What is AI red teaming?

History of red teaming

The term red teaming dates back to the U.S. Cold War era, when it was first used to describe strategic military exercises between a simulated adversary (the red team) and a defense team (the blue team). The red team would attempt infiltration techniques, or attacks, against the blue team to assist military intelligence in evaluating strategies and identifying possible weaknesses.

In the decades following, the term red teaming has become mainstream in many industries in reference to the process of identifying intelligence gaps and weaknesses. Cybersecurity communities adopted the term to describe the strategic practice of having hackers simulate attacks on technology systems to find security vulnerabilities. The results of a simulated infiltration are then used to devise preventative measures that can reduce a system's susceptibility to attack.

Traditional red teaming attacks are typically one-time simulations conducted without the security team's knowledge, focusing on a single goal. The red team attacks the system at a specific infiltration point, usually with a clear objective in mind and an understanding of the specific security concern they hope to evaluate.

How does AI red teaming differ from traditional red teaming?

Similar to traditional red teaming, AI red teaming involves infiltrating AI applications to identify their vulnerabilities and areas for security improvement. However, AI red teaming differs from traditional red teaming due to the complexity of AI applications, which require a unique set of practices and considerations.

AI technologies are constantly evolving, and with new iterations of applications come new risks for organizations to discover. The dynamic nature of AI technology necessitates a creative approach from AI red teams. Many AI systems -- generative AI tools like large language models (LLMs), for instance -- learn and adapt over time and often operate as "black boxes." This means that an AI system's response to similar red teaming attempts might change over time, and troubleshooting can be challenging when the model's training data is hidden from red teamers.

AI red teaming is often more comprehensive than traditional red teaming, involving diverse attack types across a wide range of infiltration points. AI red teaming can target AI at the foundational level -- for instance, an LLM like Generative Pre-Trained Transformer 4, commonly known as GPT-4 -- up to the system or application level. Unlike traditional red teaming, which focuses primarily on intentional, malicious attacks, AI red teaming also addresses random or incidental vulnerabilities, such as an LLM giving incorrect and harmful information due to hallucination.

Types of AI red teaming

AI red teaming involves a wide range of adversarial attack methods to discover weaknesses in AI systems. AI red teaming strategies include but are not limited to these common attack types:

• Backdoor attacks. During model training, malicious actors can insert a hidden backdoor into an AI model as an avenue for later infiltration. AI red teams can simulate backdoor attacks that are triggered by specific input prompts, instructions or demonstrations. When the AI model is triggered by a specific instruction or command, it could act in an unexpected and possibly detrimental way.
• Data poisoning. Data poisoning attacks occur when threat actors compromise data integrity by inserting incorrect or malicious data that they can later exploit. When AI red teams engage in data poisoning simulations, they can pinpoint a model's susceptibility to such exploitation and improve a model's ability to function even with incomplete or confusing training data.
• Prompt injection attacks. One of the most common attack types, prompt injection, involves prompting a generative AI model -- most commonly LLMs -- in a way that bypasses its safety guardrails. A successful prompt injection attack manipulates an LLM into outputting harmful, dangerous and malicious content, directly contravening its intended programming.
• Training data extraction. The training data used to train AI models often includes confidential information, making training data extraction a popular attack type. In this type of attack simulation, AI red teams prompt an AI system to reveal sensitive information from its training data. To do so, they employ prompting techniques such as repetition, templates and conditional prompts to trick the model into revealing sensitive information.

AI red teaming best practices

With the evolving nature of AI systems and the security and functional weaknesses they present, developing an AI red teaming strategy is crucial to properly execute attack simulations.

• Evaluate a hierarchy of risk. Identify and understand the harms that AI red teaming should target. Focus areas might include biased and unethical output; system misuse by malicious actors; data privacy; and infiltration and exfiltration, among others. After identifying relevant safety and security risks, prioritize them by constructing a hierarchy of least to most important risks.
• Configure a comprehensive team. To develop and define an AI red team, first decide whether the team should be internal or external. Whether the team is outsourced or compiled in house, it should consist of cybersecurity and AI professionals with a diverse skill set. Roles could include AI specialists, security pros, adversarial AI/ML experts and ethical hackers.
• Red team the full stack. Don't only red team AI models. It's also essential to test AI applications' underlying data infrastructure, any interconnected tools and applications, and all other system elements accessible to the AI model. This approach ensures that no unsecured access points are overlooked.
• Use red teaming in tandem with other security measures. AI red teaming doesn't cover all the testing and security measures necessary to reduce risk. Maintain strict access controls, ensuring that AI models operate with the least possible privilege. Sanitize databases that AI applications use, and employ other testing and security measures to round out the overall AI cybersecurity protocol.
• Document red teaming practices. Documentation is crucial for AI red teaming. Given the wide scope and complex nature of AI applications, it's essential to keep clear records of red teams' previous actions, future plans and decision-making rationales to streamline attack simulations.
• Continuously monitor and adjust security strategies. Understand that it is impossible to predict every possible risk and attack vector; AI models are too vast, complex and constantly evolving. The best AI red teaming strategies involve continuous monitoring and improvement, with the knowledge that red teaming alone cannot completely eliminate AI risk.