Multilingual AI red teaming

A named answer would be out of date within a quarter, and the framing hides the choice that matters: automated adversarial tooling and human red teaming find different failures, and neither substitutes for the other. Automated probing runs a known attack library at volume, repeats cheaply for regression, and is the right way to check that a fix stayed fixed. It is bounded by what is already in the library — which means it is weakest on the attacks nobody has written down yet, and weakest of all outside English, where public attack sets are thin to non-existent. Human red teaming is what produces novel attacks, culturally specific ones, and the borderline outputs where a judgement call is the whole finding. If you are choosing tooling, judge it on how much of its attack library exists in the languages you actually ship in, whether it lets you add your own probes, and how findings are categorised against your policy rather than a generic one. MoniSa supplies the human layer: native speakers writing and running attack prompts in the target language and rating what comes back.

AI red teaming is deliberately adversarial testing of an AI system: instead of checking that it works as intended, testers try to make it fail, and record what got through. For a language model that means attempting to elicit harmful, biased, false or policy-breaking output — through direct requests, indirect and layered instructions, role-play framings, prompt injection, and the ordinary manipulations a determined user reaches for. The output is a categorised set of findings tied to the policy each one breaches, which is what makes it useful for fixing guardrails rather than merely alarming. The term is borrowed from security, where a red team simulates an attacker, and the discipline now covers two fairly different jobs under one name: probing the infrastructure and software around a model, and probing the behaviour of the model itself.

No, and the distinction decides who you should be talking to. Penetration testing targets systems: infrastructure, APIs, access control, the software around the model, and it is done by security engineers. Red teaming a model targets behaviour: what the model can be persuaded to say, to whom, in what language, and how far a guardrail can be talked around. The two share a mindset and almost nothing else in method, staffing or evidence. MoniSa works on the behavioural side only. It does not perform penetration testing, infrastructure assessment or exploit development, and does not present itself as a security firm. What it supplies is the part of behavioural red teaming that is a language problem: native speakers who can construct a plausible attack in their own language and judge whether the response that came back is genuinely harmful in that culture.

Because most of what makes an attack work is language-specific, and most published safety testing is not. An attack translated out of English carries English assumptions about idiom, indirection, politeness and taboo, and drops the ones the target language actually has — code-switching between scripts, transliteration that slips past a filter, dialect-specific slurs, religious or regional sensitivities with no English equivalent, and phrasing that reads as harmless in one country and as incitement in another. Safety behaviour is uneven for a structural reason too: guardrails are usually trained on data that is overwhelmingly English, so a refusal that holds firmly in English can be weak or absent in a low-resource language answering the same request. Testing that language separately, with a native speaker writing the probes, is the only way to find out which.

The safety or content policy and its risk categories, with worked examples of what counts as a breach in each; the target languages and dialects; how testers will reach the model; whether an attack taxonomy is already in use or has to be built; the volume and the number of rounds; the format findings should come back in; the handling and retention rules for the material produced; and the date. Say early if the categories are not yet defined against examples — agreeing them is the first piece of work and is what separates findings a team can act on from a disagreement about severity. Rare pairs are confirmed against actual reviewer availability before a date is agreed.