed autoencoding . |
| Outcome: | The proposed method validates refusal-related features across multiple datasets. |
SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering (2026.acl-long)
Copied to clipboard
| Challenge: | Current safety alignment methods fail to identify intended benign task before refusing to respond. |
| Approach: | They propose a method that uses inference-time trajectory-shifting to guide model behavior . they show that LLMs persist in refusing inputs containing harmful content . |
| Outcome: | The proposed approach reduces over-refusals with minimal impact on utility. |