GPT-Red: Unlocking Self-Improvement for Robustness

AI systems commonly encounter third-party data through browsers, connected apps, local files, and other tools. These affordances are necessary for performing real-world tasks, but they also create more opportunities for malicious actors to influence model behavior. For example, a third party might embed a carefully crafted instruction⁠—designed to trick the model into uploading sensitive data to an external server—in an email, webpage, tool response, or code repository.

Human red-teaming is a critical part of our safety work, helping us uncover these vulnerabilities before deployment and put the right safeguards in place. But human red-teaming alone is difficult to scale. Designing and running these exercises is time-intensive, limiting how quickly we can identify new failure modes and incorporate them into stronger safeguards. Further, while these exercises produce valuable examples of successful attacks, they cannot generate the volume and diversity of adversarial data needed to improve model robustness through training.

Keeping pace with increasingly capable models requires red-teaming to scale as well. To this end, we have been training automated, internal-only red-teaming models that uncover vulnerabilities before deployment and generate attacks during model training to improve robustness. We believe automated red-teaming unlocks a crucial form of self-improvement for safety: using today’s models to directly help make future models safer.

GPT‑Red is the culmination of these efforts and our current best automated safety red-teaming model. Similar to how human red-teamers craft attacks, the model works toward a goal by sending a prompt, observing how GPT models respond to it, and iterating. We trained GPT‑Red at the compute scale of some of our largest post-training runs at OpenAI—an unprecedented amount of compute dedicated purely for improving safety.