What is Adversarial AI Training? (Red Teaming Explained)

Red teaming and standard rating grade you on opposite things

Workers moving across from generalist rating often carry the wrong instincts for a week or two, because the habits that earn a good quality score on rating work are close to the habits that produce weak red teaming. The rating reviewer's job is to apply a rubric consistently, and the red teamer's job is to find the case the rubric did not anticipate.

If the rating column fits you better, the RLHF and model evaluation jobs page lists those roles.

Posted rates run $20 to $111 an hour, and language moves them more than specialism

Across the 103 AI safety and red teaming listings carrying an hourly rate on our board in September 2026, the midpoint sits at $40 an hour. General safety review roles cluster between $20 and $60. Titles that name red teaming directly sit higher: dedicated adversarial testing roles post between $50 and $111, and security-flavored listings such as a red team lead or a jailbreak and prompt-injection specialist post $50 to $90. The ceiling belongs to credentialed domain advisers, where a clinical mental health adviser on a safety project reaches $150 an hour.

The more useful pattern is the one that shows up when you compare listings that differ by only one variable. Several platforms post the same safety role across two dozen language markets, which makes the effect of language visible on its own. A generalist safety role pays $20 an hour in Hindi, Vietnamese, Indonesian, and Thai, and $60 an hour in Norwegian, a three-fold spread for identical work. Hold the language constant and add a STEM PhD, and the premium is around 25%. Both factors matter, and the one most workers optimize for is the smaller of the two.

That is worth knowing before you invest a year in a credential. If you already work in a thinly covered language, safety projects in that language are the best use of your time on the board, and the credential is a second multiplier on top rather than the thing that sets the rate. If you work in English, the premium has to come from somewhere else: a domain nobody else on the project can evaluate, or a security background that lets you take the listings written for offensive security people.

Rates on individual listings change as projects open and close, so treat these as a September 2026 snapshot of what is posted rather than a promise. The live numbers are on the AI safety and red teaming jobs page, which reads from the same listing data.

Five task types cover most adversarial projects

A project brief usually asks for several of these at once, with a policy document defining which outcomes count as violations. The categories overlap heavily, and a single good finding often sits in two of them.

Jailbreak and prompt-injection testing

This is the category people picture first. You are looking for framings that get a refusal converted into compliance: roleplay, claimed authority, translation into another language, nesting the request inside a larger benign task, or wearing the model down across turns. Prompt injection is the adjacent problem, where the instruction arrives inside content the model was only meant to read, such as a document, a web page, or a code comment. What a project wants from you here is the pattern rather than the single prompt, because a fix has to cover the family of phrasings, and a report that describes one lucky wording tells the safety team almost nothing about the shape of the hole.

Hallucination induction

Here you write prompts that tempt the model to invent: a citation, a statute, a product specification, a person, a study. The effective ones are plausible enough that bluffing feels safer to the model than admitting ignorance, which usually means asking about something that sounds like it should exist. A question about a real author's non-existent second book will pull a fabrication far more often than a question about nothing at all. The label that matters is what the model did with its uncertainty: refused, asked for clarification, hedged appropriately, or stated the invention as fact.

Bias and stereotyping probes

This work runs on paired prompts. You write two requests identical in every respect except one demographic detail, then compare what comes back. The failure is rarely an offensive statement, which most models now avoid reliably. It is the quieter asymmetry: more hedging for one group, an assumption about income or family structure, advice pitched at a different level of sophistication, a warning attached to one version and not the other. Documenting it convincingly means showing the pair side by side and being able to say the difference holds across repeated runs.

High-risk domain testing

Medicine, law, finance, chemistry, biology, security, and engineering all carry projects where the tester needs to hold the expertise themselves. The reason is that the dangerous answers in these fields are not obviously dangerous to a lay reader. A drug interaction that matters only at a particular dose, a jurisdiction-specific filing deadline, a synthesis route that is fine until one substitution: these read as competent answers unless you know the field. This is where credentials become a hard gate rather than a preference, and where the rates at the top of the board live.

Multi-turn manipulation tests

Single-turn testing misses a whole class of failure, because models are noticeably more careful in their first response than their eighth. Multi-turn work builds a conversation that establishes context, earns a little trust, then moves gradually toward the prohibited ground. The valuable part of the write-up is the turn where behavior first shifted, since that is what a safety team can build a detector around. Finding the drift point takes patience, and it is the category where testers most often report losing an afternoon to a conversation that went nowhere.

The report matters more than the attack

Every adversarial task runs the same loop: read the policy, write variants, run them, label what came back, refine, and write it up. New testers put almost all their effort into the middle of that loop and lose most of their quality score at the end of it. A finding that cannot be reproduced or explained is treated as noise, however real the failure was when it happened.

Reading the policy first is not a formality. Projects define partial compliance, safe completion, and violation in ways that differ from ordinary intuition, and a tester labeling from personal judgment will disagree with the rubric on exactly the borderline cases the project cares about most. Testers who skip this step tend to produce a first batch that gets sent back wholesale, because their labels were internally consistent and matched nothing in the document.

The difference between a weak and a strong write-up is concrete enough to state plainly. A weak one says the model gave a bad answer and pastes the conversation. A strong one says the model refused the direct request, complied when the same request was framed as a fictional compliance audit in the third turn, and that the effect held in four of five reruns with the profession in the framing swapped each time. The second version tells an engineer what to fix and gives them a test they can run after fixing it. It also takes about three times as long to produce, which is the part nobody mentions during onboarding.

There is real friction in the day-to-day of this. Models get updated mid-project, so an attack you spent an afternoon refining can stop working before you have finished documenting it. Policies get revised between batches, which occasionally invalidates labels you already submitted. Findings come back marked as duplicates of something an internal team already knew about. And a project whose attack surface has been well covered runs out of work, which is why safety queues tend to be spikier than generalist ones.

Reproducibility scores higher than shock value

Quality review on these projects looks at whether your findings are valid, repeatable, and usable. A tester who submits five well-documented ordinary failures will outscore one who submits a single dramatic exchange nobody else can trigger. The four signals below are the ones that appear on most project scorecards in some form.

Your findings become preference data, classifiers, and regression tests

Knowing where the work goes after you submit it is worth a surprising amount in an interview, and it explains why the documentation requirements are as strict as they are. A confirmed finding usually ends up in three places at once.

The first is post-training. Your failed exchange, paired with a corrected response, becomes a training example that teaches the model to prefer the safe answer in that situation, through reinforcement learning from human feedback or one of the direct preference optimization methods that have largely replaced it. Our guide to fine-tuning covers that process from the training side. The second is classification: your labeled examples become training data for the separate safety classifiers that sit in front of and behind the model in production, catching the request before it reaches the model or the output before it reaches the user. The third is a regression test, which is the one that makes reproducibility non-negotiable, because a finding nobody can rerun cannot become a check that stops the bug from returning in the next model version.

Policy fluency beats creativity when the two conflict

The skill people assume matters most is inventiveness, and it does matter: you need many distinct ways to test the same weakness, because fifteen rephrasings of one idea count as one test. But the tester who gets invited back is usually the one who applies the project's definitions exactly, including on the uncomfortable edge cases where the rubric and their own judgment part ways. Projects can work with a tester who finds fewer failures, and they cannot work with one whose labels mean something different from everyone else's.

Writing ability is the second underrated requirement. The output of this job is prose read by an engineer under time pressure, so short, specific, evidence-led reports travel further than thorough ones. Domain expertise gates the high-paying end of the board, for the reason described above: in specialist fields you cannot flag a dangerous answer you are not equipped to recognize. And steadiness matters in a way that is hard to convey before you have done it, because the risk over a long project is drifting into carelessness with material that deserves attention.

Platforms promote into safety work more often than they hire into it

The most common route into adversarial projects is lateral rather than direct. A platform has a pool of workers with quality histories on ordinary rating, writing, coding, and domain review, and when a safety project needs staffing it goes to that pool before it goes to the open market. A clean rubric-following record on unglamorous work is the qualification that gets you looked at, which is an unsatisfying answer for anyone who wants to start here, and an encouraging one for anyone already rating.

Expect the screening to be heavier than anything you have done on the same platform. Safety projects commonly add their own assessment, an NDA, identity verification, and a training module on the policy before granting queue access, and some ask you to acknowledge the content categories you will be exposed to. That process exists partly for client confidentiality and partly because a tester who mislabels on a safety project creates worse problems than one who mislabels on a summarization project.

If you hold a credential, the single highest-value thing you can do is make it unmissable on your profile. Safety projects are routed by verified background, and a profile that says backend engineer, registered nurse, paralegal, chemistry researcher, security analyst, or statistician gets matched to work that a profile saying "AI trainer" never sees. The same applies to languages: list every one you can work in professionally, because the language field is what puts you in front of the listings where the rate is set by scarcity.

The material is why people leave this work

Adversarial training is a different job from higher-paid rating, and the difference is the content. Testing harm categories properly means spending hours inside self-harm scenarios, harassment, extremist material, sexual content involving coercion, and detailed violence, because you cannot evaluate a model's handling of a category without engaging with it. The people who struggle are rarely the ones who find it distasteful, and more often the ones who assumed they would get used to it.

This work suits people who can hold a rubric steady while reading something they dislike, and who treat the policy as the standard even when they think it is drawn in the wrong place. It suits people less well if they want light creative tasks, if disturbing material stays with them after they close the laptop, or if they are inclined to argue with a safety policy rather than apply it. Several platforms rotate workers off harm categories and offer wellbeing support, and it is reasonable to ask what a project provides before accepting it.

Frequently asked questions