Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

FEAT: Add Echo Chamber multi-turn attack strategy

Abierto
  • ¿Algo no está bien?
#3,269 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
34/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
ai, security

Línea de trabajo

Start with the existing Crescendo attack under pyrit/executor/attack/multi_turn/, since the issue reuses its turn loop, backtracking, AttackAdversarialConfig, AttackScoringConfig and SelfAskRefusalScorer. Confirm scope with maintainers first, since the issue's three questions are still open. Done means a new EchoChamberAttack class with its prompt under pyrit/datasets/executors/echo_chamber/, plus unit tests using mocked adversarial and objective targets that cover the seed phase, the echo turn, refusal with backtrack, and stop conditions.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Is your feature request related to a problem? Please describe.

PyRIT's multi-turn attacks (Crescendo, TAP, PAIR, RedTeaming) all escalate the request turn by turn. Echo Chamber (NeuralTrust, 2025) works differently. It gets the target to write benign text related to the objective, then keeps asking it to expand on its own earlier answers. The conversation drifts toward the objective through the model's own outputs, and no single user turn looks harmful, so per-turn filters and refusal checks don't catch it.

The paper reports 45.0% attack success on an AdvBench-derived set, against 28.6% for Crescendo and 9.5% for DAN on the same tasks. It covers a failure mode the current strategies don't.

I couldn't find an existing issue or PR for it.

Describe the solution you'd like

A new EchoChamberAttack in pyrit/executor/attack/multi_turn/, following the published flow:

  1. Seed. Derive neutral keywords from the objective, have the target write a few sentences from them, pick the one closest to the objective, and ask the target to expand on it.
  2. Echo loop. Each turn, the adversarial chat reads the transcript and writes a follow-up that builds on what the target already said, without stating the objective.
  3. Backtrack. On refusal, drop the exchange and retry from another angle.
  4. Score. Run the objective scorer each turn and stop on success or at max_turns.

It would reuse what Crescendo uses: AttackAdversarialConfig, AttackScoringConfig, AttackConverterConfig, SelfAskRefusalScorer as the default refusal scorer, conversation-duplication backtracking, and MULTI_TURN + EDITABLE_HISTORY target requirements. The adversarial system prompt would go in pyrit/datasets/executors/echo_chamber/, adapted from NeuralTrust's MIT-licensed reference code with attribution.

The PR would include unit tests with mocked adversarial and objective targets (seed phase, echo turn, refusal and backtrack, stop conditions) and a doc entry next to the other multi-turn attacks.

Describe alternatives you've considered, if relevant
  • Subclassing CrescendoAttack. The turn loop and backtracking are the same, but the seed phase and the adversarial prompt differ, so I think a separate class is clearer. I'm fine going the other way if you prefer.
  • A converter. Wouldn't work, since the attack depends on what the target said in earlier turns.
Additional context

The paper's numbers come from 12 objectives across GPT-4.1, GPT-5, and Gemini models, so the sample is small. I'll run it against a target I can reach and post the results here before opening the PR.

Questions:

  1. Is this in scope as a new multi-turn attack?
  2. Separate class or Crescendo subclass?
  3. Any preference for how the NeuralTrust attribution should look in the prompt YAML?
Lenguaje dominante
Python
Estrellas
4.6k
Forks
962
Merge medio
2 d 16 h
PR fusionados (30 d)
367

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

  • Sin Dockerfile ni archivo de Docker Compose
  • Tiene una plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de microsoft/PyRIT

Todos los issues de microsoft/PyRIT

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.