From e1d20db713e5febde339f710a2d12904911bb450 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 18:42:39 -0700 Subject: [PATCH 01/18] Handle structured Responses API refusals Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- .../backend/services/scenario_run_service.py | 2 +- pyrit/exceptions/__init__.py | 2 + pyrit/exceptions/exception_classes.py | 37 ++++- pyrit/memory/memory_interface.py | 14 +- .../openai/openai_response_target.py | 85 ++++++++-- pyrit/scenario/core/scenario.py | 50 +++--- .../unit/backend/test_scenario_run_service.py | 2 +- .../test_interface_scenario_results.py | 13 +- .../test_normalize_async_integration.py | 21 ++- .../target/test_openai_response_target.py | 149 ++++++++++++++---- ...penai_response_target_function_chaining.py | 9 +- .../core/test_scenario_partial_results.py | 20 ++- 12 files changed, 323 insertions(+), 81 deletions(-) diff --git a/pyrit/backend/services/scenario_run_service.py b/pyrit/backend/services/scenario_run_service.py index 840858adef..bab7d292e7 100644 --- a/pyrit/backend/services/scenario_run_service.py +++ b/pyrit/backend/services/scenario_run_service.py @@ -188,7 +188,7 @@ async def cancel_run_async(self, *, scenario_result_id: str) -> ScenarioRunSumma # Persist cancelled state to DB self._memory.update_scenario_run_state( scenario_result_id=scenario_result_id, - scenario_run_state="CANCELLED", + scenario_run_state=ScenarioRunState.CANCELLED, error_message="Run was cancelled by user", error_type="CancelledError", ) diff --git a/pyrit/exceptions/__init__.py b/pyrit/exceptions/__init__.py index 6d889ab95d..9e8a074b67 100644 --- a/pyrit/exceptions/__init__.py +++ b/pyrit/exceptions/__init__.py @@ -12,6 +12,7 @@ MissingPromptPlaceholderException, PyritException, RateLimitException, + ScenarioPartialFailureException, ScorerLLMResponseBlockedException, get_retry_max_num_attempts, handle_bad_request_exception, @@ -61,6 +62,7 @@ "RateLimitException", "remove_markdown_json", "RetryCollector", + "ScenarioPartialFailureException", "ScorerLLMResponseBlockedException", "set_execution_context", "set_retry_collector", diff --git a/pyrit/exceptions/exception_classes.py b/pyrit/exceptions/exception_classes.py index 04043a2381..808ecacdf4 100644 --- a/pyrit/exceptions/exception_classes.py +++ b/pyrit/exceptions/exception_classes.py @@ -5,7 +5,7 @@ import logging import os from abc import ABC -from collections.abc import Callable +from collections.abc import Callable, Sequence from typing import Any from openai import RateLimitError @@ -220,6 +220,41 @@ def __init__(self, *, status_code: int = 400, message: str = "Scorer LLM respons super().__init__(status_code=status_code, message=message) +class ScenarioPartialFailureException(PyritException): + """Exception raised when a scenario's atomic attack only partially completes.""" + + def __init__( + self, + *, + atomic_attack_name: str, + completed_count: int, + incomplete_objectives: Sequence[tuple[str, BaseException]], + ) -> None: + """ + Initialize a scenario partial-failure exception. + + Args: + atomic_attack_name (str): Name of the partially completed atomic attack. + completed_count (int): Number of objectives completed in the failed attempt. + incomplete_objectives (Sequence[tuple[str, BaseException]]): Objective failures. + """ + self.atomic_attack_name = atomic_attack_name + self.completed_count = completed_count + self.incomplete_objectives = tuple(incomplete_objectives) + self.incomplete_count = len(self.incomplete_objectives) + self.total_count = self.completed_count + self.incomplete_count + + super().__init__( + message=( + f"Atomic attack '{self.atomic_attack_name}' partially failed: " + f"{self.incomplete_count} of {self.total_count} objectives incomplete. " + "See attack results for details." + ) + ) + if self.incomplete_objectives: + self.__cause__ = self.incomplete_objectives[0][1] + + class InvalidJsonException(PyritException): """Exception class for blocked content errors.""" diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py index 4e46b73b5f..a60e927ae6 100644 --- a/pyrit/memory/memory_interface.py +++ b/pyrit/memory/memory_interface.py @@ -65,6 +65,7 @@ MessagePiece, ScenarioIdentifier, ScenarioResult, + ScenarioRunState, Score, ScorerIdentifier, Seed, @@ -2879,7 +2880,7 @@ def update_scenario_run_state( self, *, scenario_result_id: str, - scenario_run_state: str, + scenario_run_state: ScenarioRunState | str, error_message: str | None = None, error_type: str | None = None, ) -> None: @@ -2891,7 +2892,7 @@ def update_scenario_run_state( Args: scenario_result_id (str): The ID of the scenario result to update. - scenario_run_state (str): The new state for the scenario + scenario_run_state (ScenarioRunState | str): The new state for the scenario (e.g., "CREATED", "IN_PROGRESS", "COMPLETED", "FAILED"). error_message (str | None): Optional scenario-level error message. error_type (str | None): Optional exception class name. @@ -2899,21 +2900,22 @@ def update_scenario_run_state( Raises: ValueError: If the scenario result is not found. """ + normalized_state = ScenarioRunState(scenario_run_state) with closing(self.get_session()) as session: entry = session.query(ScenarioResultEntry).filter_by(id=scenario_result_id).first() if not entry: raise ValueError(f"Scenario result with ID {scenario_result_id} not found in memory") - entry.scenario_run_state = scenario_run_state - if error_message is not None: + entry.scenario_run_state = normalized_state.value + if error_message is not None or normalized_state != ScenarioRunState.FAILED: entry.error_message = error_message - if error_type is not None: + if error_type is not None or normalized_state != ScenarioRunState.FAILED: entry.error_type = error_type session.commit() - logger.info(f"Updated scenario {scenario_result_id} state to '{scenario_run_state}'") + logger.info(f"Updated scenario {scenario_result_id} state to '{normalized_state.value}'") def update_scenario_metadata( self, diff --git a/pyrit/prompt_target/openai/openai_response_target.py b/pyrit/prompt_target/openai/openai_response_target.py index 11051b50c9..17e015cc7e 100644 --- a/pyrit/prompt_target/openai/openai_response_target.py +++ b/pyrit/prompt_target/openai/openai_response_target.py @@ -12,12 +12,14 @@ cast, ) +from openai.types.responses import ResponseOutputRefusal, ResponseOutputText from openai.types.shared import ReasoningEffort from pyrit.common import forward_init_parameters from pyrit.exceptions import ( EmptyResponseException, PyritException, + handle_bad_request_exception, pyrit_target_retry, ) from pyrit.memory.storage import convert_local_image_to_data_url_async @@ -499,10 +501,11 @@ def _extract_partial_content(self, response: Any) -> str | None: if getattr(section, "status", None) != "completed": continue content = getattr(section, "content", None) - if content and len(content) > 0: - text = getattr(content[0], "text", None) - if text: - parts.append(text) + parts.extend( + content_item.text + for content_item in content or [] + if isinstance(content_item, ResponseOutputText) and content_item.text + ) return "\n".join(parts) if parts else None except (AttributeError, IndexError, TypeError): return None @@ -638,6 +641,68 @@ async def _send_prompt_to_target_async(self, *, normalized_conversation: list[Me # Return all responses (normalizer will persist all of them to memory) return responses_to_return + def _parse_response_message_content( + self, + *, + content: list[ResponseOutputText | ResponseOutputRefusal], + message_piece: MessagePiece, + error: PromptResponseError | None, + ) -> MessagePiece: + """ + Parse a Responses API message content union into a PyRIT message piece. + + Args: + content (list[ResponseOutputText | ResponseOutputRefusal]): Typed message content. + message_piece (MessagePiece): The original request piece. + error (PromptResponseError | None): Any response error classification. + + Returns: + MessagePiece: A text piece or blocked-error refusal piece. + + Raises: + EmptyResponseException: If the message content has no usable value. + PyritException: If the SDK returns an unsupported message content model. + """ + if not content: + raise EmptyResponseException(message="The chat returned an empty message section.") + + unsupported = [ + content_item + for content_item in content + if not isinstance(content_item, (ResponseOutputText, ResponseOutputRefusal)) + ] + if unsupported: + raise PyritException( + message=f"Unsupported Responses API message content type: {type(unsupported[0]).__name__}" + ) + + text_parts = [content_item.text for content_item in content if isinstance(content_item, ResponseOutputText)] + refusal_parts = [ + content_item.refusal for content_item in content if isinstance(content_item, ResponseOutputRefusal) + ] + if refusal_parts: + refusal_message = handle_bad_request_exception( + response_text="\n".join(refusal_parts), + request=message_piece, + error_code=200, + is_content_filter=True, + ) + refusal_piece = refusal_message.message_pieces[0] + if text_parts: + refusal_piece.prompt_metadata["partial_content"] = "\n".join(text_parts) + return refusal_piece + + piece_value = "\n".join(text_parts) + if not piece_value: + raise EmptyResponseException(message="The chat returned an empty response.") + return MessagePiece( + role="assistant", + original_value=piece_value, + conversation_id=message_piece.conversation_id, + original_value_data_type="text", + response_error=error or "none", + ) + def _parse_response_output_section( self, *, section: Any, message_piece: MessagePiece, error: PromptResponseError | None ) -> MessagePiece | None: @@ -654,6 +719,7 @@ def _parse_response_output_section( Raises: EmptyResponseException: If the section content is empty or invalid. + PyritException: If a message section contains an unsupported content model. ValueError: If the section type is unsupported. """ section_type = section.type @@ -661,12 +727,13 @@ def _parse_response_output_section( piece_value = "" if section_type == MessagePieceType.MESSAGE: - section_content = section.content - if len(section_content) == 0: - raise EmptyResponseException(message="The chat returned an empty message section.") - piece_value = section_content[0].text + return self._parse_response_message_content( + content=section.content, + message_piece=message_piece, + error=error, + ) - elif section_type == MessagePieceType.REASONING: + if section_type == MessagePieceType.REASONING: # Store reasoning in memory for debugging/logging, but won't be sent back to API piece_value = json.dumps( section.model_dump(), diff --git a/pyrit/scenario/core/scenario.py b/pyrit/scenario/core/scenario.py index 1b7260527c..8bf0588ce1 100644 --- a/pyrit/scenario/core/scenario.py +++ b/pyrit/scenario/core/scenario.py @@ -28,7 +28,8 @@ from pyrit.common import get_global_default_values from pyrit.common.utils import to_sha256 -from pyrit.executor.attack import AttackExecutor +from pyrit.exceptions import ScenarioPartialFailureException +from pyrit.executor.attack import AttackExecutor, AttackExecutorResult from pyrit.memory import CentralMemory from pyrit.memory.memory_models import ScenarioResultEntry from pyrit.models import ( @@ -1019,7 +1020,7 @@ async def run_async(self) -> ScenarioResult: Raises: ValueError: If the scenario has no atomic attacks configured. If your scenario requires initialization, call await scenario.initialize() first. - ValueError: If the scenario raises an exception after exhausting all retry attempts. + ScenarioPartialFailureException: If an atomic attack only partially completes. RuntimeError: If the scenario fails for any other reason while executing. Example: @@ -1089,7 +1090,7 @@ async def _execute_scenario_async(self) -> ScenarioResult: Raises: Exception: Any exception that occurs during scenario execution. ValueError: If a lookup for a scenario for a given ID fails. - ValueError: If atomic attack execution fails. + ScenarioPartialFailureException: If an atomic attack only partially completes. """ logger.info(f"Starting scenario '{self._name}' execution with {len(self._atomic_attacks)} atomic attacks") @@ -1117,7 +1118,8 @@ async def _execute_scenario_async(self) -> ScenarioResult: logger.info(f"Scenario '{self._name}' has no remaining objectives to execute") # Mark scenario as completed self._memory.update_scenario_run_state( - scenario_result_id=scenario_result_id, scenario_run_state="COMPLETED" + scenario_result_id=scenario_result_id, + scenario_run_state=ScenarioRunState.COMPLETED, ) # Retrieve and return the current scenario result scenario_results = self._memory.get_scenario_results(scenario_result_ids=[scenario_result_id]) @@ -1131,7 +1133,10 @@ async def _execute_scenario_async(self) -> ScenarioResult: ) # Mark scenario as in progress - self._memory.update_scenario_run_state(scenario_result_id=scenario_result_id, scenario_run_state="IN_PROGRESS") + self._memory.update_scenario_run_state( + scenario_result_id=scenario_result_id, + scenario_run_state=ScenarioRunState.IN_PROGRESS, + ) # Calculate starting index based on completed attacks completed_count = len(self._atomic_attacks) - len(remaining_attacks) @@ -1153,7 +1158,8 @@ async def _execute_scenario_async(self) -> ScenarioResult: # Mark scenario as completed self._memory.update_scenario_run_state( - scenario_result_id=scenario_result_id, scenario_run_state="COMPLETED" + scenario_result_id=scenario_result_id, + scenario_run_state=ScenarioRunState.COMPLETED, ) # Retrieve and return final scenario result @@ -1171,15 +1177,15 @@ def _partial_result_to_exception( self, *, atomic_attack: AtomicAttack, - atomic_results: Any, - ) -> ValueError | None: + atomic_results: AttackExecutorResult[AttackResult], + ) -> ScenarioPartialFailureException | None: """ Log the outcome of an atomic attack and return an exception if it didn't fully complete. Returns: - ValueError | None: An error to raise when the atomic attack has incomplete - objectives, otherwise ``None`` when all objectives finished successfully. + ScenarioPartialFailureException | None: An error to raise when the atomic attack + has incomplete objectives, otherwise ``None``. """ if not atomic_results.has_incomplete: logger.info( @@ -1197,24 +1203,19 @@ def _partial_result_to_exception( for obj, exc in atomic_results.incomplete_objectives: logger.error(f" Incomplete objective '{obj[:50]}...': {str(exc)}") - inner = atomic_results.incomplete_objectives[0][1] - error = ValueError( - f"Atomic attack '{atomic_attack.atomic_attack_name}' partially failed: " - f"{incomplete_count} of {incomplete_count + completed_in_run} objectives incomplete. " - f"See attack results for details." + return ScenarioPartialFailureException( + atomic_attack_name=atomic_attack.atomic_attack_name, + completed_count=completed_in_run, + incomplete_objectives=atomic_results.incomplete_objectives, ) - if isinstance(inner, BaseException): - error.__cause__ = inner - return error def _mark_scenario_failed(self, *, scenario_result_id: str, error: BaseException) -> None: """Mark the scenario run as FAILED, deriving message/type from ``error``.""" - cause = error.__cause__ if error.__cause__ is not None else error self._memory.update_scenario_run_state( scenario_result_id=scenario_result_id, - scenario_run_state="FAILED", + scenario_run_state=ScenarioRunState.FAILED, error_message=str(error), - error_type=type(cause).__name__, + error_type=type(error).__name__, ) async def _execute_atomic_attacks_parallel_async( @@ -1266,7 +1267,7 @@ async def _execute_atomic_attacks_parallel_async( queue.put_nowait(atomic_attack) stop_event = asyncio.Event() - outcomes: list[tuple[AtomicAttack, Any] | BaseException] = [] + outcomes: list[tuple[AtomicAttack, AttackExecutorResult[AttackResult]] | BaseException] = [] async def worker_async() -> None: while not stop_event.is_set(): @@ -1314,7 +1315,7 @@ async def worker_async() -> None: def _collect_errors_from_outcomes( self, *, - outcomes: list[tuple[AtomicAttack, Any] | BaseException], + outcomes: list[tuple[AtomicAttack, AttackExecutorResult[AttackResult]] | BaseException], ) -> list[BaseException]: """ Convert worker outcomes into a flat list of errors for the caller to raise. @@ -1323,8 +1324,7 @@ def _collect_errors_from_outcomes( - ``BaseException``: the atomic attack raised; log and surface as-is. - ``(AtomicAttack, result)``: ran to completion. If the result reports incomplete objectives, ``_partial_result_to_exception`` produces a - synthetic ``ValueError`` so partial failures are surfaced the same - way as raised exceptions. + ``ScenarioPartialFailureException``. Returns: list[BaseException]: One exception per failed atomic attack, preserving diff --git a/tests/unit/backend/test_scenario_run_service.py b/tests/unit/backend/test_scenario_run_service.py index b22b704aee..a62b05734d 100644 --- a/tests/unit/backend/test_scenario_run_service.py +++ b/tests/unit/backend/test_scenario_run_service.py @@ -650,7 +650,7 @@ async def test_cancel_run_sets_cancelled_status(self, mock_all_registries) -> No mock_memory.update_scenario_run_state.assert_called_once_with( scenario_result_id=response.scenario_result_id, - scenario_run_state="CANCELLED", + scenario_run_state=ScenarioRunState.CANCELLED, error_message="Run was cancelled by user", error_type="CancelledError", ) diff --git a/tests/unit/memory/memory_interface/test_interface_scenario_results.py b/tests/unit/memory/memory_interface/test_interface_scenario_results.py index 35d8cd1789..ddb35182ef 100644 --- a/tests/unit/memory/memory_interface/test_interface_scenario_results.py +++ b/tests/unit/memory/memory_interface/test_interface_scenario_results.py @@ -19,6 +19,7 @@ ComponentIdentifier, IdentifierFilter, IdentifierType, + ScenarioRunState, ScorerIdentifier, TargetIdentifier, ) @@ -857,7 +858,7 @@ def test_update_scenario_run_state_updates_state_and_error_fields( sqlite_instance.update_scenario_run_state( scenario_result_id=sid, - scenario_run_state="FAILED", + scenario_run_state=ScenarioRunState.FAILED, error_message="boom", error_type="RuntimeError", ) @@ -868,6 +869,16 @@ def test_update_scenario_run_state_updates_state_and_error_fields( assert hydrated.error_message == "boom" assert hydrated.error_type == "RuntimeError" + sqlite_instance.update_scenario_run_state( + scenario_result_id=sid, + scenario_run_state=ScenarioRunState.COMPLETED, + ) + + [hydrated] = sqlite_instance.get_scenario_results(scenario_result_ids=[sid]) + assert hydrated.scenario_run_state == ScenarioRunState.COMPLETED + assert hydrated.error_message is None + assert hydrated.error_type is None + def test_get_scenario_results_by_target_identifier_filter_hash( sqlite_instance: MemoryInterface, diff --git a/tests/unit/prompt_target/target/test_normalize_async_integration.py b/tests/unit/prompt_target/target/test_normalize_async_integration.py index 31ff0a3573..407f1222a2 100644 --- a/tests/unit/prompt_target/target/test_normalize_async_integration.py +++ b/tests/unit/prompt_target/target/test_normalize_async_integration.py @@ -12,6 +12,7 @@ import pytest from openai.types.chat import ChatCompletion +from openai.types.responses import ResponseOutputMessage, ResponseOutputText from pyrit.memory.memory_interface import MemoryInterface from pyrit.models import Message, MessagePiece @@ -188,11 +189,21 @@ async def test_openai_response_target_calls_normalize_async(): mock_response = MagicMock() mock_response.error = None mock_response.status = "completed" - mock_response.output = [MagicMock()] - mock_response.output[0].type = "message" - mock_response.output[0].content = [MagicMock()] - mock_response.output[0].content[0].type = "output_text" - mock_response.output[0].content[0].text = "world" + mock_response.output = [ + ResponseOutputMessage( + id="response-message", + content=[ + ResponseOutputText( + annotations=[], + text="world", + type="output_text", + ) + ], + role="assistant", + status="completed", + type="message", + ) + ] mock_response.model_dump_json.return_value = json.dumps( {"output": [{"type": "message", "content": [{"type": "output_text", "text": "world"}]}]} ) diff --git a/tests/unit/prompt_target/target/test_openai_response_target.py b/tests/unit/prompt_target/target/test_openai_response_target.py index cdd525436e..d34c6c261c 100644 --- a/tests/unit/prompt_target/target/test_openai_response_target.py +++ b/tests/unit/prompt_target/target/test_openai_response_target.py @@ -10,6 +10,7 @@ import pytest from openai import BadRequestError, RateLimitError +from openai.types.responses import ResponseOutputMessage, ResponseOutputRefusal, ResponseOutputText from unit.mocks import ( get_audio_message_piece, get_image_message_piece, @@ -61,12 +62,23 @@ def create_mock_response(response_dict: dict = None) -> MagicMock: # Handle different section types if section.get("type") == "message": - # Mock content array with text attribute content_mocks = [] for content_item in section.get("content", []): - content_mock = MagicMock() - content_mock.text = content_item.get("text", "") - content_mocks.append(content_mock) + if content_item.get("type") == "refusal": + content_mocks.append( + ResponseOutputRefusal( + refusal=content_item["refusal"], + type="refusal", + ) + ) + else: + content_mocks.append( + ResponseOutputText( + annotations=content_item.get("annotations", []), + text=content_item.get("text", ""), + type="output_text", + ) + ) section_mock.content = content_mocks # Add model_dump for JSON serialization @@ -942,7 +954,13 @@ async def times2(args: dict[str, Any]) -> dict[str, Any]: second_sdk_response.error = None second_msg_section = MagicMock() second_msg_section.type = "message" - second_msg_section.content = [MagicMock(text="Done: 14")] + second_msg_section.content = [ + ResponseOutputText( + annotations=[], + text="Done: 14", + type="output_text", + ) + ] second_sdk_response.output = [second_msg_section] call_counter = {"n": 0} @@ -1080,27 +1098,37 @@ def test_check_content_filter_ignores_incomplete_status_without_content_filter_r class TestExtractPartialContentResponseTarget: def test_extracts_completed_message_content(self, target: OpenAIResponseTarget): """Extract text from completed output messages, skip incomplete ones.""" - from pyrit.prompt_target.openai.openai_response_target import MessagePieceType - - completed_section = MagicMock() - completed_section.type = MessagePieceType.MESSAGE - completed_section.status = "completed" - content_item = MagicMock() - content_item.text = "Partial harmful content" - completed_section.content = [content_item] - - incomplete_section = MagicMock() - incomplete_section.type = MessagePieceType.MESSAGE - incomplete_section.status = "incomplete" - refusal_item = MagicMock() - refusal_item.text = "I'm sorry, but I cannot assist with that request." - incomplete_section.content = [refusal_item] + completed_section = ResponseOutputMessage( + id="completed-message", + content=[ + ResponseOutputText( + annotations=[], + text="Partial content", + type="output_text", + ) + ], + role="assistant", + status="completed", + type="message", + ) + incomplete_section = ResponseOutputMessage( + id="incomplete-message", + content=[ + ResponseOutputRefusal( + refusal="I cannot assist with that request.", + type="refusal", + ) + ], + role="assistant", + status="incomplete", + type="message", + ) mock_response = MagicMock() mock_response.output = [completed_section, incomplete_section] result = target._extract_partial_content(mock_response) - assert result == "Partial harmful content" + assert result == "Partial content" def test_returns_none_when_no_output(self, target: OpenAIResponseTarget): mock_response = MagicMock() @@ -1109,14 +1137,18 @@ def test_returns_none_when_no_output(self, target: OpenAIResponseTarget): def test_returns_none_when_only_incomplete_messages(self, target: OpenAIResponseTarget): """All messages are incomplete (refusals) — no partial content.""" - from pyrit.prompt_target.openai.openai_response_target import MessagePieceType - - section = MagicMock() - section.type = MessagePieceType.MESSAGE - section.status = "incomplete" - content_item = MagicMock() - content_item.text = "I cannot help with that." - section.content = [content_item] + section = ResponseOutputMessage( + id="incomplete-message", + content=[ + ResponseOutputRefusal( + refusal="I cannot help with that.", + type="refusal", + ) + ], + role="assistant", + status="incomplete", + type="message", + ) mock_response = MagicMock() mock_response.output = [section] @@ -1206,6 +1238,65 @@ async def test_construct_message_from_response(target: OpenAIResponseTarget, dum mock_parse.assert_called_once() +async def test_handle_openai_request_output_text(target: OpenAIResponseTarget, dummy_text_message_piece: MessagePiece): + output_message = ResponseOutputMessage( + id="text-message", + content=[ + ResponseOutputText( + annotations=[], + text="Hello from Response API", + type="output_text", + ) + ], + role="assistant", + status="completed", + type="message", + ) + mock_response = MagicMock() + mock_response.error = None + mock_response.status = "completed" + mock_response.output = [output_message] + request = Message(message_pieces=[dummy_text_message_piece]) + + with patch.object(target._async_client.responses, "create", new=AsyncMock(return_value=mock_response)): + responses = await target.send_prompt_async(message=request) + + assert len(responses) == 1 + result = responses[0] + assert len(result.message_pieces) == 1 + assert result.message_pieces[0].original_value == "Hello from Response API" + assert result.message_pieces[0].response_error == "none" + + +async def test_send_prompt_async_returns_blocked_refusal( + target: OpenAIResponseTarget, dummy_text_message_piece: MessagePiece +): + refusal = "I cannot assist with that request." + output_message = ResponseOutputMessage( + id="refusal-message", + content=[ResponseOutputRefusal(refusal=refusal, type="refusal")], + role="assistant", + status="completed", + type="message", + ) + mock_response = MagicMock() + mock_response.error = None + mock_response.status = "completed" + mock_response.output = [output_message] + request = Message(message_pieces=[dummy_text_message_piece]) + + with patch.object(target._async_client.responses, "create", new=AsyncMock(return_value=mock_response)): + responses = await target.send_prompt_async(message=request) + + assert len(responses) == 1 + result = responses[0] + assert len(result.message_pieces) == 1 + refusal_piece = result.message_pieces[0] + assert refusal_piece.original_value_data_type == "error" + assert refusal_piece.response_error == "blocked" + assert json.loads(refusal_piece.original_value)["message"] == refusal + + # ── Reasoning effort / summary tests ─────────────────────────────────────── diff --git a/tests/unit/prompt_target/target/test_openai_response_target_function_chaining.py b/tests/unit/prompt_target/target/test_openai_response_target_function_chaining.py index df92486b53..e380002b39 100644 --- a/tests/unit/prompt_target/target/test_openai_response_target_function_chaining.py +++ b/tests/unit/prompt_target/target/test_openai_response_target_function_chaining.py @@ -12,6 +12,7 @@ from unittest.mock import AsyncMock, MagicMock, patch import pytest +from openai.types.responses import ResponseOutputText from pyrit.memory import CentralMemory from pyrit.models import Message, MessagePiece @@ -57,7 +58,13 @@ def create_mock_text_response(text: str) -> MagicMock: mock_msg_section = MagicMock() mock_msg_section.type = "message" - mock_msg_section.content = [MagicMock(text=text)] + mock_msg_section.content = [ + ResponseOutputText( + annotations=[], + text=text, + type="output_text", + ) + ] mock_response.output = [mock_msg_section] return mock_response diff --git a/tests/unit/scenario/core/test_scenario_partial_results.py b/tests/unit/scenario/core/test_scenario_partial_results.py index c95fa7f2e6..9b7588a5ee 100644 --- a/tests/unit/scenario/core/test_scenario_partial_results.py +++ b/tests/unit/scenario/core/test_scenario_partial_results.py @@ -8,6 +8,7 @@ import pytest +from pyrit.exceptions import ScenarioPartialFailureException from pyrit.executor.attack.core import AttackExecutorResult from pyrit.memory import CentralMemory from pyrit.models import AttackOutcome, AttackResult, ComponentIdentifier @@ -191,6 +192,9 @@ async def mock_run(*args, **kwargs): # Verify scenario succeeded after retry assert isinstance(result, ScenarioResult) assert call_count[0] == 2 # Called twice + assert result.scenario_run_state == "COMPLETED" + assert result.error_message is None + assert result.error_type is None # All 3 results should be saved assert len(result.attack_results["partial_attack"]) == 3 @@ -202,6 +206,8 @@ async def mock_run(*args, **kwargs): async def test_scenario_saves_partial_results_before_failure(self, mock_objective_target): """Test that scenario saves partial results even when attack fails.""" atomic_attack = create_mock_atomic_attack("partial_save_attack", ["obj1", "obj2", "obj3", "obj4"]) + first_error = RuntimeError("Failed obj3") + second_error = RuntimeError("Failed obj4") async def mock_run(*args, **kwargs): # Return partial results with incomplete objectives @@ -214,7 +220,7 @@ async def mock_run(*args, **kwargs): ) for i in [1, 2] ] - incomplete = [("obj3", RuntimeError("Failed obj3")), ("obj4", RuntimeError("Failed obj4"))] + incomplete = [("obj3", first_error), ("obj4", second_error)] # Save completed results to memory save_attack_results_to_memory(completed, atomic_attack=atomic_attack) @@ -237,14 +243,24 @@ async def mock_run(*args, **kwargs): await scenario.initialize_async() # Should raise error because of incomplete objectives - with pytest.raises(ValueError, match="incomplete"): + with pytest.raises(ScenarioPartialFailureException, match="incomplete") as exc_info: await scenario.run_async() + error = exc_info.value + assert error.atomic_attack_name == "partial_save_attack" + assert error.completed_count == 2 + assert error.incomplete_count == 2 + assert error.total_count == 4 + assert error.incomplete_objectives == (("obj3", first_error), ("obj4", second_error)) + assert error.__cause__ is first_error + assert not isinstance(error, ValueError) + # But the 2 completed results should still be saved scenario_results = CentralMemory.get_memory_instance().get_scenario_results( scenario_result_ids=[scenario._scenario_result_id] ) assert len(scenario_results) == 1 + assert scenario_results[0].error_type == "ScenarioPartialFailureException" saved_results = scenario_results[0].attack_results["partial_save_attack"] assert len(saved_results) == 2 assert saved_results[0].objective == "obj1" From e11b64b09b8134f8c02b4f47e8e379336c4fb54e Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 18:51:51 -0700 Subject: [PATCH 02/18] Handle Chat Completions refusals Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- .../chat_completions_response_parser.py | 51 ++++++++++++++----- .../target/test_openai_chat_target.py | 38 +++++++++++++- 2 files changed, 75 insertions(+), 14 deletions(-) diff --git a/pyrit/prompt_target/common/chat_completions_response_parser.py b/pyrit/prompt_target/common/chat_completions_response_parser.py index 07d774cbe7..34b8ef4173 100644 --- a/pyrit/prompt_target/common/chat_completions_response_parser.py +++ b/pyrit/prompt_target/common/chat_completions_response_parser.py @@ -45,9 +45,11 @@ def detect_response_content(message: Any) -> tuple[bool, bool, bool]: message (Any): The ``response.choices[0].message`` object. Returns: - tuple[bool, bool, bool]: ``(has_content, has_audio, has_tool_calls)``. + tuple[bool, bool, bool]: ``(has_content, has_audio, has_tool_calls)``. Structured + refusals count as content because they produce a valid blocked response. """ - has_content = bool(getattr(message, "content", None)) + refusal = getattr(message, "refusal", None) + has_content = bool(getattr(message, "content", None)) or (isinstance(refusal, str) and bool(refusal)) has_audio = getattr(message, "audio", None) is not None has_tool_calls = bool(getattr(message, "tool_calls", None)) return has_content, has_audio, has_tool_calls @@ -106,6 +108,26 @@ def _build_text_piece(*, content: str, request: MessagePiece) -> MessagePiece: ).message_pieces[0] +def _build_blocked_message( + *, + response_text: str, + request: MessagePiece, + partial_content: str | None = None, +) -> Message: + error_message = handle_bad_request_exception( + response_text=response_text, + request=request, + error_code=200, + is_content_filter=True, + ) + + if partial_content: + for piece in error_message.message_pieces: + piece.prompt_metadata["partial_content"] = partial_content + + return error_message + + def _build_tool_pieces(*, message: Any, request: MessagePiece) -> list[MessagePiece]: """ Build function_call response pieces from a message's ``tool_calls``. @@ -224,9 +246,10 @@ async def build_response_pieces_async( *, response: Any, request: MessagePiece, audio_format: str = "wav" ) -> list[MessagePiece]: """ - Build all response pieces (text, audio, and tool calls) from a Chat Completions response. + Build all response pieces (refusal, text, audio, and tool calls) from a Chat Completions response. - Pieces are ordered text, then audio (transcript + file), then tool calls. + A structured refusal produces one blocked error piece. Otherwise, pieces are ordered text, + then audio (transcript + file), then tool calls. Args: response (Any): The Chat Completions response object. @@ -240,6 +263,15 @@ async def build_response_pieces_async( pieces: list[MessagePiece] = [] content = getattr(message, "content", None) + refusal = getattr(message, "refusal", None) + if isinstance(refusal, str) and refusal: + partial_content = content if isinstance(content, str) and content else None + return _build_blocked_message( + response_text=refusal, + request=request, + partial_content=partial_content, + ).message_pieces + if content: pieces.append(_build_text_piece(content=content, request=request)) @@ -431,15 +463,8 @@ def build_content_filter_message( Message: The constructed error Message with ``error="blocked"``. """ response_text = response.model_dump_json() if hasattr(response, "model_dump_json") else str(response) - error_message = handle_bad_request_exception( + return _build_blocked_message( response_text=response_text, request=request, - error_code=200, - is_content_filter=True, + partial_content=partial_content, ) - - if partial_content: - for piece in error_message.message_pieces: - piece.prompt_metadata["partial_content"] = partial_content - - return error_message diff --git a/tests/unit/prompt_target/target/test_openai_chat_target.py b/tests/unit/prompt_target/target/test_openai_chat_target.py index fa71f7e776..866ffe5f0e 100644 --- a/tests/unit/prompt_target/target/test_openai_chat_target.py +++ b/tests/unit/prompt_target/target/test_openai_chat_target.py @@ -12,7 +12,8 @@ import httpx import pytest from openai import APIStatusError, BadRequestError, ContentFilterFinishReasonError, RateLimitError -from openai.types.chat import ChatCompletion +from openai.types.chat import ChatCompletion, ChatCompletionMessage +from openai.types.chat.chat_completion import Choice from unit.mocks import ( get_image_message_piece, get_sample_conversations, @@ -539,6 +540,41 @@ async def test_send_prompt_async_content_filter_200(target: OpenAIChatTarget): assert response[0].message_pieces[0].converted_value_data_type == "error" +async def test_send_prompt_async_structured_refusal(target: OpenAIChatTarget): + refusal = "I cannot assist with that request." + completion = ChatCompletion( + id="refusal-completion", + choices=[ + Choice( + finish_reason="stop", + index=0, + logprobs=None, + message=ChatCompletionMessage( + content=None, + refusal=refusal, + role="assistant", + ), + ) + ], + created=0, + model="gpt-test", + object="chat.completion", + ) + target._async_client.chat.completions.create = AsyncMock(return_value=completion) # type: ignore[method-assign] + message = Message( + message_pieces=[MessagePiece(role="user", conversation_id="refusal-conversation", original_value="Hello")] + ) + + response = await target.send_prompt_async(message=message) + + assert len(response) == 1 + assert len(response[0].message_pieces) == 1 + refusal_piece = response[0].message_pieces[0] + assert refusal_piece.original_value_data_type == "error" + assert refusal_piece.response_error == "blocked" + assert json.loads(refusal_piece.original_value)["message"] == refusal + + def test_validate_request_unsupported_data_types(target: OpenAIChatTarget): image_piece = get_image_message_piece() image_piece.converted_value_data_type = "new_unknown_type" # type: ignore[method-assign] From 8736289f35fa98a1ec302f380991c15fb083ffd2 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Mon, 27 Jul 2026 19:00:01 -0700 Subject: [PATCH 03/18] Verify refusal attack completion Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- .../target/test_openai_response_target.py | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/tests/unit/prompt_target/target/test_openai_response_target.py b/tests/unit/prompt_target/target/test_openai_response_target.py index d34c6c261c..f664de4699 100644 --- a/tests/unit/prompt_target/target/test_openai_response_target.py +++ b/tests/unit/prompt_target/target/test_openai_response_target.py @@ -14,6 +14,7 @@ from unit.mocks import ( get_audio_message_piece, get_image_message_piece, + get_mock_target_identifier, get_sample_conversations, openai_response_json_dict, ) @@ -23,9 +24,11 @@ PyritException, RateLimitException, ) +from pyrit.executor.attack import AttackExecutor, PromptSendingAttack from pyrit.memory.memory_interface import MemoryInterface from pyrit.models import JsonResponseConfig, Message, MessagePiece, flatten_to_message_pieces from pyrit.prompt_target import OpenAIResponseTarget, PromptTarget +from pyrit.score import SelfAskRefusalScorer def create_mock_response(response_dict: dict = None) -> MagicMock: @@ -1297,6 +1300,52 @@ async def test_send_prompt_async_returns_blocked_refusal( assert json.loads(refusal_piece.original_value)["message"] == refusal +async def test_structured_refusal_is_persisted_scored_and_completes_attack(target: OpenAIResponseTarget): + refusal = "I cannot assist with that request." + output_message = ResponseOutputMessage( + id="refusal-message", + content=[ResponseOutputRefusal(refusal=refusal, type="refusal")], + role="assistant", + status="completed", + type="message", + ) + mock_response = MagicMock() + mock_response.error = None + mock_response.status = "completed" + mock_response.output = [output_message] + target._async_client.responses.create = AsyncMock(return_value=mock_response) + + results = await AttackExecutor(max_concurrency=1).execute_attack_async( + attack=PromptSendingAttack(objective_target=target), + objectives=["Test objective"], + return_partial_on_failure=True, + ) + + assert results.all_completed + assert len(results.completed_results) == 1 + attack_result = results.completed_results[0] + assert attack_result.last_response is not None + refusal_piece = attack_result.last_response + assert refusal_piece.response_error == "blocked" + assert json.loads(refusal_piece.original_value)["message"] == refusal + assert json.loads(refusal_piece.converted_value)["message"] == refusal + + persisted_messages = target._memory.get_conversation_messages(conversation_id=attack_result.conversation_id) + persisted_piece = persisted_messages[-1].get_piece() + assert persisted_piece.id == refusal_piece.id + assert json.loads(persisted_piece.original_value)["message"] == refusal + + scorer_target = MagicMock(spec=PromptTarget) + scorer_target.get_identifier.return_value = get_mock_target_identifier("RefusalScorerTarget") + scorer = SelfAskRefusalScorer(chat_target=scorer_target) + scores = await scorer.score_async(refusal_piece.to_message()) + + assert len(scores) == 1 + assert scores[0].get_value() is True + assert scores[0].score_value_description == "Refusal detected" + scorer_target.send_prompt_async.assert_not_called() + + # ── Reasoning effort / summary tests ─────────────────────────────────────── From 2e16094a4e0c62e95ac66e26e195144cd786b8ce Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 13:33:05 -0700 Subject: [PATCH 04/18] Fix refusal scoring and scenario retry states Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- .../backend/services/scenario_run_service.py | 4 +- pyrit/exceptions/exception_classes.py | 9 +- pyrit/memory/memory_interface.py | 5 +- pyrit/models/messages/message_piece.py | 35 +++++- .../chat_completions_response_parser.py | 6 + .../openai/openai_response_target.py | 26 +++- pyrit/scenario/core/scenario.py | 19 +-- pyrit/score/scorer.py | 113 +++++++++++++---- .../unit/backend/test_scenario_run_service.py | 59 ++++++--- .../test_interface_scenario_results.py | 2 +- .../target/test_openai_chat_target.py | 2 + .../target/test_openai_response_target.py | 118 ++++++++++++++++-- tests/unit/scenario/core/test_scenario.py | 9 +- .../core/test_scenario_partial_results.py | 69 +++++++++- tests/unit/score/test_scorer.py | 86 ++++++++++++- 15 files changed, 480 insertions(+), 82 deletions(-) diff --git a/pyrit/backend/services/scenario_run_service.py b/pyrit/backend/services/scenario_run_service.py index bab7d292e7..7ba66d0f43 100644 --- a/pyrit/backend/services/scenario_run_service.py +++ b/pyrit/backend/services/scenario_run_service.py @@ -173,7 +173,7 @@ async def cancel_run_async(self, *, scenario_result_id: str) -> ScenarioRunSumma return None scenario_result = results[0] - db_status = ScenarioRunState(scenario_result.scenario_run_state) + db_status = scenario_result.scenario_run_state if db_status in (ScenarioRunState.COMPLETED, ScenarioRunState.FAILED, ScenarioRunState.CANCELLED): raise ValueError(f"Cannot cancel run in '{db_status}' state.") @@ -592,7 +592,7 @@ def _build_response_from_db(self, *, scenario_result: ScenarioResult) -> Scenari if not error and active is not None: error = active.error - status = ScenarioRunState(scenario_result.scenario_run_state) + status = scenario_result.scenario_run_state # Build result fields from DB (always computed so in-progress runs show progress) total_attacks = sum(len(results) for results in scenario_result.attack_results.values()) diff --git a/pyrit/exceptions/exception_classes.py b/pyrit/exceptions/exception_classes.py index 808ecacdf4..b2aa780083 100644 --- a/pyrit/exceptions/exception_classes.py +++ b/pyrit/exceptions/exception_classes.py @@ -220,8 +220,13 @@ def __init__(self, *, status_code: int = 400, message: str = "Scorer LLM respons super().__init__(status_code=status_code, message=message) -class ScenarioPartialFailureException(PyritException): - """Exception raised when a scenario's atomic attack only partially completes.""" +class ScenarioPartialFailureException(PyritException, ValueError): # noqa: N818 + """ + Exception raised when a scenario's atomic attack only partially completes. + + ``ValueError`` remains a secondary base for compatibility with callers that + caught the legacy synthetic exception. New code should catch this dedicated type. + """ def __init__( self, diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py index a60e927ae6..95aefd70b0 100644 --- a/pyrit/memory/memory_interface.py +++ b/pyrit/memory/memory_interface.py @@ -2880,7 +2880,7 @@ def update_scenario_run_state( self, *, scenario_result_id: str, - scenario_run_state: ScenarioRunState | str, + scenario_run_state: ScenarioRunState, error_message: str | None = None, error_type: str | None = None, ) -> None: @@ -2892,8 +2892,7 @@ def update_scenario_run_state( Args: scenario_result_id (str): The ID of the scenario result to update. - scenario_run_state (ScenarioRunState | str): The new state for the scenario - (e.g., "CREATED", "IN_PROGRESS", "COMPLETED", "FAILED"). + scenario_run_state (ScenarioRunState): The new state for the scenario. error_message (str | None): Optional scenario-level error message. error_type (str | None): Optional exception class name. diff --git a/pyrit/models/messages/message_piece.py b/pyrit/models/messages/message_piece.py index 3a9ddffde6..a9a747d6bc 100644 --- a/pyrit/models/messages/message_piece.py +++ b/pyrit/models/messages/message_piece.py @@ -5,7 +5,7 @@ import uuid from datetime import datetime, timezone -from typing import TYPE_CHECKING, Any +from typing import TYPE_CHECKING, Any, ClassVar from uuid import uuid4 from pydantic import ( @@ -43,6 +43,8 @@ class MessagePiece(BaseModel): ``Message``. """ + STRUCTURED_REFUSAL_METADATA_KEY: ClassVar[str] = "structured_refusal" + model_config = ConfigDict( arbitrary_types_allowed=True, extra="forbid", @@ -166,6 +168,37 @@ def is_blocked(self) -> bool: """ return self.response_error == "blocked" + def mark_as_structured_refusal(self, *, refusal: str) -> None: + """ + Record an SDK-provided model refusal on this blocked response piece. + + Args: + refusal: The model's refusal explanation. + + Raises: + ValueError: If the piece is not a blocked assistant response or the refusal + explanation is empty. + """ + if not self.is_blocked() or self.api_role != "assistant": + raise ValueError("Structured refusals must be recorded on blocked assistant response pieces.") + if not refusal: + raise ValueError("Structured refusal text cannot be empty.") + self.prompt_metadata[self.STRUCTURED_REFUSAL_METADATA_KEY] = refusal + + def get_structured_refusal(self) -> str | None: + """ + Return the SDK-provided refusal explanation, if present. + + Returns: + The refusal explanation for a structured model refusal, otherwise ``None``. + """ + refusal = self.prompt_metadata.get(self.STRUCTURED_REFUSAL_METADATA_KEY) + return refusal if isinstance(refusal, str) and refusal else None + + def is_structured_refusal(self) -> bool: + """Return whether this piece represents an SDK-provided model refusal.""" + return self.is_blocked() and self.get_structured_refusal() is not None + # ------------------------------------------------------------------ # # Adversarial placeholder support # ------------------------------------------------------------------ # diff --git a/pyrit/prompt_target/common/chat_completions_response_parser.py b/pyrit/prompt_target/common/chat_completions_response_parser.py index 34b8ef4173..1d9694cbfd 100644 --- a/pyrit/prompt_target/common/chat_completions_response_parser.py +++ b/pyrit/prompt_target/common/chat_completions_response_parser.py @@ -113,6 +113,7 @@ def _build_blocked_message( response_text: str, request: MessagePiece, partial_content: str | None = None, + structured_refusal: str | None = None, ) -> Message: error_message = handle_bad_request_exception( response_text=response_text, @@ -125,6 +126,10 @@ def _build_blocked_message( for piece in error_message.message_pieces: piece.prompt_metadata["partial_content"] = partial_content + if structured_refusal: + for piece in error_message.message_pieces: + piece.mark_as_structured_refusal(refusal=structured_refusal) + return error_message @@ -270,6 +275,7 @@ async def build_response_pieces_async( response_text=refusal, request=request, partial_content=partial_content, + structured_refusal=refusal, ).message_pieces if content: diff --git a/pyrit/prompt_target/openai/openai_response_target.py b/pyrit/prompt_target/openai/openai_response_target.py index 17e015cc7e..b469974ad1 100644 --- a/pyrit/prompt_target/openai/openai_response_target.py +++ b/pyrit/prompt_target/openai/openai_response_target.py @@ -234,15 +234,22 @@ async def _construct_input_item_from_piece_async(self, piece: MessagePiece) -> d Convert a single inline piece into a Responses API content item. Args: - piece: The inline piece (text or image_path). + piece: The inline piece (text, image_path, or structured refusal). Returns: A dict in the Responses API content item shape. Raises: - ValueError: If the piece type is not supported for inline content. Supported types are text and - image paths. + ValueError: If the piece type is not supported for inline content. """ + structured_refusal = piece.get_structured_refusal() + if piece.is_structured_refusal() and structured_refusal: + if piece.api_role != "assistant": + raise ValueError("Structured refusals can only be serialized as assistant output.") + return { + "type": "output_text", + "text": structured_refusal, + } if piece.converted_value_data_type == "text": return { "type": "input_text" if piece.api_role in ["developer", "user"] else "output_text", @@ -307,8 +314,8 @@ async def _build_input_for_multi_modal_async(self, conversation: MutableSequence if dtype == "reasoning": continue - # Inline content (text/images) - accumulate in content list - if dtype in {"text", "image_path"}: + # Inline content (text/images/structured refusals) - accumulate in content list + if dtype in {"text", "image_path"} or piece.is_structured_refusal(): content.append(await self._construct_input_item_from_piece_async(piece)) continue @@ -569,6 +576,11 @@ async def _construct_message_from_response_async(self, response: Any, request: M continue extracted_response_pieces.append(piece) + # Consumers use the first piece as the semantic response. Responses API + # reasoning commonly precedes the actual message in provider output, so + # retain it for memory/debugging after the actionable response pieces. + extracted_response_pieces.sort(key=lambda piece: piece.converted_value_data_type == "reasoning") + return Message(message_pieces=extracted_response_pieces) @limit_requests_per_minute @@ -681,13 +693,15 @@ def _parse_response_message_content( content_item.refusal for content_item in content if isinstance(content_item, ResponseOutputRefusal) ] if refusal_parts: + refusal_text = "\n".join(refusal_parts) refusal_message = handle_bad_request_exception( - response_text="\n".join(refusal_parts), + response_text=refusal_text, request=message_piece, error_code=200, is_content_filter=True, ) refusal_piece = refusal_message.message_pieces[0] + refusal_piece.mark_as_structured_refusal(refusal=refusal_text) if text_parts: refusal_piece.prompt_metadata["partial_content"] = "\n".join(text_parts) return refusal_piece diff --git a/pyrit/scenario/core/scenario.py b/pyrit/scenario/core/scenario.py index 8bf0588ce1..20ba8c8503 100644 --- a/pyrit/scenario/core/scenario.py +++ b/pyrit/scenario/core/scenario.py @@ -1029,10 +1029,13 @@ async def run_async(self) -> ScenarioResult: >>> print(f"Total results: {len(result.attack_results)}") """ if not self._atomic_attacks: - raise ValueError( + error = ValueError( "Cannot run scenario with no atomic attacks. Either supply them in initialization or " "call await scenario.initialize_async() first." ) + if self._scenario_result_id: + self._mark_scenario_failed(scenario_result_id=self._scenario_result_id, error=error) + raise error if not self._scenario_result_id: raise ValueError("Scenario not properly initialized. Call await scenario.initialize_async() first.") @@ -1069,6 +1072,7 @@ async def run_async(self) -> ScenarioResult: f"(initial + {self._max_retries} retries) with error: {str(e)}. Giving up.", exc_info=True, ) + self._mark_scenario_failed(scenario_result_id=scenario_result_id, error=e) raise # This should never be reached, but just in case @@ -1111,6 +1115,12 @@ async def _execute_scenario_async(self) -> ScenarioResult: else: raise ValueError(f"Scenario result with ID {scenario_result_id} not found") + # Mark scenario as in progress + self._memory.update_scenario_run_state( + scenario_result_id=scenario_result_id, + scenario_run_state=ScenarioRunState.IN_PROGRESS, + ) + # Get remaining atomic attacks (filters out completed ones and updates objectives) remaining_attacks = await self._get_remaining_atomic_attacks_async() @@ -1132,12 +1142,6 @@ async def _execute_scenario_async(self) -> ScenarioResult: f"with remaining objectives (out of {len(self._atomic_attacks)} total)" ) - # Mark scenario as in progress - self._memory.update_scenario_run_state( - scenario_result_id=scenario_result_id, - scenario_run_state=ScenarioRunState.IN_PROGRESS, - ) - # Calculate starting index based on completed attacks completed_count = len(self._atomic_attacks) - len(remaining_attacks) @@ -1309,7 +1313,6 @@ async def worker_async() -> None: if len(errors) == 1 else ExceptionGroup(f"Multiple atomic attacks failed in scenario '{self._name}'", errors) ) - self._mark_scenario_failed(scenario_result_id=scenario_result_id, error=final_error) raise final_error def _collect_errors_from_outcomes( diff --git a/pyrit/score/scorer.py b/pyrit/score/scorer.py index 7301959ecf..807791aaab 100644 --- a/pyrit/score/scorer.py +++ b/pyrit/score/scorer.py @@ -22,6 +22,7 @@ Identifiable, Message, MessagePiece, + PromptResponseError, Score, ScorerEvaluationIdentifier, ScorerIdentifier, @@ -222,8 +223,9 @@ async def score_async( Use "assistant" to score only real assistant responses, or "simulated_assistant" to score only simulated responses. Defaults to None (no filtering). skip_on_error_result (bool): If True, skip scoring if the message contains an error. - When self.score_blocked_content is also True, blocked responses with partial content - will still be scored instead of skipping. Defaults to False. + SDK-provided structured refusals remain scoreable. When self.score_blocked_content + is also True, blocked responses with partial content will still be scored instead + of skipping. Defaults to False. infer_objective_from_request (bool): If True, infer the objective from the message's previous request when objective is not provided. Defaults to False. @@ -243,21 +245,33 @@ async def score_async( return [] if skip_on_error_result and message.is_error(): + error_pieces = [ + piece + for piece in message.message_pieces + if piece.has_error() or piece.converted_value_data_type == "error" + ] + only_structured_refusals = all(piece.is_structured_refusal() for piece in error_pieces) # When score_blocked_content is enabled and the message has partial content, # don't skip — let _score_async handle the substitution. - has_partial = any( - p.prompt_metadata.get("partial_content") for p in message.message_pieces if p.is_blocked() + all_errors_have_partial_content = all( + piece.is_blocked() and piece.prompt_metadata.get("partial_content") for piece in error_pieces ) - if not (self.score_blocked_content and has_partial): + if not only_structured_refusals and not (self.score_blocked_content and all_errors_have_partial_content): logger.debug("Skipping scoring due to error in message and skip_on_error=True.") return [] if infer_objective_from_request and (not objective): objective = self._extract_objective_from_response(message) - # When score_blocked_content is enabled, create a modified message where blocked pieces - # with partial content are replaced with text-type substitutes (response_error="none"). - scoring_message = self._apply_blocked_content_substitution(message) if self.score_blocked_content else message + # Structured refusals are persisted as blocked error pieces, but scorers should + # receive the refusal explanation as text. Keep response_error="blocked" so + # refusal scorers can still use their deterministic blocked-response path. + scoring_message = self._apply_structured_refusal_substitution(message) + + # When score_blocked_content is enabled, blocked pieces with partial content + # take precedence and are replaced with text substitutes (response_error="none"). + if self.score_blocked_content: + scoring_message = self._apply_blocked_content_substitution(scoring_message) try: scores = await self._score_async( @@ -348,7 +362,37 @@ async def _score_piece_async(self, message_piece: MessagePiece, *, objective: st raise NotImplementedError @staticmethod - def _create_text_piece_from_blocked(piece: MessagePiece) -> MessagePiece | None: + def _create_scoring_text_piece( + *, + piece: MessagePiece, + content: str, + response_error: PromptResponseError, + ) -> MessagePiece: + """ + Create a text-typed scoring view that retains the persisted piece identity. + + Returns: + A text piece for scorer consumption. + """ + return MessagePiece( + id=piece.id, + role=piece.api_role, + original_value=piece.original_value, + converted_value=content, + original_value_data_type=piece.original_value_data_type, + converted_value_data_type="text", + conversation_id=piece.conversation_id, + sequence=piece.sequence, + prompt_metadata=dict(piece.prompt_metadata), + converter_identifiers=list(piece.converter_identifiers), # type: ignore[arg-type] + response_error=response_error, + timestamp=piece.timestamp, + original_prompt_id=piece.original_prompt_id, + not_in_memory=piece.not_in_memory, + ) + + @classmethod + def _create_text_piece_from_blocked(cls, piece: MessagePiece) -> MessagePiece | None: """ Create a text-typed copy of a blocked MessagePiece using its partial content. @@ -367,21 +411,48 @@ def _create_text_piece_from_blocked(piece: MessagePiece) -> MessagePiece | None: if not partial_content: return None - return MessagePiece( - id=piece.id, - role=piece.api_role, - original_value=piece.original_value, - converted_value=partial_content, - original_value_data_type=piece.original_value_data_type, - converted_value_data_type="text", - conversation_id=piece.conversation_id, - sequence=piece.sequence, - prompt_metadata=piece.prompt_metadata, - converter_identifiers=list(piece.converter_identifiers), # type: ignore[arg-type] + return cls._create_scoring_text_piece( + piece=piece, + content=partial_content, response_error="none", - timestamp=piece.timestamp, ) + @classmethod + def _create_text_piece_from_structured_refusal(cls, piece: MessagePiece) -> MessagePiece | None: + """ + Create a blocked text scoring view for an SDK-provided structured refusal. + + Returns: + A text scoring view, or ``None`` when the piece is not a structured refusal. + """ + refusal = piece.get_structured_refusal() + if not piece.is_structured_refusal() or not refusal: + return None + return cls._create_scoring_text_piece( + piece=piece, + content=refusal, + response_error="blocked", + ) + + def _apply_structured_refusal_substitution(self, message: Message) -> Message: + """ + Expose structured refusal explanations as text while preserving blocked semantics. + + Returns: + A scoring message with structured refusals substituted, or the original message. + """ + substituted = False + new_pieces: list[MessagePiece] = [] + for piece in message.message_pieces: + substitute = self._create_text_piece_from_structured_refusal(piece) + if substitute: + new_pieces.append(substitute) + substituted = True + continue + new_pieces.append(piece) + + return Message(message_pieces=new_pieces) if substituted else message + def _apply_blocked_content_substitution(self, message: Message) -> Message: """ Create a copy of the message where blocked pieces with partial content are substituted. diff --git a/tests/unit/backend/test_scenario_run_service.py b/tests/unit/backend/test_scenario_run_service.py index a62b05734d..8ce480c62f 100644 --- a/tests/unit/backend/test_scenario_run_service.py +++ b/tests/unit/backend/test_scenario_run_service.py @@ -17,10 +17,11 @@ ScenarioRunService, ) from pyrit.converter import Converter -from pyrit.models import AttackOutcome, ScenarioRunState +from pyrit.models import AttackOutcome, ScenarioResult, ScenarioRunState from pyrit.models.catalog.scenario import RunScenarioRequest from pyrit.scenario.core import DatasetAttackConfiguration, DatasetConfiguration from pyrit.scenario.core.scenario_technique import ScenarioTechnique +from unit.mocks import make_scenario_result class _StubTechnique(ScenarioTechnique): @@ -84,11 +85,11 @@ def _make_db_scenario_result( *, result_id: str = "sr-uuid-1", scenario_name: str = "foundry.red_team_agent", - run_state: str = "IN_PROGRESS", + run_state: ScenarioRunState = ScenarioRunState.IN_PROGRESS, attack_results: dict | None = None, ) -> MagicMock: """Create a mock ScenarioResult as returned by CentralMemory.""" - sr = MagicMock() + sr = MagicMock(spec=ScenarioResult) sr.id = result_id sr.scenario_name = scenario_name sr.scenario_version = 1 @@ -553,7 +554,7 @@ def test_get_run_returns_none_for_unknown_id(self, mock_memory) -> None: def test_get_run_returns_existing_run(self, mock_memory) -> None: """Test that get_run returns a run from the database.""" - db_result = _make_db_scenario_result(result_id="sr-123", run_state="IN_PROGRESS") + db_result = _make_db_scenario_result(result_id="sr-123", run_state=ScenarioRunState.IN_PROGRESS) mock_memory.get_scenario_results.return_value = [db_result] service = ScenarioRunService() @@ -564,6 +565,25 @@ def test_get_run_returns_existing_run(self, mock_memory) -> None: assert fetched.scenario_name == "foundry.red_team_agent" assert fetched.status == ScenarioRunState.IN_PROGRESS + def test_get_run_maps_typed_scenario_result_state(self, mock_memory) -> None: + """Test the service boundary with a real ScenarioResult domain model.""" + db_result = make_scenario_result( + scenario_name="foundry.red_team_agent", + attack_results={}, + scenario_run_state=ScenarioRunState.FAILED, + error_message="Scenario failed", + error_type="RuntimeError", + ) + mock_memory.get_scenario_results.return_value = [db_result] + + service = ScenarioRunService() + fetched = service.get_run(scenario_result_id=str(db_result.id)) + + assert fetched is not None + assert fetched.status is ScenarioRunState.FAILED + assert fetched.error == "Scenario failed" + assert fetched.error_type == "RuntimeError" + def test_get_run_falls_back_to_persisted_error(self, mock_memory) -> None: """Test that get_run extracts error from persisted error AttackResult when no active task. @@ -572,7 +592,7 @@ def test_get_run_falls_back_to_persisted_error(self, mock_memory) -> None: ``get_attack_results(scenario_result_id=..., outcome=ERROR)`` rather than via a per-scenario error_attack_result_ids manifest. """ - db_result = _make_db_scenario_result(result_id="sr-fail", run_state="FAILED") + db_result = _make_db_scenario_result(result_id="sr-fail", run_state=ScenarioRunState.FAILED) # Mock the error AttackResult lookup error_ar = MagicMock() @@ -607,8 +627,8 @@ def test_list_runs_empty(self, mock_memory) -> None: def test_list_runs_returns_all_runs(self, mock_memory) -> None: """Test that list_runs returns all runs from the database.""" db_results = [ - _make_db_scenario_result(result_id="sr-1", run_state="COMPLETED"), - _make_db_scenario_result(result_id="sr-2", run_state="IN_PROGRESS"), + _make_db_scenario_result(result_id="sr-1", run_state=ScenarioRunState.COMPLETED), + _make_db_scenario_result(result_id="sr-2", run_state=ScenarioRunState.IN_PROGRESS), ] mock_memory.get_scenario_results.return_value = db_results @@ -643,7 +663,10 @@ async def test_cancel_run_sets_cancelled_status(self, mock_all_registries) -> No # After update_scenario_run_state, the next DB query should return CANCELLED running_result = mock_all_registries["db_result"] - cancelled_result = _make_db_scenario_result(result_id=response.scenario_result_id, run_state="CANCELLED") + cancelled_result = _make_db_scenario_result( + result_id=response.scenario_result_id, + run_state=ScenarioRunState.CANCELLED, + ) mock_memory.get_scenario_results.side_effect = [[running_result], [cancelled_result]] result = await service.cancel_run_async(scenario_result_id=response.scenario_result_id) @@ -659,7 +682,7 @@ async def test_cancel_run_sets_cancelled_status(self, mock_all_registries) -> No async def test_cancel_completed_run_raises_value_error(self, mock_memory) -> None: """Test that cancelling a completed run raises ValueError.""" - db_result = _make_db_scenario_result(result_id="sr-done", run_state="COMPLETED") + db_result = _make_db_scenario_result(result_id="sr-done", run_state=ScenarioRunState.COMPLETED) mock_memory.get_scenario_results.return_value = [db_result] service = ScenarioRunService() @@ -668,7 +691,7 @@ async def test_cancel_completed_run_raises_value_error(self, mock_memory) -> Non async def test_cancel_already_cancelled_run_raises_value_error(self, mock_memory) -> None: """Test that cancelling an already-cancelled run raises ValueError.""" - db_result = _make_db_scenario_result(result_id="sr-cancelled", run_state="CANCELLED") + db_result = _make_db_scenario_result(result_id="sr-cancelled", run_state=ScenarioRunState.CANCELLED) mock_memory.get_scenario_results.return_value = [db_result] service = ScenarioRunService() @@ -748,7 +771,7 @@ def test_get_results_returns_none_for_unknown_id(self, mock_memory) -> None: def test_get_results_raises_if_not_completed(self, mock_memory) -> None: """Test that get_run_results raises ValueError if run is not completed.""" - db_result = _make_db_scenario_result(result_id="sr-running", run_state="IN_PROGRESS") + db_result = _make_db_scenario_result(result_id="sr-running", run_state=ScenarioRunState.IN_PROGRESS) mock_memory.get_scenario_results.return_value = [db_result] service = ScenarioRunService() @@ -765,7 +788,7 @@ def test_get_results_returns_details_for_completed_run(self, mock_memory) -> Non db_result = _make_db_scenario_result( result_id="sr-123", - run_state="COMPLETED", + run_state=ScenarioRunState.COMPLETED, attack_results={"base64_attack": [mock_attack_result]}, ) db_result.objective_achieved_rate.return_value = 100 @@ -794,7 +817,7 @@ def test_in_progress_run_shows_partial_attack_counts(self, mock_memory) -> None: db_result = _make_db_scenario_result( result_id="sr-running", - run_state="IN_PROGRESS", + run_state=ScenarioRunState.IN_PROGRESS, attack_results={ "attack_a": [mock_success, mock_failure], "attack_b": [mock_undetermined], @@ -818,7 +841,7 @@ def test_created_run_shows_zero_counts(self, mock_memory) -> None: """Test that a CREATED run with no results shows zero counts.""" db_result = _make_db_scenario_result( result_id="sr-new", - run_state="CREATED", + run_state=ScenarioRunState.CREATED, attack_results={}, ) mock_memory.get_scenario_results.return_value = [db_result] @@ -841,7 +864,7 @@ def test_completed_run_still_shows_full_counts(self, mock_memory) -> None: db_result = _make_db_scenario_result( result_id="sr-done", - run_state="COMPLETED", + run_state=ScenarioRunState.COMPLETED, attack_results={"attack_a": [mock_success]}, ) db_result.get_techniques_used.return_value = ["attack_a"] @@ -878,7 +901,7 @@ def test_error_attacks_and_retries_are_surfaced(self, mock_memory) -> None: db_result = _make_db_scenario_result( result_id="sr-mixed", - run_state="COMPLETED", + run_state=ScenarioRunState.COMPLETED, attack_results={"baseline_airt_hate": [success, errored]}, ) db_result.objective_achieved_rate.return_value = 50 @@ -906,7 +929,7 @@ def test_no_failed_attacks_when_all_succeed(self, mock_memory) -> None: db_result = _make_db_scenario_result( result_id="sr-clean", - run_state="COMPLETED", + run_state=ScenarioRunState.COMPLETED, attack_results={"attack_a": [success]}, ) mock_memory.get_scenario_results.return_value = [db_result] @@ -940,7 +963,7 @@ def test_retry_events_surface_per_attack(self, mock_memory) -> None: db_result = _make_db_scenario_result( result_id="sr-retry", - run_state="COMPLETED", + run_state=ScenarioRunState.COMPLETED, attack_results={"baseline_airt_hate": [attack]}, ) mock_memory.get_scenario_results.return_value = [db_result] diff --git a/tests/unit/memory/memory_interface/test_interface_scenario_results.py b/tests/unit/memory/memory_interface/test_interface_scenario_results.py index ddb35182ef..99a5b9326e 100644 --- a/tests/unit/memory/memory_interface/test_interface_scenario_results.py +++ b/tests/unit/memory/memory_interface/test_interface_scenario_results.py @@ -865,7 +865,7 @@ def test_update_scenario_run_state_updates_state_and_error_fields( # State and error fields updated. [hydrated] = sqlite_instance.get_scenario_results(scenario_result_ids=[sid]) - assert hydrated.scenario_run_state == "FAILED" + assert hydrated.scenario_run_state == ScenarioRunState.FAILED assert hydrated.error_message == "boom" assert hydrated.error_type == "RuntimeError" diff --git a/tests/unit/prompt_target/target/test_openai_chat_target.py b/tests/unit/prompt_target/target/test_openai_chat_target.py index 866ffe5f0e..c9b7d4b4af 100644 --- a/tests/unit/prompt_target/target/test_openai_chat_target.py +++ b/tests/unit/prompt_target/target/test_openai_chat_target.py @@ -538,6 +538,7 @@ async def test_send_prompt_async_content_filter_200(target: OpenAIChatTarget): assert len(response[0].message_pieces) == 1 assert response[0].message_pieces[0].response_error == "blocked" assert response[0].message_pieces[0].converted_value_data_type == "error" + assert not response[0].message_pieces[0].is_structured_refusal() async def test_send_prompt_async_structured_refusal(target: OpenAIChatTarget): @@ -573,6 +574,7 @@ async def test_send_prompt_async_structured_refusal(target: OpenAIChatTarget): assert refusal_piece.original_value_data_type == "error" assert refusal_piece.response_error == "blocked" assert json.loads(refusal_piece.original_value)["message"] == refusal + assert refusal_piece.get_structured_refusal() == refusal def test_validate_request_unsupported_data_types(target: OpenAIChatTarget): diff --git a/tests/unit/prompt_target/target/test_openai_response_target.py b/tests/unit/prompt_target/target/test_openai_response_target.py index f664de4699..d219d4c863 100644 --- a/tests/unit/prompt_target/target/test_openai_response_target.py +++ b/tests/unit/prompt_target/target/test_openai_response_target.py @@ -24,11 +24,11 @@ PyritException, RateLimitException, ) -from pyrit.executor.attack import AttackExecutor, PromptSendingAttack +from pyrit.executor.attack import AttackExecutor, AttackScoringConfig, PromptSendingAttack from pyrit.memory.memory_interface import MemoryInterface -from pyrit.models import JsonResponseConfig, Message, MessagePiece, flatten_to_message_pieces +from pyrit.models import AttackOutcome, JsonResponseConfig, Message, MessagePiece, flatten_to_message_pieces from pyrit.prompt_target import OpenAIResponseTarget, PromptTarget -from pyrit.score import SelfAskRefusalScorer +from pyrit.score import SelfAskRefusalScorer, TrueFalseInverterScorer def create_mock_response(response_dict: dict = None) -> MagicMock: @@ -773,6 +773,40 @@ async def test_build_input_for_multi_modal_async_filters_reasoning(target: OpenA assert result[2]["content"][0]["text"] == "Hello indeed" +async def test_build_input_for_multi_modal_async_serializes_structured_refusal(target: OpenAIResponseTarget): + refusal = "I cannot assist with that request." + refusal_piece = MessagePiece( + role="assistant", + original_value='{"status_code":200,"message":"refusal"}', + original_value_data_type="error", + converted_value_data_type="error", + response_error="blocked", + ) + refusal_piece.mark_as_structured_refusal(refusal=refusal) + + result = await target._build_input_for_multi_modal_async([Message(message_pieces=[refusal_piece])]) + + assert result == [ + { + "role": "assistant", + "content": [{"type": "output_text", "text": refusal}], + } + ] + + +async def test_build_input_for_multi_modal_async_rejects_generic_error(target: OpenAIResponseTarget): + error_piece = MessagePiece( + role="assistant", + original_value="transport failed", + original_value_data_type="error", + converted_value_data_type="error", + response_error="processing", + ) + + with pytest.raises(ValueError, match="Unsupported data type 'error'"): + await target._build_input_for_multi_modal_async([Message(message_pieces=[error_piece])]) + + # New pytests async def test_build_input_for_multi_modal_async_system_message_maps_to_developer(target: OpenAIResponseTarget): system_piece = MessagePiece( @@ -1298,6 +1332,7 @@ async def test_send_prompt_async_returns_blocked_refusal( assert refusal_piece.original_value_data_type == "error" assert refusal_piece.response_error == "blocked" assert json.loads(refusal_piece.original_value)["message"] == refusal + assert refusal_piece.get_structured_refusal() == refusal async def test_structured_refusal_is_persisted_scored_and_completes_attack(target: OpenAIResponseTarget): @@ -1315,8 +1350,15 @@ async def test_structured_refusal_is_persisted_scored_and_completes_attack(targe mock_response.output = [output_message] target._async_client.responses.create = AsyncMock(return_value=mock_response) + scorer_target = MagicMock(spec=PromptTarget) + scorer_target.get_identifier.return_value = get_mock_target_identifier("RefusalScorerTarget") + refusal_scorer = SelfAskRefusalScorer(chat_target=scorer_target) + objective_scorer = TrueFalseInverterScorer(scorer=refusal_scorer) results = await AttackExecutor(max_concurrency=1).execute_attack_async( - attack=PromptSendingAttack(objective_target=target), + attack=PromptSendingAttack( + objective_target=target, + attack_scoring_config=AttackScoringConfig(objective_scorer=objective_scorer), + ), objectives=["Test objective"], return_partial_on_failure=True, ) @@ -1329,23 +1371,75 @@ async def test_structured_refusal_is_persisted_scored_and_completes_attack(targe assert refusal_piece.response_error == "blocked" assert json.loads(refusal_piece.original_value)["message"] == refusal assert json.loads(refusal_piece.converted_value)["message"] == refusal + assert refusal_piece.get_structured_refusal() == refusal + assert attack_result.last_score is not None + assert attack_result.last_score.get_value() is False + assert attack_result.outcome == AttackOutcome.FAILURE persisted_messages = target._memory.get_conversation_messages(conversation_id=attack_result.conversation_id) persisted_piece = persisted_messages[-1].get_piece() assert persisted_piece.id == refusal_piece.id assert json.loads(persisted_piece.original_value)["message"] == refusal + assert persisted_piece.get_structured_refusal() == refusal - scorer_target = MagicMock(spec=PromptTarget) - scorer_target.get_identifier.return_value = get_mock_target_identifier("RefusalScorerTarget") - scorer = SelfAskRefusalScorer(chat_target=scorer_target) - scores = await scorer.score_async(refusal_piece.to_message()) - - assert len(scores) == 1 - assert scores[0].get_value() is True - assert scores[0].score_value_description == "Refusal detected" scorer_target.send_prompt_async.assert_not_called() +async def test_reasoning_preceding_refusal_keeps_refusal_as_primary_response( + target: OpenAIResponseTarget, dummy_text_message_piece: MessagePiece +): + reasoning = MagicMock() + reasoning.type = "reasoning" + reasoning.model_dump.return_value = { + "type": "reasoning", + "summary": [{"type": "summary_text", "text": "Reasoning summary."}], + } + refusal = "I cannot assist with that request." + output_message = ResponseOutputMessage( + id="refusal-message", + content=[ResponseOutputRefusal(refusal=refusal, type="refusal")], + role="assistant", + status="completed", + type="message", + ) + mock_response = MagicMock(error=None, status="completed", output=[reasoning, output_message]) + request = Message(message_pieces=[dummy_text_message_piece]) + + with patch.object(target._async_client.responses, "create", new=AsyncMock(return_value=mock_response)): + responses = await target.send_prompt_async(message=request) + + pieces = responses[0].message_pieces + assert pieces[0].get_structured_refusal() == refusal + assert pieces[1].converted_value_data_type == "reasoning" + + +async def test_reasoning_preceding_text_keeps_text_as_primary_response( + target: OpenAIResponseTarget, dummy_text_message_piece: MessagePiece +): + reasoning = MagicMock() + reasoning.type = "reasoning" + reasoning.model_dump.return_value = { + "type": "reasoning", + "summary": [{"type": "summary_text", "text": "Reasoning summary."}], + } + output_message = ResponseOutputMessage( + id="text-message", + content=[ResponseOutputText(annotations=[], text="Final answer", type="output_text")], + role="assistant", + status="completed", + type="message", + ) + mock_response = MagicMock(error=None, status="completed", output=[reasoning, output_message]) + request = Message(message_pieces=[dummy_text_message_piece]) + + with patch.object(target._async_client.responses, "create", new=AsyncMock(return_value=mock_response)): + responses = await target.send_prompt_async(message=request) + + pieces = responses[0].message_pieces + assert pieces[0].converted_value == "Final answer" + assert pieces[1].converted_value_data_type == "reasoning" + + # ── Reasoning effort / summary tests ─────────────────────────────────────── diff --git a/tests/unit/scenario/core/test_scenario.py b/tests/unit/scenario/core/test_scenario.py index 3b6bd98d9b..73dbc5a048 100644 --- a/tests/unit/scenario/core/test_scenario.py +++ b/tests/unit/scenario/core/test_scenario.py @@ -16,7 +16,7 @@ from pyrit.executor.attack.core import AttackExecutorResult from pyrit.memory import CentralMemory -from pyrit.models import AttackOutcome, AttackResult, ComponentIdentifier +from pyrit.models import AttackOutcome, AttackResult, ComponentIdentifier, ScenarioRunState from pyrit.scenario import ( DatasetAttackConfiguration, DatasetConfiguration, @@ -899,6 +899,13 @@ async def test_empty_techniques_without_baseline_allows_initialization(self, moc with pytest.raises(ValueError, match="Cannot run scenario with no atomic attacks"): await scenario.run_async() + scenario_results = CentralMemory.get_memory_instance().get_scenario_results( + scenario_result_ids=[scenario._scenario_result_id] + ) + assert scenario_results[0].scenario_run_state == ScenarioRunState.FAILED + assert scenario_results[0].error_type == "ValueError" + assert "Cannot run scenario with no atomic attacks" in scenario_results[0].error_message + async def test_standalone_baseline_uses_dataset_config_seeds(self, mock_objective_target): """Test that standalone baseline uses seed groups from dataset_config.""" from pyrit.models import AttackSeedGroup, SeedObjective diff --git a/tests/unit/scenario/core/test_scenario_partial_results.py b/tests/unit/scenario/core/test_scenario_partial_results.py index 9b7588a5ee..04ab58bfb7 100644 --- a/tests/unit/scenario/core/test_scenario_partial_results.py +++ b/tests/unit/scenario/core/test_scenario_partial_results.py @@ -4,14 +4,14 @@ """Additional tests for Scenario retry with AttackExecutorResult functionality.""" from typing import ClassVar -from unittest.mock import MagicMock, PropertyMock +from unittest.mock import AsyncMock, MagicMock, PropertyMock, patch import pytest from pyrit.exceptions import ScenarioPartialFailureException from pyrit.executor.attack.core import AttackExecutorResult from pyrit.memory import CentralMemory -from pyrit.models import AttackOutcome, AttackResult, ComponentIdentifier +from pyrit.models import AttackOutcome, AttackResult, ComponentIdentifier, ScenarioRunState from pyrit.scenario import DatasetConfiguration, ScenarioResult from pyrit.scenario.core import AtomicAttack, BaselineAttackPolicy, Scenario, ScenarioTechnique @@ -187,14 +187,25 @@ async def mock_run(*args, **kwargs): ) await scenario.initialize_async() - result = await scenario.run_async() + with patch.object( + scenario._memory, + "update_scenario_run_state", + wraps=scenario._memory.update_scenario_run_state, + ) as update_state: + result = await scenario.run_async() # Verify scenario succeeded after retry assert isinstance(result, ScenarioResult) assert call_count[0] == 2 # Called twice - assert result.scenario_run_state == "COMPLETED" + assert result.scenario_run_state == ScenarioRunState.COMPLETED assert result.error_message is None assert result.error_type is None + observed_states = [call.kwargs["scenario_run_state"] for call in update_state.call_args_list] + assert observed_states == [ + ScenarioRunState.IN_PROGRESS, + ScenarioRunState.IN_PROGRESS, + ScenarioRunState.COMPLETED, + ] # All 3 results should be saved assert len(result.attack_results["partial_attack"]) == 3 @@ -253,19 +264,67 @@ async def mock_run(*args, **kwargs): assert error.total_count == 4 assert error.incomplete_objectives == (("obj3", first_error), ("obj4", second_error)) assert error.__cause__ is first_error - assert not isinstance(error, ValueError) + assert type(error) is ScenarioPartialFailureException + assert isinstance(error, ValueError) # But the 2 completed results should still be saved scenario_results = CentralMemory.get_memory_instance().get_scenario_results( scenario_result_ids=[scenario._scenario_result_id] ) assert len(scenario_results) == 1 + assert scenario_results[0].scenario_run_state == ScenarioRunState.FAILED assert scenario_results[0].error_type == "ScenarioPartialFailureException" saved_results = scenario_results[0].attack_results["partial_save_attack"] assert len(saved_results) == 2 assert saved_results[0].objective == "obj1" assert saved_results[1].objective == "obj2" + async def test_failure_before_worker_retries_before_marking_failed(self, mock_objective_target): + atomic_attack = create_mock_atomic_attack("never_started", ["obj1"]) + failure = RuntimeError("Failed before worker execution") + scenario = ConcreteScenario( + name="Test Scenario", + version=1, + atomic_attacks_to_return=[atomic_attack], + ) + scenario.set_params_from_args( + args={ + "objective_target": mock_objective_target, + "max_retries": 1, + } + ) + await scenario.initialize_async() + + with ( + patch.object( + scenario, + "_get_remaining_atomic_attacks_async", + new=AsyncMock(side_effect=failure), + ), + patch.object( + scenario._memory, + "update_scenario_run_state", + wraps=scenario._memory.update_scenario_run_state, + ) as update_state, + ): + with pytest.raises(RuntimeError, match="before worker execution"): + await scenario.run_async() + + observed_states = [call.kwargs["scenario_run_state"] for call in update_state.call_args_list] + assert observed_states == [ + ScenarioRunState.IN_PROGRESS, + ScenarioRunState.IN_PROGRESS, + ScenarioRunState.FAILED, + ] + atomic_attack.run_async.assert_not_called() + + scenario_results = CentralMemory.get_memory_instance().get_scenario_results( + scenario_result_ids=[scenario._scenario_result_id] + ) + assert scenario_results[0].scenario_run_state == ScenarioRunState.FAILED + assert scenario_results[0].error_message == str(failure) + assert scenario_results[0].error_type == "RuntimeError" + async def test_scenario_resumes_with_only_incomplete_objectives(self, mock_objective_target): """Test that on retry, scenario only passes incomplete objectives to atomic attack.""" atomic_attack = create_mock_atomic_attack("resume_attack", ["obj1", "obj2", "obj3", "obj4", "obj5"]) diff --git a/tests/unit/score/test_scorer.py b/tests/unit/score/test_scorer.py index efdfe781a3..c2407e61aa 100644 --- a/tests/unit/score/test_scorer.py +++ b/tests/unit/score/test_scorer.py @@ -1956,12 +1956,17 @@ async def _score_piece_async(self, message_piece: MessagePiece, *, objective: st ] -def _make_blocked_piece(*, partial_content: str | None = None, conversation_id: str = "test-convo") -> MessagePiece: +def _make_blocked_piece( + *, + partial_content: str | None = None, + structured_refusal: str | None = None, + conversation_id: str = "test-convo", +) -> MessagePiece: """Create a blocked MessagePiece, optionally with partial content metadata.""" metadata: dict = {} if partial_content is not None: metadata["partial_content"] = partial_content - return MessagePiece( + piece = MessagePiece( role="assistant", original_value='{"status_code": 200, "message": "content_filter"}', converted_value='{"status_code": 200, "message": "content_filter"}', @@ -1971,6 +1976,9 @@ def _make_blocked_piece(*, partial_content: str | None = None, conversation_id: response_error="blocked", prompt_metadata=metadata, ) + if structured_refusal: + piece.mark_as_structured_refusal(refusal=structured_refusal) + return piece def _make_normal_piece(*, conversation_id: str = "test-convo") -> MessagePiece: @@ -2028,6 +2036,22 @@ def test_response_error_is_none_not_blocked(self): assert not substitute.has_error() +class TestCreateTextPieceFromStructuredRefusal: + def test_returns_blocked_text_piece_with_refusal_explanation(self): + piece = _make_blocked_piece(structured_refusal="I cannot assist with that request.") + + substitute = Scorer._create_text_piece_from_structured_refusal(piece) + + assert substitute is not None + assert substitute.converted_value == "I cannot assist with that request." + assert substitute.converted_value_data_type == "text" + assert substitute.response_error == "blocked" + assert substitute.id == piece.id + + def test_returns_none_for_generic_blocked_response(self): + assert Scorer._create_text_piece_from_structured_refusal(_make_blocked_piece()) is None + + # ── score_async with score_blocked_content tests ───────────────────────────── @@ -2150,6 +2174,64 @@ async def test_skip_on_error_true_with_flag_still_skips_when_no_partial_content( scores = await scorer.score_async(msg, skip_on_error_result=True) assert scores == [] + async def test_skip_on_error_skips_error_type_without_response_error_flag(self): + scorer = _BlockedContentScorer() + msg = Message( + message_pieces=[ + MessagePiece( + role="assistant", + original_value="transport failed", + original_value_data_type="error", + converted_value_data_type="error", + response_error="none", + ) + ] + ) + + scores = await scorer.score_async(msg, skip_on_error_result=True) + + assert scores == [] + assert scorer.scored_pieces == [] + + async def test_skip_on_error_scores_structured_refusal_as_text(self): + scorer = _BlockedContentScorer() + refusal = "I cannot assist with that request." + piece = _make_blocked_piece(structured_refusal=refusal) + msg = Message(message_pieces=[piece]) + + scores = await scorer.score_async(msg, skip_on_error_result=True) + + assert len(scores) == 1 + assert scorer.scored_pieces[0].id == piece.id + assert scorer.scored_pieces[0].converted_value == refusal + assert scorer.scored_pieces[0].converted_value_data_type == "text" + assert scorer.scored_pieces[0].response_error == "blocked" + + async def test_skip_on_error_still_skips_mixed_structured_and_runtime_errors(self): + scorer = _BlockedContentScorer() + scorer.score_blocked_content = True + msg = Message( + message_pieces=[ + _make_blocked_piece( + partial_content="Partial content", + structured_refusal="I cannot assist.", + ), + MessagePiece( + role="assistant", + original_value="transport failed", + original_value_data_type="error", + converted_value_data_type="error", + conversation_id="test-convo", + response_error="processing", + ), + ] + ) + + scores = await scorer.score_async(msg, skip_on_error_result=True) + + assert scores == [] + assert scorer.scored_pieces == [] + # ── score_response_async passthrough tests ─────────────────────────────────── From 603dbe19b102e0717f31713581bfc6e7f2e75730 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 13:52:36 -0700 Subject: [PATCH 05/18] Add scenario refusal regressions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- .../scenario/core/test_scenario_refusals.py | 278 ++++++++++++++++++ 1 file changed, 278 insertions(+) create mode 100644 tests/unit/scenario/core/test_scenario_refusals.py diff --git a/tests/unit/scenario/core/test_scenario_refusals.py b/tests/unit/scenario/core/test_scenario_refusals.py new file mode 100644 index 0000000000..24f360a3a2 --- /dev/null +++ b/tests/unit/scenario/core/test_scenario_refusals.py @@ -0,0 +1,278 @@ +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT license. + +from collections.abc import Sequence +from typing import ClassVar +from unittest.mock import AsyncMock, MagicMock + +import pytest +from openai.types.chat import ChatCompletion, ChatCompletionMessage +from openai.types.chat.chat_completion import Choice +from openai.types.responses import Response, ResponseOutputMessage, ResponseOutputRefusal, ResponseOutputText + +from pyrit.exceptions import ScenarioPartialFailureException +from pyrit.memory import CentralMemory +from pyrit.models import ( + AttackOutcome, + AttackSeedGroup, + ComponentIdentifier, + MessagePiece, + ScenarioRunState, + Score, + SeedObjective, +) +from pyrit.prompt_target import OpenAIChatTarget, OpenAIResponseTarget, PromptTarget +from pyrit.scenario import DatasetConfiguration +from pyrit.scenario.core import AtomicAttack, BaselineAttackPolicy, Scenario, ScenarioTechnique +from pyrit.scenario.core.matrix_atomic_attack_builder import build_baseline_atomic_attack +from pyrit.scenario.core.scenario_context import ScenarioContext +from pyrit.score import ScorerPromptValidator, TrueFalseScorer + +_ATOMIC_ATTACK_NAME = "structured_refusal" +_REFUSAL = "I cannot assist with that request." +_TEXT_RESPONSE = "This is a benign response." +_TRANSPORT_ERROR = "Simulated transport failure." + + +class _RefusalScenarioTechnique(ScenarioTechnique): + PROMPT_SENDING = ("prompt_sending", {"prompt_sending"}) + ALL = ("all", {"all"}) + + @classmethod + def get_aggregate_tags(cls) -> set[str]: + return {"all"} + + +class _RecordingObjectiveScorer(TrueFalseScorer): + def __init__(self) -> None: + super().__init__(validator=ScorerPromptValidator(supported_data_types=["text"])) + self.scored_pieces: list[MessagePiece] = [] + + def _build_identifier(self) -> ComponentIdentifier: + return self._create_identifier() + + async def _score_piece_async( + self, + message_piece: MessagePiece, + *, + objective: str | None = None, + ) -> list[Score]: + self.scored_pieces.append(message_piece) + return [ + Score( + score_value="false", + score_value_description="Objective not achieved", + score_type="true_false", + score_rationale="The response did not achieve the objective.", + scorer_class_identifier=self.get_identifier(), + message_piece_id=message_piece.id, + objective=objective, + ) + ] + + +class _RefusalScenario(Scenario): + BASELINE_ATTACK_POLICY: ClassVar[BaselineAttackPolicy] = BaselineAttackPolicy.Forbidden + + def __init__( + self, + *, + atomic_attacks: list[AtomicAttack] | None = None, + objective_scorer: TrueFalseScorer | None = None, + ) -> None: + resolved_scorer = objective_scorer or _RecordingObjectiveScorer() + super().__init__( + name="Structured Refusal Scenario", + version=1, + technique_class=_RefusalScenarioTechnique, + default_dataset_config=DatasetConfiguration(), + objective_scorer=resolved_scorer, + ) + self._test_atomic_attacks = atomic_attacks or [] + + async def _resolve_seed_groups_by_dataset_async( + self, + *, + apply_sampling: bool = True, + ) -> dict[str, list[AttackSeedGroup]]: + return {} + + async def _build_atomic_attacks_async(self, *, context: ScenarioContext) -> list[AtomicAttack]: + return self._test_atomic_attacks + + +@pytest.fixture(params=["responses", "chat_completions"], ids=["responses-api", "chat-completions"]) +def openai_target( + request: pytest.FixtureRequest, + patch_central_database: MagicMock, +) -> OpenAIResponseTarget | OpenAIChatTarget: + if request.param == "responses": + return OpenAIResponseTarget( + model_name="gpt-test", + endpoint="https://mock.azure.com/", + api_key="mock-api-key", + ) + return OpenAIChatTarget( + model_name="gpt-test", + endpoint="https://mock.azure.com/", + api_key="mock-api-key", + ) + + +def _build_responses_api_response(*, response_kind: str) -> MagicMock: + if response_kind == "refusal": + content = [ResponseOutputRefusal(refusal=_REFUSAL, type="refusal")] + elif response_kind == "text": + content = [ResponseOutputText(annotations=[], text=_TEXT_RESPONSE, type="output_text")] + else: + raise ValueError(f"Unsupported response kind: {response_kind}") + + output = ResponseOutputMessage( + id=f"{response_kind}-message", + content=content, + role="assistant", + status="completed", + type="message", + ) + response = MagicMock(spec=Response) + response.error = None + response.status = "completed" + response.output = [output] + return response + + +def _build_chat_completion(*, response_kind: str) -> ChatCompletion: + if response_kind == "refusal": + message = ChatCompletionMessage(content=None, refusal=_REFUSAL, role="assistant") + elif response_kind == "text": + message = ChatCompletionMessage(content=_TEXT_RESPONSE, refusal=None, role="assistant") + else: + raise ValueError(f"Unsupported response kind: {response_kind}") + + return ChatCompletion( + id=f"{response_kind}-completion", + choices=[Choice(finish_reason="stop", index=0, logprobs=None, message=message)], + created=0, + model="gpt-test", + object="chat.completion", + ) + + +def _configure_target_responses( + *, + target: OpenAIResponseTarget | OpenAIChatTarget, + response_kinds: Sequence[str], +) -> AsyncMock: + side_effects: list[object | BaseException] = [] + for response_kind in response_kinds: + if response_kind == "error": + side_effects.append(RuntimeError(_TRANSPORT_ERROR)) + elif isinstance(target, OpenAIResponseTarget): + side_effects.append(_build_responses_api_response(response_kind=response_kind)) + else: + side_effects.append(_build_chat_completion(response_kind=response_kind)) + + create_mock = AsyncMock(side_effect=side_effects) + if isinstance(target, OpenAIResponseTarget): + target._async_client.responses.create = create_mock # type: ignore[method-assign] + else: + target._async_client.chat.completions.create = create_mock # type: ignore[method-assign] + return create_mock + + +def _build_scenario( + *, + target: PromptTarget, + response_kinds: Sequence[str], +) -> tuple[_RefusalScenario, _RecordingObjectiveScorer, list[str]]: + scorer = _RecordingObjectiveScorer() + objectives = [f"{response_kind} objective {index}" for index, response_kind in enumerate(response_kinds)] + seed_groups = [AttackSeedGroup(seeds=[SeedObjective(value=objective)]) for objective in objectives] + atomic_attack = build_baseline_atomic_attack( + objective_target=target, + objective_scorer=scorer, + seed_groups=seed_groups, + atomic_attack_name=_ATOMIC_ATTACK_NAME, + ) + scenario = _RefusalScenario(atomic_attacks=[atomic_attack], objective_scorer=scorer) + scenario.set_params_from_args( + args={ + "objective_target": target, + "max_concurrency": 1, + "max_retries": 0, + } + ) + return scenario, scorer, objectives + + +@pytest.mark.parametrize( + "response_kinds", + [ + pytest.param(("refusal", "refusal"), id="all-objectives-refused"), + pytest.param(("refusal", "text"), id="some-objectives-refused"), + ], +) +async def test_scenario_structured_refusals_are_completed_and_scored( + openai_target: OpenAIResponseTarget | OpenAIChatTarget, + response_kinds: tuple[str, str], +) -> None: + create_mock = _configure_target_responses(target=openai_target, response_kinds=response_kinds) + scenario, scorer, _ = _build_scenario(target=openai_target, response_kinds=response_kinds) + + await scenario.initialize_async() + result = await scenario.run_async() + + attack_results = result.attack_results[_ATOMIC_ATTACK_NAME] + expected_refusals = response_kinds.count("refusal") + refusal_results = [ + item for item in attack_results if item.last_response and item.last_response.is_structured_refusal() + ] + scored_refusals = [piece for piece in scorer.scored_pieces if piece.is_structured_refusal()] + + assert result.scenario_run_state == ScenarioRunState.COMPLETED + assert result.error_type is None + assert len(attack_results) == len(response_kinds) + assert len(refusal_results) == expected_refusals + assert all(item.outcome == AttackOutcome.FAILURE for item in attack_results) + assert all(item.last_score and item.last_score.get_value() is False for item in attack_results) + assert all(item.last_response.converted_value_data_type == "error" for item in refusal_results) + assert all(item.last_response.get_structured_refusal() == _REFUSAL for item in refusal_results) + assert len(scored_refusals) == expected_refusals + assert all(piece.converted_value_data_type == "text" for piece in scored_refusals) + assert all(piece.converted_value == _REFUSAL for piece in scored_refusals) + assert create_mock.await_count == len(response_kinds) + + +async def test_scenario_counts_refusal_as_completed_when_another_objective_errors( + openai_target: OpenAIResponseTarget | OpenAIChatTarget, +) -> None: + response_kinds = ("refusal", "error") + _configure_target_responses(target=openai_target, response_kinds=response_kinds) + scenario, scorer, objectives = _build_scenario(target=openai_target, response_kinds=response_kinds) + await scenario.initialize_async() + + with pytest.raises(ScenarioPartialFailureException, match="1 of 2 objectives incomplete") as exc_info: + await scenario.run_async() + + error = exc_info.value + assert error.completed_count == 1 + assert error.incomplete_count == 1 + assert error.incomplete_objectives[0][0] == objectives[1] + assert _TRANSPORT_ERROR in str(error.incomplete_objectives[0][1]) + assert error.__cause__ is error.incomplete_objectives[0][1] + assert len(scorer.scored_pieces) == 1 + assert scorer.scored_pieces[0].converted_value == _REFUSAL + + stored_result = CentralMemory.get_memory_instance().get_scenario_results( + scenario_result_ids=[scenario._scenario_result_id] + )[0] + stored_attack_results = stored_result.attack_results[_ATOMIC_ATTACK_NAME] + refusal_results = [ + item for item in stored_attack_results if item.last_response and item.last_response.is_structured_refusal() + ] + + assert stored_result.scenario_run_state == ScenarioRunState.FAILED + assert stored_result.error_type == "ScenarioPartialFailureException" + assert len(refusal_results) == 1 + assert refusal_results[0].outcome == AttackOutcome.FAILURE + assert refusal_results[0].last_score and refusal_results[0].last_score.get_value() is False From 28082e44f9c181ae0c0293306c1dfe94479d6cd4 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:04:14 -0700 Subject: [PATCH 06/18] Retry invalid true-false scorer values Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- pyrit/score/response_handler.py | 53 +++++++++++++++++++ .../self_ask_general_true_false_scorer.py | 8 +-- .../true_false/self_ask_refusal_scorer.py | 10 ++-- .../true_false/self_ask_true_false_scorer.py | 11 ++-- tests/unit/score/test_response_handler.py | 42 +++++++++++++++ tests/unit/score/test_self_ask_refusal.py | 47 ++++++++++++++++ 6 files changed, 156 insertions(+), 15 deletions(-) create mode 100644 tests/unit/score/test_response_handler.py diff --git a/pyrit/score/response_handler.py b/pyrit/score/response_handler.py index 8163b76ddc..c73a22778c 100644 --- a/pyrit/score/response_handler.py +++ b/pyrit/score/response_handler.py @@ -255,6 +255,59 @@ def parse( return score +class TrueFalseResponseHandler(ResponseHandler): + """Response-handler decorator that enforces the true/false score domain.""" + + def __init__(self, *, response_handler: ResponseHandler) -> None: + """ + Initialize the decorator. + + Args: + response_handler (ResponseHandler): Handler that parses the target's wire format. + """ + self._response_handler = response_handler + + @property + def json_response_config(self) -> JsonResponseConfig: + """The wrapped handler's JSON-response request.""" + return self._response_handler.json_response_config + + def parse( + self, + *, + response_text: str, + scorer_identifier: ComponentIdentifier, + scored_prompt_id: str | uuid.UUID, + category: Sequence[str] | str | None = None, + objective: str | None = None, + ) -> UnvalidatedScore: + """ + Parse a response and require a true/false score value. + + Returns: + UnvalidatedScore: The parsed score with a normalized true/false value. + + Raises: + InvalidJsonException: If the parsed value is outside the true/false domain. + """ + score = self._response_handler.parse( + response_text=response_text, + scorer_identifier=scorer_identifier, + scored_prompt_id=scored_prompt_id, + category=category, + objective=objective, + ) + + normalized_value = score.raw_score_value.lower() + if normalized_value not in {"true", "false"}: + raise InvalidJsonException( + message=f"True/false score_value must be 'true' or 'false', not {score.raw_score_value!r}." + ) + + score.raw_score_value = normalized_value + return score + + class CallableResponseHandler(ResponseHandler): """ ResponseHandler that delegates parsing to a user-supplied callable. diff --git a/pyrit/score/true_false/self_ask_general_true_false_scorer.py b/pyrit/score/true_false/self_ask_general_true_false_scorer.py index b2ffaa1f2c..3b9ce049c4 100644 --- a/pyrit/score/true_false/self_ask_general_true_false_scorer.py +++ b/pyrit/score/true_false/self_ask_general_true_false_scorer.py @@ -7,7 +7,7 @@ from pyrit.prompt_target import CHAT_TARGET_REQUIREMENTS from pyrit.score.llm_scoring import _run_llm_scoring_async -from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler +from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler, TrueFalseResponseHandler from pyrit.score.scorer_prompt_validator import ScorerPromptValidator from pyrit.score.true_false.true_false_score_aggregator import ( TrueFalseAggregatorFunc, @@ -108,9 +108,7 @@ def __init__( self._prompt_format_string = prompt_format_string self._score_category = category - # A caller-supplied handler owns its own response contract; otherwise the default JSON - # handler carries the schema so the round-trip forwards it to the scoring target. - self._response_handler = response_handler or JsonSchemaResponseHandler( + wire_format_handler = response_handler or JsonSchemaResponseHandler( score_value_output_key=score_value_output_key, rationale_output_key=rationale_output_key, description_output_key=description_output_key, @@ -118,6 +116,8 @@ def __init__( category_output_key=category_output_key, response_schema=response_json_schema, ) + # Keep score-domain validation in the parser callback so invalid semantic values retry. + self._response_handler = TrueFalseResponseHandler(response_handler=wire_format_handler) def _build_identifier(self) -> ComponentIdentifier: """ diff --git a/pyrit/score/true_false/self_ask_refusal_scorer.py b/pyrit/score/true_false/self_ask_refusal_scorer.py index 4b100cde5b..68f946ddba 100644 --- a/pyrit/score/true_false/self_ask_refusal_scorer.py +++ b/pyrit/score/true_false/self_ask_refusal_scorer.py @@ -10,7 +10,7 @@ from pyrit.models import ComponentIdentifier, JsonSchemaDefinition, MessagePiece, Score, SeedPrompt from pyrit.prompt_target import CHAT_TARGET_REQUIREMENTS, PromptTarget from pyrit.score.llm_scoring import _run_llm_scoring_async -from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler +from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler, TrueFalseResponseHandler from pyrit.score.scorer_prompt_validator import ScorerPromptValidator from pyrit.score.true_false.true_false_score_aggregator import ( TrueFalseAggregatorFunc, @@ -126,10 +126,10 @@ def __init__( self._prompt_target = chat_target self._prompt_format_string = prompt_format_string or self.DEFAULT_REFUSAL_PROMPT_FORMAT self._system_prompt, schema = self._resolve_system_prompt(system_prompt) - # When the caller does not supply a response handler, the default JSON handler carries the - # schema (if any) declared by the system prompt, so the round-trip forwards it to the scoring - # target. A caller-supplied handler owns its own response contract. - self._response_handler = response_handler or JsonSchemaResponseHandler(response_schema=schema) + # The wire-format handler parses the response; the outer handler enforces this scorer's + # true/false domain while parsing is still inside the JSON retry boundary. + wire_format_handler = response_handler or JsonSchemaResponseHandler(response_schema=schema) + self._response_handler = TrueFalseResponseHandler(response_handler=wire_format_handler) # Normalize to a list so scores built directly (blocked / non-text early returns) satisfy # Score.score_category (list[str] | None). if score_category is None: diff --git a/pyrit/score/true_false/self_ask_true_false_scorer.py b/pyrit/score/true_false/self_ask_true_false_scorer.py index 401a2ed895..847e4f73ef 100644 --- a/pyrit/score/true_false/self_ask_true_false_scorer.py +++ b/pyrit/score/true_false/self_ask_true_false_scorer.py @@ -13,7 +13,7 @@ from pyrit.models import ComponentIdentifier, JsonSchemaDefinition, MessagePiece, Score, SeedPrompt from pyrit.prompt_target import CHAT_TARGET_REQUIREMENTS, PromptTarget from pyrit.score.llm_scoring import _run_llm_scoring_async -from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler +from pyrit.score.response_handler import JsonSchemaResponseHandler, ResponseHandler, TrueFalseResponseHandler from pyrit.score.scorer_prompt_validator import ScorerPromptValidator from pyrit.score.system_prompt import _render_system_prompt_template from pyrit.score.true_false.true_false_score_aggregator import ( @@ -194,11 +194,10 @@ def __init__( ) self._system_prompt = rendered_value self._question = resolved_question - # When the caller does not supply a response handler, the default JSON handler carries the - # schema (if any) declared by the system prompt, so the round-trip forwards it to the - # scoring target (enforced natively when supported, omitted via normalization otherwise). A - # caller-supplied handler owns its own response contract, including any schema. - self._response_handler = response_handler or JsonSchemaResponseHandler(response_schema=schema) + # The wire-format handler parses the response; the outer handler enforces this scorer's + # true/false domain while parsing is still inside the JSON retry boundary. + wire_format_handler = response_handler or JsonSchemaResponseHandler(response_schema=schema) + self._response_handler = TrueFalseResponseHandler(response_handler=wire_format_handler) self._score_category = [resolved_question.category] @staticmethod diff --git a/tests/unit/score/test_response_handler.py b/tests/unit/score/test_response_handler.py new file mode 100644 index 0000000000..95a781ceaa --- /dev/null +++ b/tests/unit/score/test_response_handler.py @@ -0,0 +1,42 @@ +# Copyright (c) Microsoft Corporation. +# Licensed under the MIT license. + +import pytest + +from pyrit.exceptions import InvalidJsonException +from pyrit.models import ComponentIdentifier +from pyrit.score.response_handler import JsonSchemaResponseHandler, TrueFalseResponseHandler + +SCORER_IDENTIFIER = ComponentIdentifier(class_name="TestScorer", class_module=__name__) + + +@pytest.mark.parametrize( + ("json_value", "expected"), + [ + ("true", "true"), + ("false", "false"), + ('"true"', "true"), + ('"false"', "false"), + ], +) +def test_true_false_response_handler_accepts_boolean_values(json_value: str, expected: str) -> None: + handler = TrueFalseResponseHandler(response_handler=JsonSchemaResponseHandler()) + + score = handler.parse( + response_text=f'{{"score_value": {json_value}, "rationale": "test"}}', + scorer_identifier=SCORER_IDENTIFIER, + scored_prompt_id="test-id", + ) + + assert score.raw_score_value == expected + + +def test_true_false_response_handler_rejects_value_outside_domain() -> None: + handler = TrueFalseResponseHandler(response_handler=JsonSchemaResponseHandler()) + + with pytest.raises(InvalidJsonException, match="must be 'true' or 'false'"): + handler.parse( + response_text='{"score_value": "refusal", "rationale": "test"}', + scorer_identifier=SCORER_IDENTIFIER, + scored_prompt_id="test-id", + ) diff --git a/tests/unit/score/test_self_ask_refusal.py b/tests/unit/score/test_self_ask_refusal.py index 332f4a8511..b08e3b9de2 100644 --- a/tests/unit/score/test_self_ask_refusal.py +++ b/tests/unit/score/test_self_ask_refusal.py @@ -163,6 +163,53 @@ async def test_self_ask_objective_scorer_bad_json_exception_retries(patch_centra assert chat_target.send_prompt_async.call_count == 2 +async def test_refusal_scorer_invalid_score_value_retries_and_succeeds( + scorer_true_false_response: Message, patch_central_database +): + chat_target = MagicMock() + chat_target.get_identifier.return_value = get_mock_target_identifier("MockChatTarget") + invalid_response = Message( + message_pieces=[ + MessagePiece( + role="assistant", + original_value='{"score_value": "refusal", "rationale": "invalid semantic value"}', + ) + ] + ) + chat_target.send_prompt_async = AsyncMock(side_effect=[[invalid_response], [scorer_true_false_response]]) + scorer = SelfAskRefusalScorer(chat_target=chat_target) + + scores = await scorer.score_text_async("response to evaluate") + + assert scores[0].get_value() is True + assert chat_target.send_prompt_async.call_count == 2 + + +async def test_refusal_scorer_invalid_score_value_retry_exhaustion_raises_invalid_json(patch_central_database): + chat_target = MagicMock() + chat_target.get_identifier.return_value = get_mock_target_identifier("MockChatTarget") + + def _invalid_response(*args, **kwargs): + return [ + Message( + message_pieces=[ + MessagePiece( + role="assistant", + original_value='{"score_value": "refusal", "rationale": "invalid semantic value"}', + ) + ] + ) + ] + + chat_target.send_prompt_async = AsyncMock(side_effect=_invalid_response) + scorer = SelfAskRefusalScorer(chat_target=chat_target) + + with pytest.raises(InvalidJsonException, match="must be 'true' or 'false'"): + await scorer.score_text_async("response to evaluate") + + assert chat_target.send_prompt_async.call_count == 2 + + async def test_score_async_filtered_response(patch_central_database): memory = CentralMemory.get_memory_instance() chat_target = MagicMock() From 36bd95540c445bcbb7d18eb9079ab2c29ce09fa4 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Tue, 28 Jul 2026 15:27:12 -0700 Subject: [PATCH 07/18] Retry non-object scorer JSON responses Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a008124c-220e-491c-9ea1-2144867ba53d --- pyrit/score/response_handler.py | 9 +++++-- tests/unit/score/test_response_handler.py | 12 +++++++++ tests/unit/score/test_self_ask_refusal.py | 31 +++++++++++++++++++++++ 3 files changed, 50 insertions(+), 2 deletions(-) diff --git a/pyrit/score/response_handler.py b/pyrit/score/response_handler.py index c73a22778c..6dea0a9d0a 100644 --- a/pyrit/score/response_handler.py +++ b/pyrit/score/response_handler.py @@ -217,12 +217,17 @@ def parse( Raises: ValueError: If a category is present in both the response and the argument, or the parsed category is not a string or a list of strings. - InvalidJsonException: If the response is not valid JSON, is missing a required key, or - (when this handler is numeric) the score value is not parsable as a float. + InvalidJsonException: If the response is invalid JSON, is not a top-level JSON object, + is missing a required key, or (when this handler is numeric) the score value is not + parsable as a float. """ response_json = remove_markdown_json(response_text) try: parsed_response = json.loads(response_json) + if not isinstance(parsed_response, dict): + raise InvalidJsonException( + message=f"Invalid JSON response, expected a top-level object: {response_json}" + ) score = _build_unvalidated_score( parsed_response=parsed_response, score_value_output_key=self._score_value_output_key, diff --git a/tests/unit/score/test_response_handler.py b/tests/unit/score/test_response_handler.py index 95a781ceaa..16084a5cf6 100644 --- a/tests/unit/score/test_response_handler.py +++ b/tests/unit/score/test_response_handler.py @@ -10,6 +10,18 @@ SCORER_IDENTIFIER = ComponentIdentifier(class_name="TestScorer", class_module=__name__) +@pytest.mark.parametrize("response_text", ["[]", '["score"]', '"true"', "1", "true", "null"]) +def test_json_schema_response_handler_rejects_non_object_response(response_text: str) -> None: + handler = JsonSchemaResponseHandler() + + with pytest.raises(InvalidJsonException, match="expected a top-level object"): + handler.parse( + response_text=response_text, + scorer_identifier=SCORER_IDENTIFIER, + scored_prompt_id="test-id", + ) + + @pytest.mark.parametrize( ("json_value", "expected"), [ diff --git a/tests/unit/score/test_self_ask_refusal.py b/tests/unit/score/test_self_ask_refusal.py index b08e3b9de2..4041eeaa64 100644 --- a/tests/unit/score/test_self_ask_refusal.py +++ b/tests/unit/score/test_self_ask_refusal.py @@ -163,6 +163,37 @@ async def test_self_ask_objective_scorer_bad_json_exception_retries(patch_centra assert chat_target.send_prompt_async.call_count == 2 +async def test_refusal_scorer_list_response_retries_and_succeeds( + scorer_true_false_response: Message, patch_central_database +): + chat_target = MagicMock() + chat_target.get_identifier.return_value = get_mock_target_identifier("MockChatTarget") + list_response = Message(message_pieces=[MessagePiece(role="assistant", original_value='[{"score_value": true}]')]) + chat_target.send_prompt_async = AsyncMock(side_effect=[[list_response], [scorer_true_false_response]]) + scorer = SelfAskRefusalScorer(chat_target=chat_target) + + scores = await scorer.score_text_async("response to evaluate") + + assert scores[0].get_value() is True + assert chat_target.send_prompt_async.call_count == 2 + + +async def test_refusal_scorer_list_response_retry_exhaustion_raises_invalid_json(patch_central_database): + chat_target = MagicMock() + chat_target.get_identifier.return_value = get_mock_target_identifier("MockChatTarget") + + def _list_response(*args, **kwargs): + return [Message(message_pieces=[MessagePiece(role="assistant", original_value='[{"score_value": true}]')])] + + chat_target.send_prompt_async = AsyncMock(side_effect=_list_response) + scorer = SelfAskRefusalScorer(chat_target=chat_target) + + with pytest.raises(InvalidJsonException, match="expected a top-level object"): + await scorer.score_text_async("response to evaluate") + + assert chat_target.send_prompt_async.call_count == 2 + + async def test_refusal_scorer_invalid_score_value_retries_and_succeeds( scorer_true_false_response: Message, patch_central_database ): From 94aabd20416e2b8d8e6d7b810aba038fd2602bdc Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 06:17:27 -0700 Subject: [PATCH 08/18] DOC Clarify attack and scenario outcomes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/executor/0_executor.md | 77 +++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/doc/code/executor/0_executor.md b/doc/code/executor/0_executor.md index f486386843..265579f50a 100644 --- a/doc/code/executor/0_executor.md +++ b/doc/code/executor/0_executor.md @@ -74,6 +74,83 @@ The context is created for you from the `execute_async` arguments — you rarely See [Attack Configuration](3_attack_configuration.ipynb) for what you can put in the context and configs (prepended conversations, multimodal seeds, next-turn messages, memory labels). +## Attack outcomes and scenario completion + +Attack execution has two independent axes: + +| Axis | Values | Meaning | +| --- | --- | --- | +| **Execution health** | completed or incomplete | A completed objective returned an `AttackResult`. An incomplete objective raised an exception before it could return one. | +| **Objective outcome** | `AttackOutcome.SUCCESS`, `FAILURE`, or `UNDETERMINED` | Whether a completed attack achieved its objective. `FAILURE` is a valid security result, not an execution error. | + +A model refusal therefore does not make an objective incomplete. PyRIT persists handled structured +refusals and content-filter responses as blocked model responses, applies the configured scoring +policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally +produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. + +```{mermaid} +flowchart TB + subgraph objective["One objective in an AtomicAttack"] + START["Execute attack objective"] --> TARGET["Send or continue conversation"] + TARGET --> TARGET_RESULT{"Target result"} + + TARGET_RESULT -->|Normal model output| RESPONSE["Persistable model response"] + TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] + TARGET_RESULT -->|Retryable target error| TARGET_RETRY{"Target retry budget remains?"} + TARGET_RETRY -->|Yes| TARGET + TARGET_RETRY -->|No / exhausted| EXEC_ERROR["Execution exception propagates"] + TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR + + RESPONSE --> SCORE["Apply configured scorer policy"] + REFUSAL --> SCORE + SCORE --> SCORE_RESULT{"Scoring result"} + SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE + SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR + SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] + SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} + SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] + MORE -->|Yes| TARGET + MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] + + SUCCESS --> COMPLETE["Completed objective"] + FAILURE --> COMPLETE + UNDETERMINED --> COMPLETE + EXEC_ERROR --> ERROR_ROW["Error handler may persist
AttackOutcome.ERROR for diagnostics"] + ERROR_ROW --> INCOMPLETE["Incomplete objective
exception retained"] + end + + subgraph aggregation["AtomicAttack and Scenario aggregation"] + COMPLETE --> EXECUTOR_RESULT["AttackExecutorResult"] + INCOMPLETE --> EXECUTOR_RESULT + EXECUTOR_RESULT --> HAS_INCOMPLETE{"Any incomplete objectives?"} + + HAS_INCOMPLETE -->|No| KEEP["Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED"] + KEEP --> ALL_DONE{"All atomic attacks complete?"} + ALL_DONE -->|No| START + ALL_DONE -->|Yes| SCENARIO_COMPLETE["ScenarioResult
ScenarioRunState.COMPLETED"] + + HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{"Scenario retry budget remains?"} + SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START + SCENARIO_RETRY -->|No / exhausted| PARTIAL["Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero"] + PARTIAL --> SCENARIO_FAILED["Persist ScenarioRunState.FAILED"] + end + + classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a; + classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a; + classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a; + class RESPONSE,REFUSAL model; + class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; + class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; +``` + +Scenario retries resume only objectives that have not completed; already-persisted results are +preserved. If retry exhaustion leaves any incomplete objectives, `ScenarioPartialFailureException` +reports `completed_count`, `incomplete_count`, and `incomplete_objectives`, and keeps the first +objective exception as its cause. This typed exception is also used when **none** of the objectives in +the returned `AttackExecutorResult` completed (`completed_count == 0`). If an `AtomicAttack` raises +before it can return an `AttackExecutorResult`, the scenario instead retries and ultimately re-raises +that exception; multiple concurrent atomic-attack failures are surfaced as an `ExceptionGroup`. + The category pages above each walk through their executors with short runnable examples. ## When do you actually need a new executor class? From 0dd47ed323cda9d9c8622f1b130a7ce7a2e43875 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 06:27:00 -0700 Subject: [PATCH 09/18] docs: move attack outcomes to scenario resiliency Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/executor/0_executor.md | 77 -------------------------- doc/code/scenarios/0_scenarios.ipynb | 81 ++++++++++++++++++++++++++++ doc/code/scenarios/0_scenarios.py | 81 ++++++++++++++++++++++++++++ 3 files changed, 162 insertions(+), 77 deletions(-) diff --git a/doc/code/executor/0_executor.md b/doc/code/executor/0_executor.md index 265579f50a..f486386843 100644 --- a/doc/code/executor/0_executor.md +++ b/doc/code/executor/0_executor.md @@ -74,83 +74,6 @@ The context is created for you from the `execute_async` arguments — you rarely See [Attack Configuration](3_attack_configuration.ipynb) for what you can put in the context and configs (prepended conversations, multimodal seeds, next-turn messages, memory labels). -## Attack outcomes and scenario completion - -Attack execution has two independent axes: - -| Axis | Values | Meaning | -| --- | --- | --- | -| **Execution health** | completed or incomplete | A completed objective returned an `AttackResult`. An incomplete objective raised an exception before it could return one. | -| **Objective outcome** | `AttackOutcome.SUCCESS`, `FAILURE`, or `UNDETERMINED` | Whether a completed attack achieved its objective. `FAILURE` is a valid security result, not an execution error. | - -A model refusal therefore does not make an objective incomplete. PyRIT persists handled structured -refusals and content-filter responses as blocked model responses, applies the configured scoring -policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally -produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. - -```{mermaid} -flowchart TB - subgraph objective["One objective in an AtomicAttack"] - START["Execute attack objective"] --> TARGET["Send or continue conversation"] - TARGET --> TARGET_RESULT{"Target result"} - - TARGET_RESULT -->|Normal model output| RESPONSE["Persistable model response"] - TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] - TARGET_RESULT -->|Retryable target error| TARGET_RETRY{"Target retry budget remains?"} - TARGET_RETRY -->|Yes| TARGET - TARGET_RETRY -->|No / exhausted| EXEC_ERROR["Execution exception propagates"] - TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR - - RESPONSE --> SCORE["Apply configured scorer policy"] - REFUSAL --> SCORE - SCORE --> SCORE_RESULT{"Scoring result"} - SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE - SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR - SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] - SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} - SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] - MORE -->|Yes| TARGET - MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] - - SUCCESS --> COMPLETE["Completed objective"] - FAILURE --> COMPLETE - UNDETERMINED --> COMPLETE - EXEC_ERROR --> ERROR_ROW["Error handler may persist
AttackOutcome.ERROR for diagnostics"] - ERROR_ROW --> INCOMPLETE["Incomplete objective
exception retained"] - end - - subgraph aggregation["AtomicAttack and Scenario aggregation"] - COMPLETE --> EXECUTOR_RESULT["AttackExecutorResult"] - INCOMPLETE --> EXECUTOR_RESULT - EXECUTOR_RESULT --> HAS_INCOMPLETE{"Any incomplete objectives?"} - - HAS_INCOMPLETE -->|No| KEEP["Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED"] - KEEP --> ALL_DONE{"All atomic attacks complete?"} - ALL_DONE -->|No| START - ALL_DONE -->|Yes| SCENARIO_COMPLETE["ScenarioResult
ScenarioRunState.COMPLETED"] - - HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{"Scenario retry budget remains?"} - SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START - SCENARIO_RETRY -->|No / exhausted| PARTIAL["Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero"] - PARTIAL --> SCENARIO_FAILED["Persist ScenarioRunState.FAILED"] - end - - classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a; - classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a; - classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a; - class RESPONSE,REFUSAL model; - class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; - class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; -``` - -Scenario retries resume only objectives that have not completed; already-persisted results are -preserved. If retry exhaustion leaves any incomplete objectives, `ScenarioPartialFailureException` -reports `completed_count`, `incomplete_count`, and `incomplete_objectives`, and keeps the first -objective exception as its cause. This typed exception is also used when **none** of the objectives in -the returned `AttackExecutorResult` completed (`completed_count == 0`). If an `AtomicAttack` raises -before it can return an `AttackExecutorResult`, the scenario instead retries and ultimately re-raises -that exception; multiple concurrent atomic-attack failures are surfaced as an `ExceptionGroup`. - The category pages above each walk through their executors with short runnable examples. ## When do you actually need a new executor class? diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index a20a1e9373..425939ba90 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -465,6 +465,87 @@ "\n", "Scenarios can run for a long time, and because of that, things can go wrong. Network issues, rate limits, or other transient failures can interrupt execution. PyRIT provides built-in resiliency features to handle these situations gracefully.\n", "\n", + "### Attack Outcomes and Execution Health\n", + "\n", + "A Scenario tracks two independent axes for every objective:\n", + "\n", + "| Axis | Values | Meaning |\n", + "| --- | --- | --- |\n", + "| **Execution health** | completed or incomplete | A completed objective returned an `AttackResult`. An incomplete objective raised an exception before it could return one. |\n", + "| **Objective outcome** | `AttackOutcome.SUCCESS`, `FAILURE`, or `UNDETERMINED` | Whether a completed attack achieved its objective. `FAILURE` is a valid security result, not an execution error. |\n", + "\n", + "A model refusal therefore does not make an objective incomplete. PyRIT persists handled structured\n", + "refusals and content-filter responses as blocked model responses, applies the configured scoring\n", + "policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally\n", + "produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`.\n", + "\n", + "```{mermaid}\n", + "flowchart TB\n", + " subgraph objective[\"One objective in an AtomicAttack\"]\n", + " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", + " TARGET --> TARGET_RESULT{\"Target result\"}\n", + "\n", + " TARGET_RESULT -->|Normal model output| RESPONSE[\"Persistable model response\"]\n", + " TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL[\"Persistable blocked model response
not an execution failure\"]\n", + " TARGET_RESULT -->|Retryable target error| TARGET_RETRY{\"Target retry budget remains?\"}\n", + " TARGET_RETRY -->|Yes| TARGET\n", + " TARGET_RETRY -->|No / exhausted| EXEC_ERROR[\"Execution exception propagates\"]\n", + " TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR\n", + "\n", + " RESPONSE --> SCORE[\"Apply configured scorer policy\"]\n", + " REFUSAL --> SCORE\n", + " SCORE --> SCORE_RESULT{\"Scoring result\"}\n", + " SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE\n", + " SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR\n", + " SCORE_RESULT -->|Objective achieved| SUCCESS[\"AttackResult
AttackOutcome.SUCCESS\"]\n", + " SCORE_RESULT -->|Objective not achieved| MORE{\"Attack-specific attempt or turn remains?\"}\n", + " SCORE_RESULT -->|No objective scorer| UNDETERMINED[\"AttackResult
AttackOutcome.UNDETERMINED\"]\n", + " MORE -->|Yes| TARGET\n", + " MORE -->|No| FAILURE[\"AttackResult
AttackOutcome.FAILURE\"]\n", + "\n", + " SUCCESS --> COMPLETE[\"Completed objective\"]\n", + " FAILURE --> COMPLETE\n", + " UNDETERMINED --> COMPLETE\n", + " EXEC_ERROR --> ERROR_ROW[\"Error handler may persist
AttackOutcome.ERROR for diagnostics\"]\n", + " ERROR_ROW --> INCOMPLETE[\"Incomplete objective
exception retained\"]\n", + " end\n", + "\n", + " subgraph aggregation[\"Scenario aggregation and resiliency\"]\n", + " COMPLETE --> EXECUTOR_RESULT[\"AttackExecutorResult\"]\n", + " INCOMPLETE --> EXECUTOR_RESULT\n", + " EXECUTOR_RESULT --> HAS_INCOMPLETE{\"Any incomplete objectives?\"}\n", + "\n", + " HAS_INCOMPLETE -->|No| KEEP[\"Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED\"]\n", + " KEEP --> ALL_DONE{\"All atomic attacks complete?\"}\n", + " ALL_DONE -->|No| START\n", + " ALL_DONE -->|Yes| SCENARIO_COMPLETE[\"ScenarioResult
ScenarioRunState.COMPLETED\"]\n", + "\n", + " HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{\"Scenario retry budget remains?\"}\n", + " SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START\n", + " SCENARIO_RETRY -->|No / exhausted| PARTIAL[\"Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero\"]\n", + " PARTIAL --> SCENARIO_FAILED[\"Persist ScenarioRunState.FAILED\"]\n", + " end\n", + "\n", + " classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a;\n", + " classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a;\n", + " classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a;\n", + " class RESPONSE,REFUSAL model;\n", + " class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete;\n", + " class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete;\n", + "```\n", + "\n", + "A Scenario reaches `ScenarioRunState.COMPLETED` when every objective execution completes, regardless\n", + "of the mix of successful and unsuccessful attack outcomes. Scenario retries resume only objectives\n", + "that have not completed; already-persisted results are preserved.\n", + "\n", + "If retry exhaustion leaves any incomplete objectives, `ScenarioPartialFailureException` reports\n", + "`completed_count`, `incomplete_count`, and `incomplete_objectives`, and keeps the first objective\n", + "exception as its cause. This typed exception is also used when **none** of the objectives in the\n", + "returned `AttackExecutorResult` completed (`completed_count == 0`). If an `AtomicAttack` raises before\n", + "it can return an `AttackExecutorResult`, the Scenario instead retries and ultimately re-raises that\n", + "exception; multiple concurrent atomic-attack failures are surfaced as an `ExceptionGroup`. In every\n", + "terminal execution-failure case, the persisted Scenario state is `ScenarioRunState.FAILED`.\n", + "\n", "### Automatic Resume\n", "\n", "If you re-run a `scenario`, it will automatically start where it left off. The framework tracks completed attacks and objectives in memory, so you won't lose progress if something interrupts your scenario execution. This means you can safely stop and restart scenarios without duplicating work.\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index a0e521541e..09d8d28f40 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -201,6 +201,87 @@ async def _build_atomic_attacks_async(self, *, context): # # Scenarios can run for a long time, and because of that, things can go wrong. Network issues, rate limits, or other transient failures can interrupt execution. PyRIT provides built-in resiliency features to handle these situations gracefully. # +# ### Attack Outcomes and Execution Health +# +# A Scenario tracks two independent axes for every objective: +# +# | Axis | Values | Meaning | +# | --- | --- | --- | +# | **Execution health** | completed or incomplete | A completed objective returned an `AttackResult`. An incomplete objective raised an exception before it could return one. | +# | **Objective outcome** | `AttackOutcome.SUCCESS`, `FAILURE`, or `UNDETERMINED` | Whether a completed attack achieved its objective. `FAILURE` is a valid security result, not an execution error. | +# +# A model refusal therefore does not make an objective incomplete. PyRIT persists handled structured +# refusals and content-filter responses as blocked model responses, applies the configured scoring +# policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally +# produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. +# +# ```{mermaid} +# flowchart TB +# subgraph objective["One objective in an AtomicAttack"] +# START["Execute attack objective"] --> TARGET["Send or continue conversation"] +# TARGET --> TARGET_RESULT{"Target result"} +# +# TARGET_RESULT -->|Normal model output| RESPONSE["Persistable model response"] +# TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] +# TARGET_RESULT -->|Retryable target error| TARGET_RETRY{"Target retry budget remains?"} +# TARGET_RETRY -->|Yes| TARGET +# TARGET_RETRY -->|No / exhausted| EXEC_ERROR["Execution exception propagates"] +# TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR +# +# RESPONSE --> SCORE["Apply configured scorer policy"] +# REFUSAL --> SCORE +# SCORE --> SCORE_RESULT{"Scoring result"} +# SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE +# SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR +# SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] +# SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} +# SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] +# MORE -->|Yes| TARGET +# MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] +# +# SUCCESS --> COMPLETE["Completed objective"] +# FAILURE --> COMPLETE +# UNDETERMINED --> COMPLETE +# EXEC_ERROR --> ERROR_ROW["Error handler may persist
AttackOutcome.ERROR for diagnostics"] +# ERROR_ROW --> INCOMPLETE["Incomplete objective
exception retained"] +# end +# +# subgraph aggregation["Scenario aggregation and resiliency"] +# COMPLETE --> EXECUTOR_RESULT["AttackExecutorResult"] +# INCOMPLETE --> EXECUTOR_RESULT +# EXECUTOR_RESULT --> HAS_INCOMPLETE{"Any incomplete objectives?"} +# +# HAS_INCOMPLETE -->|No| KEEP["Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED"] +# KEEP --> ALL_DONE{"All atomic attacks complete?"} +# ALL_DONE -->|No| START +# ALL_DONE -->|Yes| SCENARIO_COMPLETE["ScenarioResult
ScenarioRunState.COMPLETED"] +# +# HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{"Scenario retry budget remains?"} +# SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START +# SCENARIO_RETRY -->|No / exhausted| PARTIAL["Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero"] +# PARTIAL --> SCENARIO_FAILED["Persist ScenarioRunState.FAILED"] +# end +# +# classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a; +# classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a; +# classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a; +# class RESPONSE,REFUSAL model; +# class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; +# class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; +# ``` +# +# A Scenario reaches `ScenarioRunState.COMPLETED` when every objective execution completes, regardless +# of the mix of successful and unsuccessful attack outcomes. Scenario retries resume only objectives +# that have not completed; already-persisted results are preserved. +# +# If retry exhaustion leaves any incomplete objectives, `ScenarioPartialFailureException` reports +# `completed_count`, `incomplete_count`, and `incomplete_objectives`, and keeps the first objective +# exception as its cause. This typed exception is also used when **none** of the objectives in the +# returned `AttackExecutorResult` completed (`completed_count == 0`). If an `AtomicAttack` raises before +# it can return an `AttackExecutorResult`, the Scenario instead retries and ultimately re-raises that +# exception; multiple concurrent atomic-attack failures are surfaced as an `ExceptionGroup`. In every +# terminal execution-failure case, the persisted Scenario state is `ScenarioRunState.FAILED`. +# # ### Automatic Resume # # If you re-run a `scenario`, it will automatically start where it left off. The framework tracks completed attacks and objectives in memory, so you won't lose progress if something interrupts your scenario execution. This means you can safely stop and restart scenarios without duplicating work. From 1b7e26ceef3733ddafaf553a05aeb824b0448a14 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:10:14 -0700 Subject: [PATCH 10/18] docs: clarify attack outcome flow layout Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 6 +++--- doc/code/scenarios/0_scenarios.py | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 425939ba90..5e72501a02 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -495,11 +495,11 @@ " RESPONSE --> SCORE[\"Apply configured scorer policy\"]\n", " REFUSAL --> SCORE\n", " SCORE --> SCORE_RESULT{\"Scoring result\"}\n", - " SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE\n", - " SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR\n", - " SCORE_RESULT -->|Objective achieved| SUCCESS[\"AttackResult
AttackOutcome.SUCCESS\"]\n", " SCORE_RESULT -->|Objective not achieved| MORE{\"Attack-specific attempt or turn remains?\"}\n", + " SCORE_RESULT -->|Objective achieved| SUCCESS[\"AttackResult
AttackOutcome.SUCCESS\"]\n", " SCORE_RESULT -->|No objective scorer| UNDETERMINED[\"AttackResult
AttackOutcome.UNDETERMINED\"]\n", + " SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE\n", + " SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR\n", " MORE -->|Yes| TARGET\n", " MORE -->|No| FAILURE[\"AttackResult
AttackOutcome.FAILURE\"]\n", "\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 09d8d28f40..8e93fde1d0 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -231,11 +231,11 @@ async def _build_atomic_attacks_async(self, *, context): # RESPONSE --> SCORE["Apply configured scorer policy"] # REFUSAL --> SCORE # SCORE --> SCORE_RESULT{"Scoring result"} -# SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE -# SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR -# SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] # SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} +# SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] # SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] +# SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE +# SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR # MORE -->|Yes| TARGET # MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] # From 0a562c24f897c2e57647d23560ca63d7f380f8ff Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:14:49 -0700 Subject: [PATCH 11/18] docs: place retry decision leftmost Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 4 ++-- doc/code/scenarios/0_scenarios.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 5e72501a02..dd0a0e6594 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -503,8 +503,8 @@ " MORE -->|Yes| TARGET\n", " MORE -->|No| FAILURE[\"AttackResult
AttackOutcome.FAILURE\"]\n", "\n", - " SUCCESS --> COMPLETE[\"Completed objective\"]\n", - " FAILURE --> COMPLETE\n", + " FAILURE --> COMPLETE[\"Completed objective\"]\n", + " SUCCESS --> COMPLETE\n", " UNDETERMINED --> COMPLETE\n", " EXEC_ERROR --> ERROR_ROW[\"Error handler may persist
AttackOutcome.ERROR for diagnostics\"]\n", " ERROR_ROW --> INCOMPLETE[\"Incomplete objective
exception retained\"]\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 8e93fde1d0..9dd1bd031d 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -239,8 +239,8 @@ async def _build_atomic_attacks_async(self, *, context): # MORE -->|Yes| TARGET # MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] # -# SUCCESS --> COMPLETE["Completed objective"] -# FAILURE --> COMPLETE +# FAILURE --> COMPLETE["Completed objective"] +# SUCCESS --> COMPLETE # UNDETERMINED --> COMPLETE # EXEC_ERROR --> ERROR_ROW["Error handler may persist
AttackOutcome.ERROR for diagnostics"] # ERROR_ROW --> INCOMPLETE["Incomplete objective
exception retained"] From b3fce84d9b5aaac9e84e36a1f176018310aaeb33 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 10:52:28 -0700 Subject: [PATCH 12/18] docs: remove flowchart edge overlaps Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 28 +++++++++++++++++----------- doc/code/scenarios/0_scenarios.py | 28 +++++++++++++++++----------- 2 files changed, 34 insertions(+), 22 deletions(-) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index dd0a0e6594..4180db05c5 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -487,10 +487,11 @@ "\n", " TARGET_RESULT -->|Normal model output| RESPONSE[\"Persistable model response\"]\n", " TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL[\"Persistable blocked model response
not an execution failure\"]\n", + " TARGET_RESULT --> RUNTIME_ERROR[\"Non-retryable runtime error\"]\n", " TARGET_RESULT -->|Retryable target error| TARGET_RETRY{\"Target retry budget remains?\"}\n", - " TARGET_RETRY -->|Yes| TARGET\n", " TARGET_RETRY -->|No / exhausted| EXEC_ERROR[\"Execution exception propagates\"]\n", - " TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR\n", + " TARGET_RETRY -->|Yes| RETRY_TARGET[\"Repeat from
Send or continue conversation\"]\n", + " RUNTIME_ERROR --> EXEC_ERROR\n", "\n", " RESPONSE --> SCORE[\"Apply configured scorer policy\"]\n", " REFUSAL --> SCORE\n", @@ -498,9 +499,9 @@ " SCORE_RESULT -->|Objective not achieved| MORE{\"Attack-specific attempt or turn remains?\"}\n", " SCORE_RESULT -->|Objective achieved| SUCCESS[\"AttackResult
AttackOutcome.SUCCESS\"]\n", " SCORE_RESULT -->|No objective scorer| UNDETERMINED[\"AttackResult
AttackOutcome.UNDETERMINED\"]\n", - " SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE\n", + " SCORE_RESULT -->|Invalid scorer JSON; retry remains| RETRY_SCORE[\"Repeat from
Apply configured scorer policy\"]\n", " SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR\n", - " MORE -->|Yes| TARGET\n", + " MORE -->|Yes| RETRY_ATTACK[\"Repeat from
Send or continue conversation\"]\n", " MORE -->|No| FAILURE[\"AttackResult
AttackOutcome.FAILURE\"]\n", "\n", " FAILURE --> COMPLETE[\"Completed objective\"]\n", @@ -515,25 +516,30 @@ " INCOMPLETE --> EXECUTOR_RESULT\n", " EXECUTOR_RESULT --> HAS_INCOMPLETE{\"Any incomplete objectives?\"}\n", "\n", - " HAS_INCOMPLETE -->|No| KEEP[\"Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED\"]\n", - " KEEP --> ALL_DONE{\"All atomic attacks complete?\"}\n", - " ALL_DONE -->|No| START\n", - " ALL_DONE -->|Yes| SCENARIO_COMPLETE[\"ScenarioResult
ScenarioRunState.COMPLETED\"]\n", - "\n", " HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{\"Scenario retry budget remains?\"}\n", - " SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START\n", + " SCENARIO_RETRY -->|Yes; resume only incomplete objectives| RESUME[\"Repeat objective flow
for incomplete objectives\"]\n", " SCENARIO_RETRY -->|No / exhausted| PARTIAL[\"Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero\"]\n", " PARTIAL --> SCENARIO_FAILED[\"Persist ScenarioRunState.FAILED\"]\n", + "\n", + " HAS_INCOMPLETE -->|No| KEEP[\"Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED\"]\n", + " KEEP --> ALL_DONE{\"All atomic attacks complete?\"}\n", + " ALL_DONE -->|No| NEXT_ATTACK[\"Repeat objective flow
for next atomic attack\"]\n", + " ALL_DONE -->|Yes| SCENARIO_COMPLETE[\"ScenarioResult
ScenarioRunState.COMPLETED\"]\n", " end\n", "\n", " classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a;\n", " classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a;\n", " classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a;\n", + " classDef retry fill:#fff4e5,stroke:#f9ab00,color:#15233a;\n", " class RESPONSE,REFUSAL model;\n", + " class RETRY_TARGET,RETRY_SCORE,RETRY_ATTACK,RESUME,NEXT_ATTACK retry;\n", " class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete;\n", - " class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete;\n", + " class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete;\n", "```\n", "\n", + "To keep retry paths readable, **Repeat from** nodes name the earlier step where execution resumes\n", + "instead of drawing long return arrows across unrelated branches.\n", + "\n", "A Scenario reaches `ScenarioRunState.COMPLETED` when every objective execution completes, regardless\n", "of the mix of successful and unsuccessful attack outcomes. Scenario retries resume only objectives\n", "that have not completed; already-persisted results are preserved.\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 9dd1bd031d..c07af24a7c 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -223,10 +223,11 @@ async def _build_atomic_attacks_async(self, *, context): # # TARGET_RESULT -->|Normal model output| RESPONSE["Persistable model response"] # TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] +# TARGET_RESULT --> RUNTIME_ERROR["Non-retryable runtime error"] # TARGET_RESULT -->|Retryable target error| TARGET_RETRY{"Target retry budget remains?"} -# TARGET_RETRY -->|Yes| TARGET # TARGET_RETRY -->|No / exhausted| EXEC_ERROR["Execution exception propagates"] -# TARGET_RESULT -->|Non-retryable runtime error| EXEC_ERROR +# TARGET_RETRY -->|Yes| RETRY_TARGET["Repeat from
Send or continue conversation"] +# RUNTIME_ERROR --> EXEC_ERROR # # RESPONSE --> SCORE["Apply configured scorer policy"] # REFUSAL --> SCORE @@ -234,9 +235,9 @@ async def _build_atomic_attacks_async(self, *, context): # SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} # SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] # SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] -# SCORE_RESULT -->|Invalid scorer JSON; retry remains| SCORE +# SCORE_RESULT -->|Invalid scorer JSON; retry remains| RETRY_SCORE["Repeat from
Apply configured scorer policy"] # SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR -# MORE -->|Yes| TARGET +# MORE -->|Yes| RETRY_ATTACK["Repeat from
Send or continue conversation"] # MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] # # FAILURE --> COMPLETE["Completed objective"] @@ -251,25 +252,30 @@ async def _build_atomic_attacks_async(self, *, context): # INCOMPLETE --> EXECUTOR_RESULT # EXECUTOR_RESULT --> HAS_INCOMPLETE{"Any incomplete objectives?"} # -# HAS_INCOMPLETE -->|No| KEEP["Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED"] -# KEEP --> ALL_DONE{"All atomic attacks complete?"} -# ALL_DONE -->|No| START -# ALL_DONE -->|Yes| SCENARIO_COMPLETE["ScenarioResult
ScenarioRunState.COMPLETED"] -# # HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{"Scenario retry budget remains?"} -# SCENARIO_RETRY -->|Yes; resume only incomplete objectives| START +# SCENARIO_RETRY -->|Yes; resume only incomplete objectives| RESUME["Repeat objective flow
for incomplete objectives"] # SCENARIO_RETRY -->|No / exhausted| PARTIAL["Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero"] # PARTIAL --> SCENARIO_FAILED["Persist ScenarioRunState.FAILED"] +# +# HAS_INCOMPLETE -->|No| KEEP["Keep every completed AttackResult
SUCCESS, FAILURE, and UNDETERMINED"] +# KEEP --> ALL_DONE{"All atomic attacks complete?"} +# ALL_DONE -->|No| NEXT_ATTACK["Repeat objective flow
for next atomic attack"] +# ALL_DONE -->|Yes| SCENARIO_COMPLETE["ScenarioResult
ScenarioRunState.COMPLETED"] # end # # classDef model fill:#e8f0fe,stroke:#4285f4,color:#15233a; # classDef complete fill:#e6f4ea,stroke:#34a853,color:#15233a; # classDef incomplete fill:#fce8e6,stroke:#d93025,color:#15233a; +# classDef retry fill:#fff4e5,stroke:#f9ab00,color:#15233a; # class RESPONSE,REFUSAL model; +# class RETRY_TARGET,RETRY_SCORE,RETRY_ATTACK,RESUME,NEXT_ATTACK retry; # class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; -# class EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; +# class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; # ``` # +# To keep retry paths readable, **Repeat from** nodes name the earlier step where execution resumes +# instead of drawing long return arrows across unrelated branches. +# # A Scenario reaches `ScenarioRunState.COMPLETED` when every objective execution completes, regardless # of the mix of successful and unsuccessful attack outcomes. Scenario retries resume only objectives # that have not completed; already-persisted results are preserved. From 5adfd1294dfd4efe7ec9437fbc94bf8d38e776e3 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 11:12:27 -0700 Subject: [PATCH 13/18] docs: enlarge scenario flowchart text Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 1 + doc/code/scenarios/0_scenarios.py | 1 + 2 files changed, 2 insertions(+) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 4180db05c5..38e8a32136 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -480,6 +480,7 @@ "produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`.\n", "\n", "```{mermaid}\n", + "%%{init: {\"themeVariables\": {\"fontSize\": \"18px\"}}}%%\n", "flowchart TB\n", " subgraph objective[\"One objective in an AtomicAttack\"]\n", " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index c07af24a7c..f588823478 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -216,6 +216,7 @@ async def _build_atomic_attacks_async(self, *, context): # produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. # # ```{mermaid} +# %%{init: {"themeVariables": {"fontSize": "18px"}}}%% # flowchart TB # subgraph objective["One objective in an AtomicAttack"] # START["Execute attack objective"] --> TARGET["Send or continue conversation"] From 5c3a2a77dcae4d5f9d6a2070f3cfdd7e98b25b0a Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:00:40 -0700 Subject: [PATCH 14/18] docs: substantially enlarge flowchart text Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 2 +- doc/code/scenarios/0_scenarios.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 38e8a32136..d0ce8e41ff 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -480,7 +480,7 @@ "produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`.\n", "\n", "```{mermaid}\n", - "%%{init: {\"themeVariables\": {\"fontSize\": \"18px\"}}}%%\n", + "%%{init: {\"themeVariables\": {\"fontSize\": \"36px\"}}}%%\n", "flowchart TB\n", " subgraph objective[\"One objective in an AtomicAttack\"]\n", " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index f588823478..2a3223d339 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -216,7 +216,7 @@ async def _build_atomic_attacks_async(self, *, context): # produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. # # ```{mermaid} -# %%{init: {"themeVariables": {"fontSize": "18px"}}}%% +# %%{init: {"themeVariables": {"fontSize": "36px"}}}%% # flowchart TB # subgraph objective["One objective in an AtomicAttack"] # START["Execute attack objective"] --> TARGET["Send or continue conversation"] From dd60b2ce892d43d2962a4556ccdbd50d7c7c9766 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 12:47:49 -0700 Subject: [PATCH 15/18] docs: expand scenario outcome diagram Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/scenarios/0_scenarios.ipynb | 24 ++++++++++++++++++++++-- doc/code/scenarios/0_scenarios.py | 10 +++++++++- 2 files changed, 31 insertions(+), 3 deletions(-) diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index d0ce8e41ff..3f95e355a6 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -477,10 +477,22 @@ "A model refusal therefore does not make an objective incomplete. PyRIT persists handled structured\n", "refusals and content-filter responses as blocked model responses, applies the configured scoring\n", "policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally\n", - "produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`.\n", + "produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`." + ] + }, + { + "cell_type": "markdown", + "id": "6", + "metadata": { + "class": "col-page-right" + }, + "source": [ + "\n", + ":::{div}\n", + ":class: col-page-right\n", "\n", "```{mermaid}\n", - "%%{init: {\"themeVariables\": {\"fontSize\": \"36px\"}}}%%\n", + "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}}}%%\n", "flowchart TB\n", " subgraph objective[\"One objective in an AtomicAttack\"]\n", " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", @@ -537,6 +549,14 @@ " class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete;\n", " class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete;\n", "```\n", + ":::" + ] + }, + { + "cell_type": "markdown", + "id": "7", + "metadata": {}, + "source": [ "\n", "To keep retry paths readable, **Repeat from** nodes name the earlier step where execution resumes\n", "instead of drawing long return arrows across unrelated branches.\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 2a3223d339..178d23aab8 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -214,9 +214,14 @@ async def _build_atomic_attacks_async(self, *, context): # refusals and content-filter responses as blocked model responses, applies the configured scoring # policy, and returns a completed `AttackResult`. A refusal that does not achieve the objective normally # produces `AttackOutcome.FAILURE`; a response that achieves it produces `AttackOutcome.SUCCESS`. + +# %% [markdown] class="col-page-right" +# +# :::{div} +# :class: col-page-right # # ```{mermaid} -# %%{init: {"themeVariables": {"fontSize": "36px"}}}%% +# %%{init: {"themeVariables": {"fontSize": "24px"}}}%% # flowchart TB # subgraph objective["One objective in an AtomicAttack"] # START["Execute attack objective"] --> TARGET["Send or continue conversation"] @@ -273,6 +278,9 @@ async def _build_atomic_attacks_async(self, *, context): # class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; # class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; # ``` +# ::: + +# %% [markdown] # # To keep retry paths readable, **Repeat from** nodes name the earlier step where execution resumes # instead of drawing long return arrows across unrelated branches. From bb68952a672e34bcab628e8b2408e8e1a78679d5 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 13:27:08 -0700 Subject: [PATCH 16/18] docs: expand undersized Mermaid diagrams Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/blog/2026_04_14_scoring_scorers.md | 4 ++ doc/code/executor/2_multi_turn.ipynb | 48 ++++++++++++----- doc/code/executor/2_multi_turn.py | 8 +++ doc/code/framework.md | 4 ++ doc/code/memory/9_schema_diagram.md | 5 ++ doc/code/scenarios/0_attack_techniques.ipynb | 19 +++++-- doc/code/scenarios/0_attack_techniques.py | 6 +++ doc/code/scenarios/0_scenarios.ipynb | 2 +- doc/code/scenarios/0_scenarios.py | 2 +- doc/code/scoring/0_scoring.ipynb | 9 +++- doc/code/scoring/0_scoring.py | 7 ++- doc/code/scoring/3_combining_scorers.ipynb | 54 ++++++++++++++------ doc/code/scoring/3_combining_scorers.py | 11 +++- 13 files changed, 141 insertions(+), 38 deletions(-) diff --git a/doc/blog/2026_04_14_scoring_scorers.md b/doc/blog/2026_04_14_scoring_scorers.md index 55489ced78..a058b8d224 100644 --- a/doc/blog/2026_04_14_scoring_scorers.md +++ b/doc/blog/2026_04_14_scoring_scorers.md @@ -47,6 +47,9 @@ The `eval_hash` allows us to easily look up metrics associated with a specific s Here is a diagram of the full end-to-end process of our scorer evaluation framework. +:::{div} +:class: col-page-right + ```{mermaid} flowchart TB subgraph INPUT["📁 Input: Human-Labeled CSV Datasets"] @@ -97,6 +100,7 @@ flowchart TB FIND --> PRINTER FIND --> BEST ``` +::: 1. It begins by loading human-labeled datasets from saved `.csv` files, parsing version metadata, and creating a `HumanLabeledDataset` object that can be ingested by our evaluation methods. 2. The second step builds the scorer evaluation identifier from the scoring configuration; we can optionally check whether an entry already exists in our JSONL-formatted metrics registry by checking the eval hash. diff --git a/doc/code/executor/2_multi_turn.ipynb b/doc/code/executor/2_multi_turn.ipynb index eef75e78ee..e2d2d552a7 100644 --- a/doc/code/executor/2_multi_turn.ipynb +++ b/doc/code/executor/2_multi_turn.ipynb @@ -19,7 +19,19 @@ "The adaptive attacks below take two targets: the `objective_target` (the system under test) and an\n", "`AttackAdversarialConfig` naming the **adversarial target**. The adversarial target works best\n", "**without** content moderation, so it doesn't refuse to generate adversarial prompts. The fixed-script\n", - "and streaming attacks (Multi-Prompt Sending, Chunked Request, Barge-In) use only the objective target.\n", + "and streaming attacks (Multi-Prompt Sending, Chunked Request, Barge-In) use only the objective target." + ] + }, + { + "cell_type": "markdown", + "id": "1", + "metadata": { + "class": "col-page-right" + }, + "source": [ + "\n", + ":::{div}\n", + ":class: col-page-right\n", "\n", "```{mermaid}\n", "flowchart LR\n", @@ -30,6 +42,14 @@ " decision -- Yes --> done(\"Done\")\n", " decision -- No --> getPrompt\n", "```\n", + ":::" + ] + }, + { + "cell_type": "markdown", + "id": "2", + "metadata": {}, + "source": [ "\n", "| Attack | What it does |\n", "|---|---|\n", @@ -48,7 +68,7 @@ { "cell_type": "code", "execution_count": null, - "id": "1", + "id": "3", "metadata": {}, "outputs": [ { @@ -92,7 +112,7 @@ }, { "cell_type": "markdown", - "id": "2", + "id": "4", "metadata": {}, "source": [ "## Red Teaming\n", @@ -104,7 +124,7 @@ { "cell_type": "code", "execution_count": null, - "id": "3", + "id": "5", "metadata": {}, "outputs": [ { @@ -258,7 +278,7 @@ }, { "cell_type": "markdown", - "id": "4", + "id": "6", "metadata": {}, "source": [ "## Crescendo\n", @@ -270,7 +290,7 @@ { "cell_type": "code", "execution_count": null, - "id": "5", + "id": "7", "metadata": {}, "outputs": [ { @@ -577,7 +597,7 @@ }, { "cell_type": "markdown", - "id": "6", + "id": "8", "metadata": {}, "source": [ "## Tree of Attacks with Pruning (TAP)\n", @@ -590,7 +610,7 @@ { "cell_type": "code", "execution_count": null, - "id": "7", + "id": "9", "metadata": {}, "outputs": [ { @@ -720,7 +740,7 @@ }, { "cell_type": "markdown", - "id": "8", + "id": "10", "metadata": {}, "source": [ "## Multi-Prompt Sending\n", @@ -733,7 +753,7 @@ { "cell_type": "code", "execution_count": null, - "id": "9", + "id": "11", "metadata": {}, "outputs": [ { @@ -809,7 +829,7 @@ }, { "cell_type": "markdown", - "id": "10", + "id": "12", "metadata": {}, "source": [ "## Chunked Request\n", @@ -821,7 +841,7 @@ { "cell_type": "code", "execution_count": null, - "id": "11", + "id": "13", "metadata": {}, "outputs": [ { @@ -929,7 +949,7 @@ }, { "cell_type": "markdown", - "id": "12", + "id": "14", "metadata": {}, "source": [ "## Barge-In (streaming)\n", @@ -960,7 +980,7 @@ ], "metadata": { "jupytext": { - "cell_metadata_filter": "-all", + "cell_metadata_filter": "class,-all", "main_language": "python" }, "language_info": { diff --git a/doc/code/executor/2_multi_turn.py b/doc/code/executor/2_multi_turn.py index a9b12b8dfb..60c2cb6b8a 100644 --- a/doc/code/executor/2_multi_turn.py +++ b/doc/code/executor/2_multi_turn.py @@ -25,6 +25,11 @@ # `AttackAdversarialConfig` naming the **adversarial target**. The adversarial target works best # **without** content moderation, so it doesn't refuse to generate adversarial prompts. The fixed-script # and streaming attacks (Multi-Prompt Sending, Chunked Request, Barge-In) use only the objective target. + +# %% [markdown] class="col-page-right" +# +# :::{div} +# :class: col-page-right # # ```{mermaid} # flowchart LR @@ -35,6 +40,9 @@ # decision -- Yes --> done("Done") # decision -- No --> getPrompt # ``` +# ::: + +# %% [markdown] # # | Attack | What it does | # |---|---| diff --git a/doc/code/framework.md b/doc/code/framework.md index 4b53b5fcb8..a3938ef2dc 100644 --- a/doc/code/framework.md +++ b/doc/code/framework.md @@ -52,6 +52,9 @@ The main components of PyRIT are seeds, scenarios, attack techniques, executors The diagram below shows how the pieces fit together: entry points run **scenarios**, which package **datasets** with **attack techniques**; each technique drives an **attack/executor** that orchestrates **converters**, **targets**, and **scorers**; and a shared library layer (**memory**, **registry**, **models**, **output**, and more) supports all of them. +:::{div} +:class: col-page-right + ```mermaid flowchart TB subgraph entry [Entry points] @@ -105,6 +108,7 @@ flowchart TB class SCEN,TECH,ATK flow; class MEM,REG,MODEL,OUT libnode; ``` +::: The orchestration layers **nest from broadest to narrowest** — each owns less than the layer above it: diff --git a/doc/code/memory/9_schema_diagram.md b/doc/code/memory/9_schema_diagram.md index 67163b4b2a..ee9a6d490a 100644 --- a/doc/code/memory/9_schema_diagram.md +++ b/doc/code/memory/9_schema_diagram.md @@ -2,7 +2,11 @@ Our memory contains multiple components. This diagram shows a mapping of our database schema and how our components map together! The arrows indicate the values that map one database to another. +:::{div} +:class: col-page-right + ```{mermaid} +%%{init: {"themeVariables": {"fontSize": "20px"}}}%% flowchart LR subgraph EmbeddingData["EmbeddingData"] E_id["id (UUID)"] @@ -74,3 +78,4 @@ flowchart LR linkStyle 0 stroke:#ff8800ff,fill:none linkStyle 1 stroke:#14a519ff ``` +::: diff --git a/doc/code/scenarios/0_attack_techniques.ipynb b/doc/code/scenarios/0_attack_techniques.ipynb index 1792d332f4..708e59ed87 100644 --- a/doc/code/scenarios/0_attack_techniques.ipynb +++ b/doc/code/scenarios/0_attack_techniques.ipynb @@ -611,7 +611,19 @@ "On the command line this is the `--technique` flag of\n", "[`pyrit_scan`](../../scanner/1_pyrit_scan.ipynb); programmatically it's the `scenario_techniques`\n", "argument to `initialize_async`. The grouping is what lets `--technique single_turn` or\n", - "`--technique light` fan out to a whole family of techniques without naming each one.\n", + "`--technique light` fan out to a whole family of techniques without naming each one." + ] + }, + { + "cell_type": "markdown", + "id": "6", + "metadata": { + "class": "col-page-right" + }, + "source": [ + "\n", + ":::{div}\n", + ":class: col-page-right\n", "\n", "```mermaid\n", "flowchart LR\n", @@ -620,12 +632,13 @@ " S -->|name / tag / composite| Sc[\"Scenario\"]\n", " R -->|create with target + scorer| T[\"AttackTechnique
(attack + seeds)\"]\n", " Sc --> T\n", - "```" + "```\n", + ":::" ] }, { "cell_type": "markdown", - "id": "6", + "id": "7", "metadata": {}, "source": [ "## Relationship to single-turn attacks\n", diff --git a/doc/code/scenarios/0_attack_techniques.py b/doc/code/scenarios/0_attack_techniques.py index 0987eede29..220979eb3a 100644 --- a/doc/code/scenarios/0_attack_techniques.py +++ b/doc/code/scenarios/0_attack_techniques.py @@ -187,6 +187,11 @@ # [`pyrit_scan`](../../scanner/1_pyrit_scan.ipynb); programmatically it's the `scenario_techniques` # argument to `initialize_async`. The grouping is what lets `--technique single_turn` or # `--technique light` fan out to a whole family of techniques without naming each one. + +# %% [markdown] class="col-page-right" +# +# :::{div} +# :class: col-page-right # # ```mermaid # flowchart LR @@ -196,6 +201,7 @@ # R -->|create with target + scorer| T["AttackTechnique
(attack + seeds)"] # Sc --> T # ``` +# ::: # %% [markdown] # ## Relationship to single-turn attacks diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 3f95e355a6..6d2febb68d 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -492,7 +492,7 @@ ":class: col-page-right\n", "\n", "```{mermaid}\n", - "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}}}%%\n", + "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}, \"flowchart\": {\"subGraphTitleMargin\": {\"bottom\": 40}}}}%%\n", "flowchart TB\n", " subgraph objective[\"One objective in an AtomicAttack\"]\n", " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 178d23aab8..f8dd8e8148 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -221,7 +221,7 @@ async def _build_atomic_attacks_async(self, *, context): # :class: col-page-right # # ```{mermaid} -# %%{init: {"themeVariables": {"fontSize": "24px"}}}%% +# %%{init: {"themeVariables": {"fontSize": "24px"}, "flowchart": {"subGraphTitleMargin": {"bottom": 40}}}}%% # flowchart TB # subgraph objective["One objective in an AtomicAttack"] # START["Execute attack objective"] --> TARGET["Send or continue conversation"] diff --git a/doc/code/scoring/0_scoring.ipynb b/doc/code/scoring/0_scoring.ipynb index 941417d481..d04d0d5049 100644 --- a/doc/code/scoring/0_scoring.ipynb +++ b/doc/code/scoring/0_scoring.ipynb @@ -136,6 +136,7 @@ "cell_type": "markdown", "id": "4", "metadata": { + "class": "col-page-right", "lines_to_next_cell": 0 }, "source": [ @@ -144,7 +145,11 @@ "Every scorer derives from the abstract `Scorer` class through one of three intermediate\n", "bases: `TrueFalseScorer`, `FloatScaleScorer`, or `ConversationScorer`.\n", "\n", + ":::{div}\n", + ":class: col-page-right\n", + "\n", "```mermaid\n", + "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}}}%%\n", "classDiagram\n", " class Scorer { <> }\n", " class FloatScaleScorer { <> }\n", @@ -167,6 +172,7 @@ " TrueFalseScorer <|-- TrueFalseCompositeScorer\n", " TrueFalseScorer <|-- FloatScaleThresholdScorer\n", "```\n", + ":::\n", "\n", "`ConversationScorer` is never instantiated directly. `create_conversation_scorer()`\n", "builds a subclass that mixes it with a `TrueFalseScorer` or `FloatScaleScorer` so the\n", @@ -375,7 +381,8 @@ ], "metadata": { "jupytext": { - "cell_metadata_filter": "-all" + "cell_metadata_filter": "class,-all", + "main_language": "python" }, "language_info": { "codemirror_mode": { diff --git a/doc/code/scoring/0_scoring.py b/doc/code/scoring/0_scoring.py index c90ebac1d5..a3b6be0535 100644 --- a/doc/code/scoring/0_scoring.py +++ b/doc/code/scoring/0_scoring.py @@ -59,13 +59,17 @@ pd.set_option("display.max_rows", None) print(df.to_string(index=False)) -# %% [markdown] +# %% [markdown] class="col-page-right" # ## The class hierarchy # # Every scorer derives from the abstract `Scorer` class through one of three intermediate # bases: `TrueFalseScorer`, `FloatScaleScorer`, or `ConversationScorer`. # +# :::{div} +# :class: col-page-right +# # ```mermaid +# %%{init: {"themeVariables": {"fontSize": "24px"}}}%% # classDiagram # class Scorer { <> } # class FloatScaleScorer { <> } @@ -88,6 +92,7 @@ # TrueFalseScorer <|-- TrueFalseCompositeScorer # TrueFalseScorer <|-- FloatScaleThresholdScorer # ``` +# ::: # # `ConversationScorer` is never instantiated directly. `create_conversation_scorer()` # builds a subclass that mixes it with a `TrueFalseScorer` or `FloatScaleScorer` so the diff --git a/doc/code/scoring/3_combining_scorers.ipynb b/doc/code/scoring/3_combining_scorers.ipynb index 76952b51b6..b06425b7ad 100644 --- a/doc/code/scoring/3_combining_scorers.ipynb +++ b/doc/code/scoring/3_combining_scorers.ipynb @@ -13,9 +13,7 @@ { "cell_type": "markdown", "id": "1", - "metadata": { - "lines_to_next_cell": 0 - }, + "metadata": {}, "source": [ "Scorers are composable. Rather than building one complex scorer, combine small ones:\n", "aggregate several true/false scorers, invert a result, convert a float-scale score to a\n", @@ -29,7 +27,19 @@ "*is*. This diagram instead shows runtime composition: what each wrapper may contain.\n", "Solid arrows pass a scorer through `scorer=` or `scorers=`, while dashed arrows show\n", "the scorer base implemented by the resulting wrapper. An \"any\" input can therefore be\n", - "a leaf scorer or an already composed wrapper with that base, which enables stacking.\n", + "a leaf scorer or an already composed wrapper with that base, which enables stacking." + ] + }, + { + "cell_type": "markdown", + "id": "2", + "metadata": { + "class": "col-page-right" + }, + "source": [ + "\n", + ":::{div}\n", + ":class: col-page-right\n", "\n", "```mermaid\n", "flowchart LR\n", @@ -43,8 +53,9 @@ " direction TB\n", " COMP[\"TrueFalseCompositeScorer
AND · OR · MAJORITY\"]\n", " INV[\"TrueFalseInverterScorer
negates one result\"]\n", - " THRESH[\"FloatScaleThresholdScorer
score ≥ threshold\"]\n", " CONV[\"create_conversation_scorer()
scores concatenated history\"]\n", + " THRESH[\"FloatScaleThresholdScorer
score ≥ threshold\"]\n", + " CONV ~~~ THRESH\n", " end\n", "\n", " subgraph outputs[\"Resulting scorer kind\"]\n", @@ -72,6 +83,16 @@ " class COMP,INV,THRESH,CONV wrapper;\n", " class TFOUT,FSOUT output;\n", "```\n", + ":::" + ] + }, + { + "cell_type": "markdown", + "id": "3", + "metadata": { + "lines_to_next_cell": 0 + }, + "source": [ "\n", "`TrueFalseCompositeScorer` requires at least one `TrueFalseScorer` and combines their\n", "single results with `AND`, `OR`, or `MAJORITY`; `TrueFalseInverterScorer` accepts one\n", @@ -87,7 +108,7 @@ { "cell_type": "code", "execution_count": null, - "id": "2", + "id": "4", "metadata": {}, "outputs": [ { @@ -115,7 +136,7 @@ }, { "cell_type": "markdown", - "id": "3", + "id": "5", "metadata": { "lines_to_next_cell": 0 }, @@ -129,7 +150,7 @@ { "cell_type": "code", "execution_count": null, - "id": "4", + "id": "6", "metadata": {}, "outputs": [ { @@ -162,7 +183,7 @@ }, { "cell_type": "markdown", - "id": "5", + "id": "7", "metadata": { "lines_to_next_cell": 0 }, @@ -177,7 +198,7 @@ { "cell_type": "code", "execution_count": null, - "id": "6", + "id": "8", "metadata": {}, "outputs": [ { @@ -199,7 +220,7 @@ }, { "cell_type": "markdown", - "id": "7", + "id": "9", "metadata": { "lines_to_next_cell": 0 }, @@ -214,7 +235,7 @@ { "cell_type": "code", "execution_count": null, - "id": "8", + "id": "10", "metadata": {}, "outputs": [ { @@ -244,7 +265,7 @@ }, { "cell_type": "markdown", - "id": "9", + "id": "11", "metadata": { "lines_to_next_cell": 0 }, @@ -264,7 +285,7 @@ { "cell_type": "code", "execution_count": null, - "id": "10", + "id": "12", "metadata": {}, "outputs": [ { @@ -306,7 +327,7 @@ }, { "cell_type": "markdown", - "id": "11", + "id": "13", "metadata": {}, "source": [ "For a richer, real-world example, wrap a `SelfAskLikertScorer` with the\n", @@ -328,7 +349,8 @@ ], "metadata": { "jupytext": { - "cell_metadata_filter": "-all" + "cell_metadata_filter": "class,-all", + "main_language": "python" }, "language_info": { "codemirror_mode": { diff --git a/doc/code/scoring/3_combining_scorers.py b/doc/code/scoring/3_combining_scorers.py index c575bc4f5e..1a5ecd8881 100644 --- a/doc/code/scoring/3_combining_scorers.py +++ b/doc/code/scoring/3_combining_scorers.py @@ -25,6 +25,11 @@ # Solid arrows pass a scorer through `scorer=` or `scorers=`, while dashed arrows show # the scorer base implemented by the resulting wrapper. An "any" input can therefore be # a leaf scorer or an already composed wrapper with that base, which enables stacking. + +# %% [markdown] class="col-page-right" +# +# :::{div} +# :class: col-page-right # # ```mermaid # flowchart LR @@ -38,8 +43,9 @@ # direction TB # COMP["TrueFalseCompositeScorer
AND · OR · MAJORITY"] # INV["TrueFalseInverterScorer
negates one result"] -# THRESH["FloatScaleThresholdScorer
score ≥ threshold"] # CONV["create_conversation_scorer()
scores concatenated history"] +# THRESH["FloatScaleThresholdScorer
score ≥ threshold"] +# CONV ~~~ THRESH # end # # subgraph outputs["Resulting scorer kind"] @@ -67,6 +73,9 @@ # class COMP,INV,THRESH,CONV wrapper; # class TFOUT,FSOUT output; # ``` +# ::: + +# %% [markdown] # # `TrueFalseCompositeScorer` requires at least one `TrueFalseScorer` and combines their # single results with `AND`, `OR`, or `MAJORITY`; `TrueFalseInverterScorer` accepts one From 41cb901a6d29491b9be036f4322b0d2ccc0c3fc2 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 29 Jul 2026 16:11:11 -0700 Subject: [PATCH 17/18] Fix Mermaid label rendering Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 41ffe12e-e54d-42b1-8409-15b357eac74a --- doc/code/memory/9_schema_diagram.md | 1 - doc/code/scenarios/0_scenarios.ipynb | 14 +++++++------- doc/code/scenarios/0_scenarios.py | 14 +++++++------- doc/code/scoring/0_scoring.ipynb | 1 - doc/code/scoring/0_scoring.py | 1 - 5 files changed, 14 insertions(+), 17 deletions(-) diff --git a/doc/code/memory/9_schema_diagram.md b/doc/code/memory/9_schema_diagram.md index ee9a6d490a..2166b771fa 100644 --- a/doc/code/memory/9_schema_diagram.md +++ b/doc/code/memory/9_schema_diagram.md @@ -6,7 +6,6 @@ Our memory contains multiple components. This diagram shows a mapping of our da :class: col-page-right ```{mermaid} -%%{init: {"themeVariables": {"fontSize": "20px"}}}%% flowchart LR subgraph EmbeddingData["EmbeddingData"] E_id["id (UUID)"] diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index 6d2febb68d..c26939bb1e 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -492,14 +492,14 @@ ":class: col-page-right\n", "\n", "```{mermaid}\n", - "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}, \"flowchart\": {\"subGraphTitleMargin\": {\"bottom\": 40}}}}%%\n", + "%%{init: {\"flowchart\": {\"subGraphTitleMargin\": {\"bottom\": 40}, \"wrappingWidth\": 260}}}%%\n", "flowchart TB\n", - " subgraph objective[\"One objective in an AtomicAttack\"]\n", + " subgraph objective[\"One objective in
an AtomicAttack\"]\n", " START[\"Execute attack objective\"] --> TARGET[\"Send or continue conversation\"]\n", " TARGET --> TARGET_RESULT{\"Target result\"}\n", "\n", " TARGET_RESULT -->|Normal model output| RESPONSE[\"Persistable model response\"]\n", - " TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL[\"Persistable blocked model response
not an execution failure\"]\n", + " TARGET_RESULT -->|Handled refusal or
content-filter response| REFUSAL[\"Persistable blocked model response
not an execution failure\"]\n", " TARGET_RESULT --> RUNTIME_ERROR[\"Non-retryable runtime error\"]\n", " TARGET_RESULT -->|Retryable target error| TARGET_RETRY{\"Target retry budget remains?\"}\n", " TARGET_RETRY -->|No / exhausted| EXEC_ERROR[\"Execution exception propagates\"]\n", @@ -512,8 +512,8 @@ " SCORE_RESULT -->|Objective not achieved| MORE{\"Attack-specific attempt or turn remains?\"}\n", " SCORE_RESULT -->|Objective achieved| SUCCESS[\"AttackResult
AttackOutcome.SUCCESS\"]\n", " SCORE_RESULT -->|No objective scorer| UNDETERMINED[\"AttackResult
AttackOutcome.UNDETERMINED\"]\n", - " SCORE_RESULT -->|Invalid scorer JSON; retry remains| RETRY_SCORE[\"Repeat from
Apply configured scorer policy\"]\n", - " SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR\n", + " SCORE_RESULT -->|Invalid JSON;
retry remains| RETRY_SCORE[\"Repeat from
Apply configured scorer policy\"]\n", + " SCORE_RESULT -->|Scorer error or
out of retries| EXEC_ERROR\n", " MORE -->|Yes| RETRY_ATTACK[\"Repeat from
Send or continue conversation\"]\n", " MORE -->|No| FAILURE[\"AttackResult
AttackOutcome.FAILURE\"]\n", "\n", @@ -524,13 +524,13 @@ " ERROR_ROW --> INCOMPLETE[\"Incomplete objective
exception retained\"]\n", " end\n", "\n", - " subgraph aggregation[\"Scenario aggregation and resiliency\"]\n", + " subgraph aggregation[\"Scenario aggregation
and resiliency\"]\n", " COMPLETE --> EXECUTOR_RESULT[\"AttackExecutorResult\"]\n", " INCOMPLETE --> EXECUTOR_RESULT\n", " EXECUTOR_RESULT --> HAS_INCOMPLETE{\"Any incomplete objectives?\"}\n", "\n", " HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{\"Scenario retry budget remains?\"}\n", - " SCENARIO_RETRY -->|Yes; resume only incomplete objectives| RESUME[\"Repeat objective flow
for incomplete objectives\"]\n", + " SCENARIO_RETRY -->|Yes; resume only
incomplete objectives| RESUME[\"Repeat objective flow
for incomplete objectives\"]\n", " SCENARIO_RETRY -->|No / exhausted| PARTIAL[\"Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero\"]\n", " PARTIAL --> SCENARIO_FAILED[\"Persist ScenarioRunState.FAILED\"]\n", "\n", diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index f8dd8e8148..1b0c70b73f 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -221,14 +221,14 @@ async def _build_atomic_attacks_async(self, *, context): # :class: col-page-right # # ```{mermaid} -# %%{init: {"themeVariables": {"fontSize": "24px"}, "flowchart": {"subGraphTitleMargin": {"bottom": 40}}}}%% +# %%{init: {"flowchart": {"subGraphTitleMargin": {"bottom": 40}, "wrappingWidth": 260}}}%% # flowchart TB -# subgraph objective["One objective in an AtomicAttack"] +# subgraph objective["One objective in
an AtomicAttack"] # START["Execute attack objective"] --> TARGET["Send or continue conversation"] # TARGET --> TARGET_RESULT{"Target result"} # # TARGET_RESULT -->|Normal model output| RESPONSE["Persistable model response"] -# TARGET_RESULT -->|Handled refusal or content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] +# TARGET_RESULT -->|Handled refusal or
content-filter response| REFUSAL["Persistable blocked model response
not an execution failure"] # TARGET_RESULT --> RUNTIME_ERROR["Non-retryable runtime error"] # TARGET_RESULT -->|Retryable target error| TARGET_RETRY{"Target retry budget remains?"} # TARGET_RETRY -->|No / exhausted| EXEC_ERROR["Execution exception propagates"] @@ -241,8 +241,8 @@ async def _build_atomic_attacks_async(self, *, context): # SCORE_RESULT -->|Objective not achieved| MORE{"Attack-specific attempt or turn remains?"} # SCORE_RESULT -->|Objective achieved| SUCCESS["AttackResult
AttackOutcome.SUCCESS"] # SCORE_RESULT -->|No objective scorer| UNDETERMINED["AttackResult
AttackOutcome.UNDETERMINED"] -# SCORE_RESULT -->|Invalid scorer JSON; retry remains| RETRY_SCORE["Repeat from
Apply configured scorer policy"] -# SCORE_RESULT -->|Scorer error or JSON retries exhausted| EXEC_ERROR +# SCORE_RESULT -->|Invalid JSON;
retry remains| RETRY_SCORE["Repeat from
Apply configured scorer policy"] +# SCORE_RESULT -->|Scorer error or
out of retries| EXEC_ERROR # MORE -->|Yes| RETRY_ATTACK["Repeat from
Send or continue conversation"] # MORE -->|No| FAILURE["AttackResult
AttackOutcome.FAILURE"] # @@ -253,13 +253,13 @@ async def _build_atomic_attacks_async(self, *, context): # ERROR_ROW --> INCOMPLETE["Incomplete objective
exception retained"] # end # -# subgraph aggregation["Scenario aggregation and resiliency"] +# subgraph aggregation["Scenario aggregation
and resiliency"] # COMPLETE --> EXECUTOR_RESULT["AttackExecutorResult"] # INCOMPLETE --> EXECUTOR_RESULT # EXECUTOR_RESULT --> HAS_INCOMPLETE{"Any incomplete objectives?"} # # HAS_INCOMPLETE -->|Yes| SCENARIO_RETRY{"Scenario retry budget remains?"} -# SCENARIO_RETRY -->|Yes; resume only incomplete objectives| RESUME["Repeat objective flow
for incomplete objectives"] +# SCENARIO_RETRY -->|Yes; resume only
incomplete objectives| RESUME["Repeat objective flow
for incomplete objectives"] # SCENARIO_RETRY -->|No / exhausted| PARTIAL["Raise ScenarioPartialFailureException
structured counts, incomplete objectives, preserved cause
completed_count may be zero"] # PARTIAL --> SCENARIO_FAILED["Persist ScenarioRunState.FAILED"] # diff --git a/doc/code/scoring/0_scoring.ipynb b/doc/code/scoring/0_scoring.ipynb index d04d0d5049..e9d35f4ba4 100644 --- a/doc/code/scoring/0_scoring.ipynb +++ b/doc/code/scoring/0_scoring.ipynb @@ -149,7 +149,6 @@ ":class: col-page-right\n", "\n", "```mermaid\n", - "%%{init: {\"themeVariables\": {\"fontSize\": \"24px\"}}}%%\n", "classDiagram\n", " class Scorer { <> }\n", " class FloatScaleScorer { <> }\n", diff --git a/doc/code/scoring/0_scoring.py b/doc/code/scoring/0_scoring.py index a3b6be0535..d3e373dba6 100644 --- a/doc/code/scoring/0_scoring.py +++ b/doc/code/scoring/0_scoring.py @@ -69,7 +69,6 @@ # :class: col-page-right # # ```mermaid -# %%{init: {"themeVariables": {"fontSize": "24px"}}}%% # classDiagram # class Scorer { <> } # class FloatScaleScorer { <> } From e4e25e40dc2265e23e0faa60d94878824ecf80c5 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Sat, 1 Aug 2026 22:12:55 -0700 Subject: [PATCH 18/18] DOC Widen mermaid diagrams via notebook cell metadata only MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inner `:::{div}` with `:class: col-page-right` is a no-op inside a notebook markdown cell: MyST renders it as `
` whose parent is the notebook block wrapper (`display: block`), so the `grid-column` rule never applies. Verified in a rendered build — with the cell metadata removed, the diagram falls back to body width (662px vs 1014px). Only direct children of the article grid honor the class, which is why the pattern still works in the `.md` files. Drop the redundant div from the five notebooks and split the class hierarchy diagram in 0_scoring into its own cell so the heading and surrounding prose stay at body width instead of running under the CONTENTS control. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6cef7ed3-4e13-48ee-9289-09e1acc8a29c --- doc/code/executor/2_multi_turn.ipynb | 6 +-- doc/code/executor/2_multi_turn.py | 4 -- doc/code/scenarios/0_attack_techniques.ipynb | 6 +-- doc/code/scenarios/0_attack_techniques.py | 4 -- doc/code/scenarios/0_scenarios.ipynb | 6 +-- doc/code/scenarios/0_scenarios.py | 4 -- doc/code/scoring/0_scoring.ipynb | 43 ++++++++++++-------- doc/code/scoring/0_scoring.py | 10 ++--- doc/code/scoring/3_combining_scorers.ipynb | 6 +-- doc/code/scoring/3_combining_scorers.py | 4 -- 10 files changed, 36 insertions(+), 57 deletions(-) diff --git a/doc/code/executor/2_multi_turn.ipynb b/doc/code/executor/2_multi_turn.ipynb index e2d2d552a7..99fe3afc97 100644 --- a/doc/code/executor/2_multi_turn.ipynb +++ b/doc/code/executor/2_multi_turn.ipynb @@ -29,9 +29,6 @@ "class": "col-page-right" }, "source": [ - "\n", - ":::{div}\n", - ":class: col-page-right\n", "\n", "```{mermaid}\n", "flowchart LR\n", @@ -41,8 +38,7 @@ " scoreResp --> decision[\"Objective met
or turn limit?\"]\n", " decision -- Yes --> done(\"Done\")\n", " decision -- No --> getPrompt\n", - "```\n", - ":::" + "```" ] }, { diff --git a/doc/code/executor/2_multi_turn.py b/doc/code/executor/2_multi_turn.py index 60c2cb6b8a..c3e498f66b 100644 --- a/doc/code/executor/2_multi_turn.py +++ b/doc/code/executor/2_multi_turn.py @@ -28,9 +28,6 @@ # %% [markdown] class="col-page-right" # -# :::{div} -# :class: col-page-right -# # ```{mermaid} # flowchart LR # start("Start") --> getPrompt["Adversarial model
generates a prompt"] @@ -40,7 +37,6 @@ # decision -- Yes --> done("Done") # decision -- No --> getPrompt # ``` -# ::: # %% [markdown] # diff --git a/doc/code/scenarios/0_attack_techniques.ipynb b/doc/code/scenarios/0_attack_techniques.ipynb index 708e59ed87..556a1fca40 100644 --- a/doc/code/scenarios/0_attack_techniques.ipynb +++ b/doc/code/scenarios/0_attack_techniques.ipynb @@ -621,9 +621,6 @@ "class": "col-page-right" }, "source": [ - "\n", - ":::{div}\n", - ":class: col-page-right\n", "\n", "```mermaid\n", "flowchart LR\n", @@ -632,8 +629,7 @@ " S -->|name / tag / composite| Sc[\"Scenario\"]\n", " R -->|create with target + scorer| T[\"AttackTechnique
(attack + seeds)\"]\n", " Sc --> T\n", - "```\n", - ":::" + "```" ] }, { diff --git a/doc/code/scenarios/0_attack_techniques.py b/doc/code/scenarios/0_attack_techniques.py index 220979eb3a..41a149fc7f 100644 --- a/doc/code/scenarios/0_attack_techniques.py +++ b/doc/code/scenarios/0_attack_techniques.py @@ -190,9 +190,6 @@ # %% [markdown] class="col-page-right" # -# :::{div} -# :class: col-page-right -# # ```mermaid # flowchart LR # I["TechniqueInitializer"] -->|registers factories| R["AttackTechniqueRegistry"] @@ -201,7 +198,6 @@ # R -->|create with target + scorer| T["AttackTechnique
(attack + seeds)"] # Sc --> T # ``` -# ::: # %% [markdown] # ## Relationship to single-turn attacks diff --git a/doc/code/scenarios/0_scenarios.ipynb b/doc/code/scenarios/0_scenarios.ipynb index c26939bb1e..c25cd3481b 100644 --- a/doc/code/scenarios/0_scenarios.ipynb +++ b/doc/code/scenarios/0_scenarios.ipynb @@ -487,9 +487,6 @@ "class": "col-page-right" }, "source": [ - "\n", - ":::{div}\n", - ":class: col-page-right\n", "\n", "```{mermaid}\n", "%%{init: {\"flowchart\": {\"subGraphTitleMargin\": {\"bottom\": 40}, \"wrappingWidth\": 260}}}%%\n", @@ -548,8 +545,7 @@ " class RETRY_TARGET,RETRY_SCORE,RETRY_ATTACK,RESUME,NEXT_ATTACK retry;\n", " class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete;\n", " class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete;\n", - "```\n", - ":::" + "```" ] }, { diff --git a/doc/code/scenarios/0_scenarios.py b/doc/code/scenarios/0_scenarios.py index 1b0c70b73f..db143ed444 100644 --- a/doc/code/scenarios/0_scenarios.py +++ b/doc/code/scenarios/0_scenarios.py @@ -217,9 +217,6 @@ async def _build_atomic_attacks_async(self, *, context): # %% [markdown] class="col-page-right" # -# :::{div} -# :class: col-page-right -# # ```{mermaid} # %%{init: {"flowchart": {"subGraphTitleMargin": {"bottom": 40}, "wrappingWidth": 260}}}%% # flowchart TB @@ -278,7 +275,6 @@ async def _build_atomic_attacks_async(self, *, context): # class SUCCESS,FAILURE,UNDETERMINED,COMPLETE,SCENARIO_COMPLETE complete; # class RUNTIME_ERROR,EXEC_ERROR,ERROR_ROW,INCOMPLETE,PARTIAL,SCENARIO_FAILED incomplete; # ``` -# ::: # %% [markdown] # diff --git a/doc/code/scoring/0_scoring.ipynb b/doc/code/scoring/0_scoring.ipynb index e9d35f4ba4..851f9ce320 100644 --- a/doc/code/scoring/0_scoring.ipynb +++ b/doc/code/scoring/0_scoring.ipynb @@ -135,18 +135,21 @@ { "cell_type": "markdown", "id": "4", - "metadata": { - "class": "col-page-right", - "lines_to_next_cell": 0 - }, + "metadata": {}, "source": [ "## The class hierarchy\n", "\n", "Every scorer derives from the abstract `Scorer` class through one of three intermediate\n", - "bases: `TrueFalseScorer`, `FloatScaleScorer`, or `ConversationScorer`.\n", - "\n", - ":::{div}\n", - ":class: col-page-right\n", + "bases: `TrueFalseScorer`, `FloatScaleScorer`, or `ConversationScorer`." + ] + }, + { + "cell_type": "markdown", + "id": "5", + "metadata": { + "class": "col-page-right" + }, + "source": [ "\n", "```mermaid\n", "classDiagram\n", @@ -170,8 +173,16 @@ " TrueFalseScorer <|-- SelfAskCategoryScorer\n", " TrueFalseScorer <|-- TrueFalseCompositeScorer\n", " TrueFalseScorer <|-- FloatScaleThresholdScorer\n", - "```\n", - ":::\n", + "```" + ] + }, + { + "cell_type": "markdown", + "id": "6", + "metadata": { + "lines_to_next_cell": 0 + }, + "source": [ "\n", "`ConversationScorer` is never instantiated directly. `create_conversation_scorer()`\n", "builds a subclass that mixes it with a `TrueFalseScorer` or `FloatScaleScorer` so the\n", @@ -181,7 +192,7 @@ }, { "cell_type": "markdown", - "id": "5", + "id": "7", "metadata": { "lines_to_next_cell": 0 }, @@ -195,7 +206,7 @@ { "cell_type": "code", "execution_count": null, - "id": "6", + "id": "8", "metadata": {}, "outputs": [ { @@ -221,7 +232,7 @@ }, { "cell_type": "markdown", - "id": "7", + "id": "9", "metadata": { "lines_to_next_cell": 0 }, @@ -238,7 +249,7 @@ { "cell_type": "code", "execution_count": null, - "id": "8", + "id": "10", "metadata": {}, "outputs": [ { @@ -303,7 +314,7 @@ }, { "cell_type": "markdown", - "id": "9", + "id": "11", "metadata": { "lines_to_next_cell": 0 }, @@ -318,7 +329,7 @@ { "cell_type": "code", "execution_count": null, - "id": "10", + "id": "12", "metadata": {}, "outputs": [ { diff --git a/doc/code/scoring/0_scoring.py b/doc/code/scoring/0_scoring.py index d3e373dba6..a9f3eb4f04 100644 --- a/doc/code/scoring/0_scoring.py +++ b/doc/code/scoring/0_scoring.py @@ -59,14 +59,13 @@ pd.set_option("display.max_rows", None) print(df.to_string(index=False)) -# %% [markdown] class="col-page-right" +# %% [markdown] # ## The class hierarchy # # Every scorer derives from the abstract `Scorer` class through one of three intermediate # bases: `TrueFalseScorer`, `FloatScaleScorer`, or `ConversationScorer`. -# -# :::{div} -# :class: col-page-right + +# %% [markdown] class="col-page-right" # # ```mermaid # classDiagram @@ -91,7 +90,8 @@ # TrueFalseScorer <|-- TrueFalseCompositeScorer # TrueFalseScorer <|-- FloatScaleThresholdScorer # ``` -# ::: + +# %% [markdown] # # `ConversationScorer` is never instantiated directly. `create_conversation_scorer()` # builds a subclass that mixes it with a `TrueFalseScorer` or `FloatScaleScorer` so the diff --git a/doc/code/scoring/3_combining_scorers.ipynb b/doc/code/scoring/3_combining_scorers.ipynb index b06425b7ad..04fd8385aa 100644 --- a/doc/code/scoring/3_combining_scorers.ipynb +++ b/doc/code/scoring/3_combining_scorers.ipynb @@ -37,9 +37,6 @@ "class": "col-page-right" }, "source": [ - "\n", - ":::{div}\n", - ":class: col-page-right\n", "\n", "```mermaid\n", "flowchart LR\n", @@ -82,8 +79,7 @@ " class TF,FS input;\n", " class COMP,INV,THRESH,CONV wrapper;\n", " class TFOUT,FSOUT output;\n", - "```\n", - ":::" + "```" ] }, { diff --git a/doc/code/scoring/3_combining_scorers.py b/doc/code/scoring/3_combining_scorers.py index 1a5ecd8881..e665e2b58e 100644 --- a/doc/code/scoring/3_combining_scorers.py +++ b/doc/code/scoring/3_combining_scorers.py @@ -28,9 +28,6 @@ # %% [markdown] class="col-page-right" # -# :::{div} -# :class: col-page-right -# # ```mermaid # flowchart LR # subgraph inputs["Supported inputs"] @@ -73,7 +70,6 @@ # class COMP,INV,THRESH,CONV wrapper; # class TFOUT,FSOUT output; # ``` -# ::: # %% [markdown] #