What does multi-layer red teaming actually do that the other methods don't?
Multi-layer red teaming treats an AI agent as a stack of attack surfaces—infrastructure, protocols/tools, agent behavior, and the model itself—and probes each with tailored attacks. This is fundamentally different from retrieval, fine-tuning, or human review, which are defensive or evaluative but not adversarial. The key advantage is that it finds failures that only appear when the agent is acting in its full environment. A 2025 study compared red teaming a standalone model versus the same model inside an agentic loop and found 'agentic-only vulnerabilities'—attacks that worked only when the model was using tools, with tool-calling contexts showing 24% higher vulnerability than non-tool contexts [5]. That means if you only test the model in isolation, you miss a whole class of real-world failures.
The multi-layer approach also scales attack discovery. A 2025 framework called CoRT (Controllable Risk-concealed Red Teaming) used multi-turn conversations to hide risky intent and achieved a 95% average attack success rate across nine LLMs in finance [1]. Another agentic red-teaming framework, CoP (Composition of Principles), improved the best-known single-turn attack success rate by up to 19 times by orchestrating human-provided principles into novel jailbreak prompts [2]. These numbers show that red teaming isn't just about finding known issues—it's about discovering new attack vectors that other methods wouldn't anticipate.
How do retrieval, fine-tuning, and human review compare as alternatives?
Retrieval and fine-tuning are hardening techniques: they make the agent less likely to produce harmful outputs by giving it better context or adjusting its weights. They are useful for reducing known risks, but they don't tell you what the remaining risks are. For example, a 2026 catalogue of coordination patterns notes that retrieval-layer defense can be improved through a 'Basin Hardening Cycle'—a technique that iteratively strengthens the retrieval layer until a certain depth-ratio is reached [4]. That's a defensive loop, not a discovery mechanism. Fine-tuning, similarly, can embed safety rules, but red teaming is what reveals whether those rules hold under adversarial pressure.
Human review is the gold standard for judgment but doesn't scale. A 2026 paper on Human-on-the-Bridge (HOB) argues that human-in-the-loop review preserves expert judgment but 'does not scale easily' [3]. Instead, HOB encodes expert knowledge upfront—domain context, red-team traps, scoring guidelines—and then runs it repeatedly through an automated harness. In a study of 23,500 agent turns across finance, healthcare, and code generation, this approach surfaced failures that static benchmarks and single-evaluator scoring missed, such as phantom tool-call claims and policy drift [3]. So human review is best used to build reusable evaluation intelligence, not to manually inspect every interaction.
When should you use each method, and can they work together?
The evidence suggests these methods are complementary, not mutually exclusive. Multi-layer red teaming is the discovery engine—it finds new vulnerabilities. Retrieval and fine-tuning are the patch layers—they fix known issues. Human review is the quality gate—it ensures the fixes are correct and the evaluation is meaningful. A 2026 framework, AI-Infra-Guard, explicitly matches a detection paradigm to each layer: deterministic rule matching for infrastructure, LLM-driven auditing for MCP servers and agent skills, multi-turn black-box red teaming for agent behavior, and a jailbreak harness for the model [6]. This layered approach is the only one among the papers that spans all attack surfaces, including supply-chain auditing of agent skills.
The practical takeaway: if you're building or deploying an AI agent, start with multi-layer red teaming to map your attack surface, then use retrieval and fine-tuning to close the gaps it finds, and use human review to validate the fixes and to curate reusable test cases. The HOB study shows that smaller evaluator models can challenge frontier agents when expert judgment is encoded upfront [3], which means you don't need a huge human team to maintain quality—you need a smart red-teaming setup and a good curation process.
About These Sources
This answer is built on 6 studies (all preprints) — published from 2025 to 2026, 6 from 2024 or later — selected as the most relevant from 7 studies that passed quality screening, drawn from 72 papers retrieved from a database of over 500 million.
Sources used in this answer
Learning to Conceal Risk: Controllable Multi-turn Red Teaming for LLMs in the Financial Domain
CoRT, a controllable multi-turn red-teaming framework, achieved a 95% average attack success rate across nine LLMs in finance, using risk-concealed prompts that appear legitimate but induce regulatory violations.
CoP: Agentic Red-teaming for Large Language Models using Composition of Principles
CoP, an agentic red-teaming framework that composes human-provided principles, improved the best-known single-turn attack success rate by up to 19 times against leading LLMs.
Human-on-the-Bridge: Scalable Evaluation for AI Agents
Human-on-the-Bridge (HOB) encoded expert judgment upfront and reused it across 23,500 agent turns, surfacing failures missed by static benchmarks and single-evaluator scoring, including phantom tool-call claims and policy drift.
The Logotic Technique Catalogue: Recovering Cooperative and Defensive Coordination Patterns from Adversarial AI Agent Architecture
The Logotic Technique Catalogue reclassifies adversarial coordination patterns for defensive use, including a 'Basin Hardening Cycle' for retrieval-layer defense, showing that techniques are substrate-neutral and can serve multiple paradigms.
Mind the Gap: Comparing Model- vs Agentic-Level Red Teaming with Action-Graph Observability on GPT-OSS-20B
A comparative red-teaming analysis of GPT-OSS-20B found agentic-only vulnerabilities that emerge only in tool-using contexts, with tool-calling contexts showing 24% higher vulnerability than non-tool contexts.
Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
AI-Infra-Guard is an open-source framework that matches detection paradigms to four layers (infrastructure, protocol/tool, agent behavior, model), covering 75+ AI components and 1,400+ vulnerability rules, plus a jailbreak harness with 26+ attack operators.