这篇论文拿多个模型种群跑了几万局游戏，发现换一条规则，事故率能差 58 个百分点，而且匿名化也挡不住针对性消除。做多智能体安全的一定要看。
论文提出 institutional red-teaming 方法论并实例化为 IABench-CA 基准，覆盖 228 个上下文、5 条规范规则及 7 个模型种群（共 33,924 局游戏）。结果显示：仅改变后果规则即可使平均死亡人数变动 22-58 个百分点。没有任何规则在所有种群中安全：最安全与最不安全的规则及其影响方向均随种群变化，但回归性身份定位从未成为任何上下文中的绝对安全策略，且在 30-87% 的游戏中去除了资源最少的智能体。对最易受剥削种群（gpt-5.1）的消融实验表明，规则文本中命名损失承担者使针对性消除从 22% 升至 81%；重复游戏下匿名化仅延迟定位，智能体从观察结果反推隐藏规则。
Institutional Red-Teaming: Deployment Rules, Not Just Models, Causally Shape Multi-Agent AI Safety
We introduce institutional red-teaming, an evaluation methodology for testing deployment rules in multi-agent AI: hold the agents, objectives, and task state fixed, vary only one rule, and attribute the resulting change in collective behavior to that rule. We instantiate the methodology in IABench-CA, a consequence-allocation benchmark spanning 228 contexts, five canonical rules, and seven model populations (33,924 games), with a normative cooperative reference and auto-labelled reasoning traces. Three findings emerge. (1) Deployment rules causally alter collective safety: changing only the consequence rule moves mean fatality by 22 to 58 percentage points within every population. (2) There is no safe default, but the targeting hazard is universal: the safest rule, the least-safe rule, and even the direction of the incidence effect vary across populations, yet regressive identity-targeting is never decisively safest in any context for any population, eliminates the least-resourced agent in 30-87% of games everywhere, and is selection-unsafe relative to the cooperative reference for all seven populations. (3) Identity salience is the mechanism: a one-shot anonymization ablation on the most exploitation-prone population (gpt-5.1) shows that merely naming the loss bearer in the rule text drives targeted elimination from 22% to 81% at identical payoffs; under repeated play, anonymization only delays the targeting, as agents re-infer the hidden rule from observed eliminations. We package the methodology as a safety-case workflow that certifies a provisional rule region $Φ(c,P)$ per deployment context and population, with explicit residual risks and monitoring obligations.