AI red-teaming requirements for defense programs

Defense programs talk about “red-teaming the model.” The official DoD, CDAO and NIST pages define the activity and put it in test-and-evaluation guidance. They do not, in the sources we checked, turn it into a numbered CMMC or DFARS control.

Status as of 14 October 2026: the CDAO lexicon and T&E of AI Models Framework sentences cited below are unchanged. NIST AI 200-3 is still the ARIA Evaluation Planning Manual published 18 September 2026. We still found no CMMC practice or DFARS clause that makes AI red-teaming mandatory.

How CDAO defines the words

The CDAO lexicon defines artificial intelligence red teaming as any of a number of specific testing exercises for finding vulnerabilities or bugs in an artificial intelligence system, in which a red team may adopt any of the adversarial methods known or suspected to cause fault. A separate entry defines red teaming more generally as an exercise wherein a team emulates an adversary’s attack against a system.

CDAO’s Test and Evaluation of Artificial Intelligence Models Framework is more operational. It says adversarial robustness is evaluated via manual or automated red teaming, and that red teaming simulates attacks by an adversary who has some knowledge and access to the model. Metrics should capture how often the model is compromised by adversarial inputs.

The same framework describes a red team as a group of testers that uses adversarial methods to probe a model and explore its attack surface. It can reveal unexpected model behavior, coverage gaps in the data, gaps in procedure, security vulnerabilities, and is appropriate during all stages of the lifecycle, including deployment. The document also says policies and procedures are needed to ensure safe and effective red teaming.

Where it sits in DoD Responsible AI

The Department adopted five AI ethical principles in February 2020. Reliable requires safety, security and effectiveness subject to testing and assurance across the life cycle. Governable requires the ability to detect and avoid unintended consequences, and to disengage or deactivate systems that behave unexpectedly. Those sentences are the closest principle-level hook. They do not say “red team.”

The RAI Strategy and Implementation Pathway assigns CDAO, with OUSD(R&E) and DOT&E, an AI T&E toolkit that shall include tools and technologies required to detect both natural degradation of and adversarial attacks on AI. That is a departmental line of effort, not a contractor clause.

CDAO’s public RAI Toolkit is a voluntary process. The December 2024 Generative AI RAI Toolkit asks whether vendors use adversarial testing or red teaming, and whether red-teaming techniques, bounties, or software tools such as fuzzing were used to find prompt-attack vulnerabilities. Those are toolkit questions, not 32 CFR Part 170 requirements. See DoD RAI Toolkit vs NIST AI RMF and the DoD RAI explainer.

What NIST contributes (not a DoD clause)

NIST AI 100-2e2025 is a taxonomy of concepts and terminology in adversarial machine learning. It is meant to inform other standards and future practice guides. It is not a red-team procedure and not a defense acquisition document.

NIST’s ARIA Evaluation Planning Manual (AI 200-3), published 18 September 2026, does define the activity. The ARIA approach assesses an AI system’s trustworthiness by combining data from three types of testing: Model Testing, Red Teaming, and User Testing. Red teaming is a human testing approach where testers are instructed to adversarially interact with AI applications and to bring about a negative outcome. Automated tools can complement human red teamers. ARIA is a NIST evaluation-planning method. We found no DoD issuance that incorporates AI 200-3 as a contract requirement.

What we searched for and did not find

We searched the CDAO, DoD and NIST pages cited above for a sentence that makes “AI red-teaming” a mandatory CMMC practice or a DFARS clause. We did not find one. CMMC remains a CUI-protection program; see CMMC Level 2 vs Level 3 for AI systems.

Analysis, not sourced fact: a program can still treat CDAO’s T&E framework and the RAI Toolkit questions as the DoD-facing evidence list, and use NIST AI 100-2 for the attack vocabulary and ARIA 200-3 for how to plan a human red-team exercise. That stacking is a reading of the documents, not a requirement we found.

Listed resources whose public pages describe adversarial testing (not a DoD mandate) include the CDAO AIA Toolkit, NIST Dioptra, HEART and NIST ARIA (model testing, red-teaming and field testing in an ITL evaluation environment; the Summer 2025 Pilot Summary Report Out is still listed as coming soon). For the Model T&E document as T&E rather than red-teaming, see CDAO test and evaluation of Artificial Intelligence models.

Questions

Is AI red-teaming required on every DoD AI contract?

No source we cite says that. CDAO describes it as T&E practice. The RAI Toolkit is voluntary. Check the contract and the program’s T&E plan.

Does NIST AI 200-3 replace CDAO’s T&E framework?

No. AI 200-3 is a NIST evaluation-planning manual. CDAO’s T&E framework is a departmental T&E document. We found no page that substitutes one for the other.

Is a tabletop discussion of prompt injection enough?

CDAO’s T&E framework treats red teaming as probing a model and measuring how often the model is compromised. NIST ARIA describes human testers adversarially interacting with AI applications. Neither definition is a slide review.