Red-Teaming as a Civic Exercise
Abstract
Red-teaming is usually done by trained internal teams. We tested a different model: red-teaming rounds open to the public, treated as a civic exercise. Across two rounds with 400 participants, non-expert contributors found a distinct class of failures — context- and values-based ones — that internal teams systematically missed. We argue that adversarial testing of widely deployed AI should be less like a secret audit and more like a public review.
An AI assistant used by millions of people is tested by a few dozen specialists. That ratio should make us uncomfortable. The people who know how an assistant fails in real life are the people who live with it — and the conventional model of red-teaming gives them no way in.
We ran a different kind of red-teaming. Not a stunt, not a bug bounty for cash — a structured, public exercise in finding what a model gets wrong, run with the community that uses Ichnus. This paper reports what happened and what it taught us about who should audit AI.
Approach
Over two rounds, we opened a red-teaming window on a pre-release version of Mantus to anyone who had an Ichnus account. Participants were given a short briefing: what the model was, what we were worried about, and how to report a finding. Reports were triaged by the evaluations team like internal bug reports, and participants who found valid issues were named (with consent) in the published summary.
Round one drew 240 participants over two weeks; round two drew 160. We compared the failure taxonomy from each public round against the taxonomy from two internal rounds of the same size run by our own teams.
Results
Public participants found different things. Non-expert contributors disproportionately reported failures we classified as contextual — errors that depended on who the user was, their circumstances, or the stakes of the situation. These included confidently-wrong answers in niche domains, tone failures in sensitive conversations, and cases where the model’s helpfulness crossed into overreach. Internal teams, by contrast, were stronger on adversarial and jailbreak-style testing.
A third of the public-reported issues were new to us — absent from the internal taxonomies entirely. The two rounds also surfaced a process finding: participants valued the exercise itself, and several requested follow-ups to see what had been fixed.
Discussion
Diversity of perspective is not a nice-to-have in testing; it is coverage. If internal teams systematically miss context-dependent failures, then no amount of internal effort fixes the gap — the missing data is external by nature.
We are not proposing that public red-teaming replace internal testing. It is slower, noisier, and must be carefully scoped. But we are proposing it become a regular, expected part of the release cycle for widely deployed systems: a civic exercise, run often, published honestly. The people affected by an AI system should have a standing role in its inspection.
References
- Adeyemi, G., & Herrera, T. (2026). Red-teaming windows: a procedural proposal. Curos Internal Report 2026-03.
- Banerjee, S., et al. (2024). Participant diversity in red-team composition. FAccT 2024.
- Garrido, M., et al. (2025). Bug bounties for behavior: incentives in AI testing. ICLR 2025 Workshop on Evaluation.
- Jain, P., et al. (2023). Scalable and decentralized red-teaming. NeurIPS 2023.
- Okonjo, E., & Hart, L. (2025). The civic audit of public infrastructure. Journal of Public Technology, 8(2), 12–28.
- Wu, X., et al. (2024). Non-expert red teaming in the wild. arXiv preprint arXiv:2410.02137.