NIST's Generative AI Profile (NIST AI 600-1) describes four kinds of AI red team: general public, expert, a combination of both, and human plus AI. The right choice depends on the use case, and domain expertise matters more than team size for specialised systems.
The four types
NIST describes AI red-teaming as an evolving practice, often run in a controlled environment with the developers, to identify adverse behaviour or outcomes of a system, how they could occur, and to stress test safeguards. It lists these approaches.
General public. Run by ordinary users, not necessarily AI or technical experts, who bring their own experience to the task. They may be given instructions to help them elicit harmful behaviour. NIST says this works better with large groups.
Expert. Run by specialists in the domain or context of use, for example medicine, biotech or cybersecurity.
Combination. Used when it is hard to recruit enough specialists. Experts and public participants work together, for example experts modifying or verifying prompts written by the public participants. NIST says this may also widen coverage of the attack surface.
Human and AI. Generative AI works with specialist or non-specialist human teams. NIST says AI-led red-teaming can be more cost effective than human red-teamers alone, and that human or AI-led approaches may suit eliciting different kinds of harms.
Match type to risk
- Consumer chatbot with broad topics: General public, plus experts on abuse
- Assistant over internal engineering docs: Expert, with security and platform engineers
- Medical or legal assistant: Expert in that domain, plus a security expert
- Coverage of many prompt variants: Human and AI
This table is a starting point from the NIST categories, not a NIST rule.
Quality depends on the team
NIST states that the quality of red-teaming output is related to the background and expertise of the team. It says teams with diverse demographics and disciplines can find flaws in the varied contexts where the system will be used, and that teams should show domain expertise and awareness of the deployment context.
For a RAG assistant, "domain expertise" has two parts: the subject matter the assistant answers about, and the security of retrieval systems. You often need both, from different people.
Treat results with care
NIST adds that red-teaming results should be analysed further before they feed into governance, policy updates and risk management. A list of clever prompts is not a risk assessment. Someone has to decide which findings matter, which are one-offs and which point to a design flaw.
Practical steps
- List the harms you care about: leaks, wrong answers, unsafe tool actions, offensive output.
- Pick a team type for each harm. They need not be the same.
- Brief testers on scope and the rules, using the three phase scoping guide.
- Collect findings in one format with steps to reproduce.
- Review them with engineering before anyone writes a summary.
- Convert fixed findings into regression tests.
Quick check
Does NIST say every system needs all four types?
No. It describes the types and says the right one depends on the use case.
Can AI replace human red teamers?
NIST says AI-led work can be more cost effective and may suit different harms. It describes pairing AI with human teams rather than replacing them.
Sources
Last reviewed: 19 October 2026.
