Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

FEAT: Add Echo Chamber multi-turn attack strategy

Ouverte
  • Quelque chose ne va pas ?
#3,269 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 2 jours

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
34/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
python
Domaine
ai, security

Piste de recherche

Start with the existing Crescendo attack under pyrit/executor/attack/multi_turn/, since the issue reuses its turn loop, backtracking, AttackAdversarialConfig, AttackScoringConfig and SelfAskRefusalScorer. Confirm scope with maintainers first, since the issue's three questions are still open. Done means a new EchoChamberAttack class with its prompt under pyrit/datasets/executors/echo_chamber/, plus unit tests using mocked adversarial and objective targets that cover the seed phase, the echo turn, refusal with backtrack, and stop conditions.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Is your feature request related to a problem? Please describe.

PyRIT's multi-turn attacks (Crescendo, TAP, PAIR, RedTeaming) all escalate the request turn by turn. Echo Chamber (NeuralTrust, 2025) works differently. It gets the target to write benign text related to the objective, then keeps asking it to expand on its own earlier answers. The conversation drifts toward the objective through the model's own outputs, and no single user turn looks harmful, so per-turn filters and refusal checks don't catch it.

The paper reports 45.0% attack success on an AdvBench-derived set, against 28.6% for Crescendo and 9.5% for DAN on the same tasks. It covers a failure mode the current strategies don't.

I couldn't find an existing issue or PR for it.

Describe the solution you'd like

A new EchoChamberAttack in pyrit/executor/attack/multi_turn/, following the published flow:

  1. Seed. Derive neutral keywords from the objective, have the target write a few sentences from them, pick the one closest to the objective, and ask the target to expand on it.
  2. Echo loop. Each turn, the adversarial chat reads the transcript and writes a follow-up that builds on what the target already said, without stating the objective.
  3. Backtrack. On refusal, drop the exchange and retry from another angle.
  4. Score. Run the objective scorer each turn and stop on success or at max_turns.

It would reuse what Crescendo uses: AttackAdversarialConfig, AttackScoringConfig, AttackConverterConfig, SelfAskRefusalScorer as the default refusal scorer, conversation-duplication backtracking, and MULTI_TURN + EDITABLE_HISTORY target requirements. The adversarial system prompt would go in pyrit/datasets/executors/echo_chamber/, adapted from NeuralTrust's MIT-licensed reference code with attribution.

The PR would include unit tests with mocked adversarial and objective targets (seed phase, echo turn, refusal and backtrack, stop conditions) and a doc entry next to the other multi-turn attacks.

Describe alternatives you've considered, if relevant
  • Subclassing CrescendoAttack. The turn loop and backtracking are the same, but the seed phase and the adversarial prompt differ, so I think a separate class is clearer. I'm fine going the other way if you prefer.
  • A converter. Wouldn't work, since the attack depends on what the target said in earlier turns.
Additional context

The paper's numbers come from 12 objectives across GPT-4.1, GPT-5, and Gemini models, so the sample is small. I'll run it against a target I can reach and post the results here before opening the PR.

Questions:

  1. Is this in scope as a new multi-turn attack?
  2. Separate class or Crescendo subclass?
  3. Any preference for how the NeuralTrust attribution should look in the prompt YAML?
Langage dominant
Python
Étoiles
4.6k
Forks
944
Merge moyen
2 j 18 h
PR mergées (30 j)
369

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

  • Aucun Dockerfile ni fichier Docker Compose
  • Propose un modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de microsoft/PyRIT

Toutes les issues de microsoft/PyRIT

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.