Redefining AI Red Teaming in the Agentic Era: From Weeks to Hours

Paper: 2605.04019 Authors: Raja Sekhar Rao Dheekonda, Will Pearce, Nick Landers Categories: cs.AI, cs.CR

The Gap

AI red teaming exists but is stuck in manual mode. Current tools like TextAttack, Garak, and PyRIT force operators to hand-wire workflows: pick attacks from library A, transforms from library B, scorers from library C, then glue them together with custom code. When a workflow fails to expose vulnerabilities, you rebuild from scratch. The field has adversarial primitives but no automation layer to compose them intelligently. Operators spend 80% of time on plumbing, 20% on actual security probing.

Problem: Manual workflow assembly bottleneck
   |
   v
Assumption: Workflow construction can be delegated to an agent
   |
   v
Method: Agentic interface over unified attack/transform/scorer library
   |
   v
Evidence: Llama Scout red teamed in hours (85% ASR) with zero human code
   |
   v
Conclusion: Automation shifts operator focus from "how" to "what"

The Increment

One sentence: Before this paper, red teaming meant weeks of manual workflow coding; after, operators describe goals in natural language and an agent handles execution in hours.

Core Mechanism

The system has three layers. At the bottom sits the Dreadnode SDK: a unified library containing 45+ adversarial attacks (gradient-based perturbations, jailbreak prompts), 450+ transforms (character swaps, translation chains, encoding tricks), and 130+ scorers (toxicity detectors, refusal classifiers). Middle layer is the agent: it takes natural language goals, searches the SDK for relevant primitives, composes them into workflows, executes against targets, and reports results. Top layer is the TUI (Terminal User Interface) where operators specify what to probe without writing code.

Data flows like this: operator inputs “test Llama Scout for jailbreaks on harmful content” → agent parses intent → queries SDK for jailbreak attacks + toxicity scorers → generates workflow combining attacks with transforms → executes workflow against target → collects success rates and severity scores → presents report to operator. The agent handles all composition logic: which attacks pair with which transforms, how to chain operations, when to retry with different primitives.

Operator (TUI)
   |
   | "Test for jailbreaks"
   v
Agent (composition engine)
   |
   +---> Query SDK primitives
   |
   +---> Generate workflow
   |        (attack + transform + scorer)
   |
   +---> Execute against target
   |
   +---> Collect results
   v
Report (ASR, severity)

Think of it like ordering food delivery versus cooking from scratch. The old way: you’re in a grocery store (SDK library) picking ingredients (attacks), figuring out recipes (workflows), cooking (execution), and plating (reporting). The new way: you tell a chef (agent) what you want to eat (security goal), and they handle ingredient selection, cooking, and presentation. The grocery store still exists—same ingredients—but now there’s a chef who knows how to combine them. The operator’s job shifts from “how do I sauté this” to “I want something spicy with seafood.” The chef (agent) has seen enough recipes (workflow patterns) to improvise combinations, retry with different techniques when one fails, and deliver a finished dish (vulnerability report) without the operator touching a pan.

Key Concepts

• Attack Success Rate (ASR): The percentage of adversarial inputs that successfully bypass a model’s safety guardrails. If you send 100 jailbreak attempts and 85 produce harmful outputs, ASR is 85%. It’s a binary metric: did the attack work or not? High ASR means the model is vulnerable. In this paper, 85% ASR on Llama Scout means 85 out of 100 crafted inputs broke through defenses. ASR doesn’t measure how bad the output is, just whether defenses failed.

• Transforms: Operations that modify adversarial inputs to evade detection while preserving attack intent. Example: “How to make a bomb” → translate to French → back to English with typos → encode in base64. Each transform is a mutation step. The paper uses 450+ transforms because models detect simple attacks but miss transformed variants. Transforms are like disguises: the underlying attack (the person) stays the same, but the surface appearance (clothing, makeup) changes to slip past guards.

• Unified framework: A single codebase that handles both traditional adversarial examples (pixel perturbations on images) and generative AI attacks (jailbreak prompts on LLMs). Before this, you’d use one library for computer vision attacks, another for LLM red teaming. Unified means the same SDK, same agent, same workflow engine works across modalities. It’s like having one remote control for TV, stereo, and lights instead of three separate remotes.

Framework Shift

Before (mainstream approach):        After (this paper):

Operator                             Operator
   |                                    |
   | Manual coding                      | Natural language goal
   v                                    v
Library A (attacks)                  Agent
Library B (transforms)                  |
Library C (scorers)                     | Auto-compose
   |                                    v
   | Custom glue code                Unified SDK
   v                                 (attacks + transforms + scorers)
Workflow (weeks)                        |
   |                                    | Execute
   v                                    v
Results                              Results (hours)

From assembly line to factory automation, the core shift is delegating composition to an agent that knows the primitives.

Expert Assessment

Problem choice: Real gap. Red teaming is genuinely bottlenecked by manual workflow construction. The field has good primitives but poor tooling for composing them. This sits at the intersection of adversarial ML (mature) and agentic systems (emerging), which is a productive place to work. Not manufactured—practitioners will recognize this pain immediately.

Method maturity: More engineering than research insight. The agent is essentially a search-and-compose system over a large library. The novelty is integration, not algorithmic breakthrough. That said, integration is undervalued in ML research, and this solves a real problem. The unified framework is clever—collapsing separate libraries into one API is non-trivial design work. But there’s no deep theoretical contribution here.

Experimental integrity: The Llama Scout case study is compelling but narrow. 85% ASR is impressive, but we only see one target. No comparison to manual workflows (how long would a human take? what ASR would they achieve?). No ablation studies (which components matter most?). The “zero human-developed code” claim is marketing—someone wrote the SDK and agent. What they mean is “zero user code,” which is fair but overstated. Baselines are missing. I’d want to see: manual workflow time vs agent time, agent ASR vs human ASR, and performance across multiple targets.

Writing quality: The abstract oversells (“redefining AI red teaming” is grandiose for a workflow automation tool). The paper would benefit from honest limitations: when does the agent fail? what goals can’t be expressed in natural language? how does it handle novel attack types not in the SDK? Section 3 (method) is too high-level—more implementation details would help reproducibility. The case study (Section 4) is the strongest part but needs more targets and baselines.

Verdict: weak accept — Solves a real problem with solid engineering, but lacks experimental depth and oversells the contribution. Useful tool, incremental research.

Takeaways

Steal the architecture: separate primitives (attacks/transforms/scorers) from composition logic (agent). This pattern works beyond red teaming—any domain with reusable components and complex workflows benefits from an agentic composition layer. Example: data pipelines (primitives = transforms, agent = pipeline optimizer), testing (primitives = test cases, agent = test suite generator), or code refactoring (primitives = refactorings, agent = refactoring planner).

Steal the interface design: natural language goals + automated execution. Users specify intent, system handles implementation. This shifts cognitive load from “how” to “what,” which is valuable whenever experts spend more time on tooling than domain work.

Don’t steal the hype. “Redefining” and “agentic era” are overstatements. This is workflow automation with LLM-based composition. Call it what it is: a productivity tool that reduces manual work. The value is in time saved, not paradigm shift.