Red team testing and adversarial evaluations can only prove that a model is safe in the scenarios that have been tested, and cannot prove that the model is safe in all possible scenarios.