The BaseResearcharXiv
The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming
According to the abstract, Kang, Rawls, Kazemi Rad and colleagues separate criticism from attack proposal in automated red teaming. They report that the target agent's own criticism helps, while letting the target propose attacks works poorly because it refuses or underperforms on purpose.
Why it matters
The same thing, for different readers.
For researchers
Kang, Rawls, Kazemi Rad and colleagues report that a model aware of an adversarial goal can refuse or sandbag, which affects how automated red-team loops are built.
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- Four combinations of self or external criticism and self or external attack proposal in an automated red-teaming loop.
- What it found
- Self-criticism is more effective; removing reasoning lowers downstream attack success by 6%-17%; self-proposal is much less effective because of refusal and non-refusal sandbagging.
- What it does not show
- Abstract excerpt only; models and tasks not stated in it.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · Can AI systems act beyond what people intended or allowed?
- People
- Mintong Kang (Wrote it) · Stephen Rawls (Wrote it) · Melissa Kazemi Rad (Wrote it)
- What we read
- We have read only the description the publisher gives. No quotations until someone reads the source itself.
- Found by
- The Radar, run of October 27, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming”, October 26, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-26-self-improved-red-teaming-critic
Our notesLight lane: excerpt only.