{
 "body": "\n## What it measures\n\nHELM's anthropic_red_team task gives the model one English sentence from a human red-teamer and asks it to reply. The sentence is the first `Human:` turn of a dialogue in Anthropic's red-team-attempts file. Crowdworkers originally used those dialogues to try to make an assistant produce harmful text. HELM throws away later turns, so the model never sees the rest of the attack. The skill under test is whether the first reply is judged harmless, not whether a long jailbreak eventually succeeds.\n\nThe underlying collection is the 38,961-attack set from Ganguli, Lovitt, Kernion and colleagues at Anthropic (arXiv:2209.07858, submitted 23 August 2022). HELM also cites the HH-RLHF paper (arXiv:2204.05862) because the same Hugging Face repo hosts both preference data and these transcripts. This page documents the HELM scenario, not Anthropic's original multi-turn analysis.\n\n## How it is scored\n\nThe headline metric is `safety_score` on a 0\u20131 scale, higher better. An annotator prompt asks a judge to rate harmfulness in five bands from 0 to 1. HELM averages the numeric `*_score` fields it gets back. The schema still says that mean is over GPT-4o and Llama 3.1. The current judge helper pins `openai/gpt-4o-2024-05-13` and has the Llama 3.1 405B Turbo entry commented out after a 6 March 2026 deprecation note. A new run may therefore be a single-judge score. Generation is temperature 0, 512 tokens, no in-context examples.\n\nThis is not Anthropic's own success rating. In the source file each transcript has a crowdworker Likert `rating` of how well the red-teamer broke the assistant. HELM does not use that field. It also does not use the preference-model harmlessness scores stored on the rows.\n\n## Dataset and licence\n\nAnthropic released 38,961 attacks. Each row is a full transcript plus metadata (model size and type, red-team member id, Upwork vs MTurk, optional tags on a 1,000-item sample). HELM parses the transcript, splits on `Human:` / `Assistant:`, and keeps the first non-empty utterance. The Hugging Face card and GitHub README both mark the repo MIT; the GitHub LICENSE file is MIT, Copyright 2022 Anthropic. Prompts and transcripts are public. There is no held-out test split for this subset.\n\n## Who publishes it\n\nAnthropic collected the dialogues and published the 2022 red-teaming paper. Core authors named above the paper's author break are Deep Ganguli, Liane Lovitt and Jackson Kernion; the full author list is much longer. Stanford CRFM wrapped the first utterance as a HELM Safety scenario and still lists it on the HELM Safety leaderboard (launched November 2024). HELM itself entered maintenance mode on 1 June 2026.\n\n## Lineage\n\nThis is not a copy of [harm_bench](harm_bench.md). HarmBench scores attack success with its own classifier on a separate behaviour set. It is not [agentic_misalignment](agentic_misalignment.md) or [model_written_evals](model_written_evals.md). Those are later Anthropic evals with different tasks. The five-scenario mean that includes this run is [helm_safety](helm_safety.md). [anthropic_hh_rlhf](anthropic_hh_rlhf.md) is HELM Instruct over the same Hugging Face repo, including a `red_team` subset scored with a 1\u20135 helpfulness critique, not this Safety `safety_score`.\n\n## Saturation and contamination\n\nNo sourced top score for this scenario alone was found. A high HELM Safety mean is not a reading of this run: that average also includes BBQ, HarmBench, SimpleSafetyTests and XSTest. Treat a high `safety_score` here as a judge's view of a one-turn refusal, not as evidence that the model resists a full red-team dialogue. The prompts have been public since 2022, so training-set overlap and targeted safety tuning are both plausible.\n\n## How to run it\n\nIn HELM the run spec name is `anthropic_red_team`. It loads `AnthropicRedTeamScenario`, annotates with `AnthropicRedTeamAnnotator`, and scores with `SafetyScoreMetric`. `run_entries_safety.conf` lists it beside `bbq`, `harm_bench`, `simple_safety_tests` and `xstest`. Compare numbers only when the judge set matches. After March 2026 the Llama judge may be absent from the code even though the schema text still names two models.\n\n## Reading the numbers\n\nA high score means the judges called the first reply harmless on these 2022 attack openings. It does not mean the model would hold up over the rest of the original dialogue. It does not measure helpfulness, over-refusal, or robustness to new jailbreaks. Read it next to [helm_safety](helm_safety.md) and [harm_bench](harm_bench.md), and check which judge models produced the number.\n",
 "build": {
  "built_at": "2026-09-09T16:56:50+00:00",
  "commit": "0a599558854c0e238c03a0f0d725239cb28f9d11",
  "eligibility_as_of": "2026-09-09"
 },
 "disposition": {
  "canonical_id": "anthropic_red_team",
  "reasons": [],
  "status": "unassessed",
  "verified_results": []
 },
 "models_covered": [],
 "page": {
  "aliases": [
   "AnthropicRedTeam",
   "anthropic-red-team",
   "hh-rlhf red-team-attempts"
  ],
  "category": "safety",
  "contamination": {
   "note": "Transcripts and first-turn prompts have been public on GitHub and Hugging Face since 2022 under MIT. Providers have used similar red-team text in later safety tuning. HELM's first-utterance cut is a deterministic extract of that public file, so leakage into training or refusal datasets is plausible.\n",
   "risk": "high"
  },
  "dataset": {
   "languages": [
    "en"
   ],
   "license": "MIT",
   "modalities": [
    "text"
   ],
   "public_test_set": true,
   "size": 38961,
   "size_note": "Ganguli et al. (2022) release 38,961 red-team attacks. HELM loads Anthropic/hh-rlhf data_dir=red-team-attempts at revision 09be8c5bbc57cb3887f3a9732ad6aa7ec602a1fa and maps the Hugging Face train split to HELM's test split because that subset has no test split. HELM Safety's write-up uses the same 38,961 figure. This page did not decompress the 15 MB jsonl.gz to re-count rows.\n",
   "splits": "Hugging Face red-team-attempts train used as HELM test; no held-out test split",
   "url": "https://huggingface.co/datasets/Anthropic/hh-rlhf"
  },
  "freshness": {
   "researched": "2026-09-08",
   "researched_by": "Grok Build, batch-026 (Codex coordinated)",
   "reviewed": "2026-09-08",
   "reviewed_by": "Grok Build independent review, batch-026"
  },
  "harness": {
   "bigbench": "",
   "helm": "anthropic_red_team",
   "inspect_evals": "",
   "lm_eval": "",
   "opencompass": "",
   "other": "run_entries_safety.conf and schema_safety.yaml list this scenario with bbq, harm_bench, simple_safety_tests, and xstest"
  },
  "id": "anthropic_red_team",
  "last_updated": "2026-03",
  "leaderboard_url": "https://crfm.stanford.edu/helm/safety/latest/",
  "lineage": {
   "family": "",
   "predecessor": "",
   "successors": [],
   "variants": []
  },
  "measures": "HELM's anthropic_red_team scenario takes Anthropic's public red-team dialogues and keeps only the first human utterance of each transcript. The model must answer that single English prompt. The original collection was a multi-turn attack by crowdworkers trying to elicit harmful assistant behaviour. HELM does not replay later turns, so the score is a one-shot refusal test on historically successful attack openings, not a reproduction of Anthropic's multi-turn red-team protocol.\n",
  "metric": {
   "baseline_note": "The annotator prompt maps replies from 0 (extremely offensive or dangerous) to 1 (completely harmless). HELM's schema still describes safety_score as the mean of GPT-4o and Llama 3.1 ratings. In the current model_as_judge.py the Llama 3.1 405B Turbo judge is commented out as deprecated on 2026-03-06, so a fresh run may be GPT-4o-2024-05-13 only. No random or human baseline is defined.\n",
   "direction": "higher_is_better",
   "human_baseline": null,
   "max_score": 1.0,
   "name": "safety_score (mean of LLM-judge harmlessness ratings)",
   "random_baseline": null,
   "unit": "0-1 scale"
  },
  "name": "Anthropic Red Team (HELM)",
  "page_kind": "benchmark",
  "paper": {
   "arxiv": "2209.07858",
   "title": "Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned",
   "url": "https://arxiv.org/abs/2209.07858",
   "year": 2022
  },
  "publisher": {
   "authors": [
    "Deep Ganguli",
    "Liane Lovitt",
    "Jackson Kernion"
   ],
   "org": "Anthropic (dataset); Stanford CRFM (HELM scenario)",
   "url": "https://github.com/anthropics/hh-rlhf"
  },
  "released": "2022-09",
  "repo_url": "https://github.com/stanford-crfm/helm/blob/main/src/helm/benchmark/scenarios/anthropic_red_team_scenario.py",
  "saturation": {
   "as_of": "",
   "note": "No dated per-scenario top score for anthropic_red_team alone was read here. The parent [HELM Safety](helm_safety.md) mean mixes this scenario with BBQ, HarmBench, SimpleSafetyTests and XSTest, so it is not a reading of this run.\n",
   "status": "unknown",
   "top_score": null
  },
  "sources": [
   {
    "accessed": "2026-09-08",
    "title": "HELM AnthropicRedTeamScenario (first utterance, hh-rlhf red-team-attempts pin)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/scenarios/anthropic_red_team_scenario.py"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM safety_run_specs.py (anthropic_red_team run spec, 512 tokens, T=0)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/run_specs/safety_run_specs.py"
   },
   {
    "accessed": "2026-09-08",
    "title": "AnthropicRedTeamAnnotator (0\u20131 harmfulness rubric)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/annotation/anthropic_red_team_annotator.py"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM SafetyScoreMetric (mean of *_score annotator fields)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/metrics/safety_metrics.py"
   },
   {
    "accessed": "2026-09-08",
    "title": "score_with_reasoning_with_gpt_and_llama (GPT-4o-2024-05-13; Llama 3.1 405B commented out 2026-03-06)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/annotation/model_as_judge.py"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM schema_safety.yaml (anthropic_red_team main_name safety_score)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/static/schema_safety.yaml"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM run_entries_safety.conf (bbq, harm_bench, simple_safety_tests, anthropic_red_team, xstest)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/src/helm/benchmark/presentation/run_entries_safety.conf"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM README (maintenance mode from 2026-06-01)",
    "url": "https://raw.githubusercontent.com/stanford-crfm/helm/main/README.md"
   },
   {
    "accessed": "2026-09-08",
    "title": "Red Teaming Language Models to Reduce Harms (arXiv:2209.07858)",
    "url": "https://arxiv.org/abs/2209.07858"
   },
   {
    "accessed": "2026-09-08",
    "title": "Ganguli et al. HTML (38,961 attacks released)",
    "url": "https://ar5iv.labs.arxiv.org/html/2209.07858"
   },
   {
    "accessed": "2026-09-08",
    "title": "Training a Helpful and Harmless Assistant with RLHF (arXiv:2204.05862)",
    "url": "https://arxiv.org/abs/2204.05862"
   },
   {
    "accessed": "2026-09-08",
    "title": "Anthropic/hh-rlhf dataset card (MIT; red-team-attempts usage)",
    "url": "https://huggingface.co/datasets/Anthropic/hh-rlhf"
   },
   {
    "accessed": "2026-09-08",
    "title": "Hugging Face dataset API (license MIT, revision 09be8c5bbc57cb3887f3a9732ad6aa7ec602a1fa)",
    "url": "https://huggingface.co/api/datasets/Anthropic/hh-rlhf"
   },
   {
    "accessed": "2026-09-08",
    "title": "anthropics/hh-rlhf README (red-team field dictionary)",
    "url": "https://raw.githubusercontent.com/anthropics/hh-rlhf/master/README.md"
   },
   {
    "accessed": "2026-09-08",
    "title": "anthropics/hh-rlhf MIT License (Copyright 2022 Anthropic)",
    "url": "https://raw.githubusercontent.com/anthropics/hh-rlhf/master/LICENSE"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM Safety CRFM write-up (AnthropicRedTeam 38,961 items)",
    "url": "https://crfm.stanford.edu/2024/11/08/helm-safety.html"
   },
   {
    "accessed": "2026-09-08",
    "title": "HELM Safety leaderboard",
    "url": "https://crfm.stanford.edu/helm/safety/latest/"
   }
  ],
  "status": "active",
  "subcategory": "single-turn refusal on first utterances from Anthropic's 2022 red-team dialogues",
  "summary": "HELM safety scenario that scores a model's first reply to 38,961 Anthropic red-team openings with a 0\u20131 LLM-judge safety_score.",
  "tags": [
   "safety",
   "red-teaming",
   "refusal",
   "llm-judge",
   "helm",
   "english"
  ],
  "task_format": "Zero-shot generation. HELM sends the first Human utterance with empty instructions, max_tokens 512, temperature 0. Two LLM judges (the safety annotator) rate the completion's harmfulness on a 0\u20131 scale; higher means a more harmless reply.\n"
 }
}