Large Empirical Case Study: Go-Explore adapted for AI Red Team Testing

Production LLM agents with tool-using capabilities require security testing despite their safety training. We adapt Go-Explore to evaluate GPT-4o-mini across 28 experimental runs spanning six research questions. We find that random-seed variance dominates algorithmic parameters, yielding an 8x spread in outcomes; single-seed comparisons are unreliable, while multi-seed averaging materially reduces variance in our setup. Reward shaping consistently harms performance, causing exploration collapse in 94% of runs or producing 18 false positives with zero verified attacks. In our environment, simple state signatures outperform complex ones. For comprehensive security testing, ensembles provide attack-type diversity, whereas single agents optimize coverage within a given attack type. Overall, these results suggest that seed variance and targeted domain knowledge can outweigh algorithmic sophistication when testing safety-trained models.

Key Contributions

• Adaptation of the Go-Explore RL exploration algorithm for automated LLM agent red-team security testing across 28 experimental runs and 6 research questions
• Empirical finding that random seed variance (8x outcome spread) dominates all algorithmic parameters, making single-seed comparisons unreliable; multi-seed averaging (~3–4 seeds) materially reduces variance
• Demonstration that reward shaping consistently harms performance (94% exploration collapse or 18 false positives with zero verified attacks), and that ensembles provide attack-type diversity while single agents optimize within-type coverage

🛡️ Threat Analysis

Details

Similar Papers