OpenShift AI turns enterprise policy into an automated red-team pipeline

Red Hat has detailed an automated red-teaming pipeline in OpenShift AI that converts an organization’s policy document into adversarial model tests, escalates those tests through increasingly costly attack methods, and reports which prompts defeated the target model’s controls.

The feature is a technology preview in OpenShift AI 3.4 and is expected to become generally available in 3.5, according to Red Hat. It gives platform and security teams a repeatable alternative to relying only on generic safety benchmarks or manually assembled jailbreak prompts.

Policy becomes the test specification

The pipeline starts with risk categories describing content the model should not produce. Teams can use a baseline taxonomy—covering areas such as fraud, malware, violence and misinformation—or add categories specific to their business. Red Hat’s example for financial services includes executive-compensation disclosure, debt-repayment negotiation and investment advice.

A challenger model then generates prompts across variations such as demographic, region, writing style and trust signal. That design matters because the policy document becomes the evaluation boundary: teams are testing the model against their own prohibited behavior rather than assuming a public benchmark captures it.

Cheap attacks run before expensive ones

The generated prompts move through a custom Garak harness. It first sends each prompt unchanged, then tries system-prompt overrides and text manipulation, translation attacks, and finally Tree of Attacks with Pruning. Only prompts the model refused advance to the next stage.

That funnel is the operational idea worth carrying forward. Straightforward failures are found with inexpensive probes, while adaptive challenger-model work is reserved for harder cases. A separate judge model classifies target responses as complied, rejected, alternative or other. The main metric is attack success rate: a prompt is unsafe if any strategy produces a compliant response.

Red Hat’s published Qwen3 example reached a 100% attack success rate despite refusing every baseline prompt; more than half were defeated by a simple system-prompt override. The result is an illustration, not a general benchmark, but it shows why baseline refusal behavior is not enough evidence for production readiness.

What teams need to run it

The documented cluster path uses EvalHub, a target-model endpoint, OpenShift AI pipelines, S3-compatible artifact storage and MLflow. An additional unconstrained model endpoint is optional for advanced attacks. Red Hat also documents a path that does not use AI pipelines.

For platform teams, the immediate work is to define risk categories before choosing mitigations, provision separate model roles for challenge and judgment, and decide where evaluation evidence will live. The pipeline identifies weaknesses; it does not itself make the model safe. Red Hat says a follow-up will cover mitigation with NVIDIA NeMo Guardrails.