A bug bounty is an organized contest or reporting program that rewards people for finding security defects or other vulnerabilities. In large-language-model testing, providers use bounties to invite outsiders to discover ways models can produce unsafe or otherwise undesirable outputs. section 5.9
Bug bounties extend red teaming beyond an internal team. They add crowdsourced human testing, helping providers find diverse attacks that automated systems may miss, especially across creative or multi-turn interactions. Their findings provide useful signals, not complete solutions: model failures can be probabilistic, difficult to reproduce, or resistant to straightforward fixes. section 5.9 section 10.22
A bug-bounty program can:
- Scale manual adversarial testing by inviting many participants to search for model weaknesses. section 5.9
- Expose risks publicly, increasing shared visibility and accountability around deployed systems. section 10.22
- Feed discovered failure modes into safety workflows such as prompt changes, dataset modifications, access restrictions, or architectural safeguards. section 10.22
