摘要：我们引入制度红队测试，一种用于在多智能体 AI 中测试部署规则的评估方法：固定智能体、目标和任务状态，仅改变一条规则，并将由此引起的集体行为变化归因于该规则。我们在 IABench-CA 中实例化了该方法，这是一个涵盖 228 个情景、五种经典规则和七个模型种群（共 33924 局博弈）的后果分配基准，并带有规范合作参照和自动标注的推理轨迹。三项发现浮现。（1）部署规则因果性地改变集体安全：仅改变后果规则，在每一个种群内就能使平均致死率变动 22 至 58 个百分点。（2）不存在安全默认设置，但瞄准危害普遍存在：最安全的规则、最不安全的规则，甚至发生率效应的方向，均在不同种群间变化；然而，回归性身份瞄准在任何情景下对任何种群都绝不具有决定性安全优势，在所有种群中有 30%–87% 的博弈中淘汰资源最少的智能体，并且相对于合作参照，对所有七个种群都具有选择安全性问题。（3）身份显著性是机制：对最易被利用的种群（gpt-5.1）进行单次匿名化消融实验表明，在收益完全相同的情况下，仅在规则文本中命名损失承担者，就会使定向淘汰从 22% 上升至 81%；在重复博弈下，匿名化仅能延迟瞄准，因为智能体从观察到的淘汰中重新推断出隐藏规则。我们将该方法打包为一个安全案例工作流，为每个部署情景和种群认证一个临时规则区域 $\Phi(c,P)$，并附有明确的残余风险和监测义务。

Abstract:We introduce institutional red-teaming, an evaluation methodology for testing deployment rules in multi-agent AI: hold the agents, objectives, and task state fixed, vary only one rule, and attribute the resulting change in collective behavior to that rule. We instantiate the methodology in IABench-CA, a consequence-allocation benchmark spanning 228 contexts, five canonical rules, and seven model populations (33,924 games), with a normative cooperative reference and auto-labelled reasoning traces. Three findings emerge. (1) Deployment rules causally alter collective safety: changing only the consequence rule moves mean fatality by 22 to 58 percentage points within every population. (2) There is no safe default, but the targeting hazard is universal: the safest rule, the least-safe rule, and even the direction of the incidence effect vary across populations, yet regressive identity-targeting is never decisively safest in any context for any population, eliminates the least-resourced agent in 30-87% of games everywhere, and is selection-unsafe relative to the cooperative reference for all seven populations. (3) Identity salience is the mechanism: a one-shot anonymization ablation on the most exploitation-prone population (gpt-5.1) shows that merely naming the loss bearer in the rule text drives targeted elimination from 22% to 81% at identical payoffs; under repeated play, anonymization only delays the targeting, as agents re-infer the hidden rule from observed eliminations. We package the methodology as a safety-case workflow that certifies a provisional rule region $\Phi(c,P)$ per deployment context and population, with explicit residual risks and monitoring obligations.