Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

FEAT: Add supports_prefill capability and PrefillAttack strategy

Ouverte
  • Quelque chose ne va pas ?
#3,270 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 2 jours

@shashank03-dev y travaille déjà.

Depuis le 17/10/2026.

  • #3283 par @shashank03-dev — ouverte

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Active
Stack technique
huggingface, python
Domaine
ai, security

Piste de recherche

Start with TargetCapabilities and CapabilityName to see how existing flags are declared, then read SkeletonKeyAttack in pyrit/executor/attack/single_turn/ to see how a trailing assistant message is already used to prime a target. The open questions (one PR or two, which targets set the flag) need a maintainer decision before the work starts. Done means the flag exists and round-trips through serialization, and PrefillAttack raises on targets without PREFILL in TARGET_REQUIREMENTS.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Is your feature request related to a problem? Please describe.

Some targets let the caller write the first part of the model's reply: the request ends with an open assistant turn, and the model continues it. Prefill attacks rely on this, and recent work shows they're effective against current open-weight models (arXiv:2602.14689 tested more than 20 strategies). PyRIT can't test for this properly:

  1. TargetCapabilities doesn't record whether a target continues a trailing assistant message. Completion endpoints and local Hugging Face models do. Most hosted chat APIs ignore it or reject the request. Without a flag, an attack that depends on prefill can't require it.
  2. You can end a prepended_conversation on an assistant message, the same way SkeletonKeyAttack primes a target, but no attack is built around it. On a target that drops the assistant turn, the model just answers the user message, and the result looks like the model resisted the attack.
Describe the solution you'd like
  1. Capability. Add CapabilityName.PREFILL = "supports_prefill" and supports_prefill: bool = False on TargetCapabilities. Set it for targets that continue a trailing assistant turn (completion-style and locally hosted ones) and leave it false for hosted chat APIs.
  2. Attack. Add PrefillAttack(PromptSendingAttack) in pyrit/executor/attack/single_turn/, next to SkeletonKeyAttack. It takes the objective and a prefill_text, ends the conversation with an assistant message carrying that text, sends it, and scores the continuation. TARGET_REQUIREMENTS requires PREFILL, so an unsupported target raises an error up front.

Unit tests would cover the prefill being the final assistant piece, the error on an unsupported target, scoring, and the new field round-tripping through serialization. The PR would also add a doc entry.

Describe alternatives you've considered, if relevant
  • Only the capability flag. Users would build the prepended_conversation by hand each time, and nothing would check the target.
  • A converter. Converters change prompt text and can't add an assistant turn.
Additional context

Hosted APIs are dropping support for caller-set assistant turns, so this mostly matters for open-weight and completion-style targets. PyRIT tests those too.

Questions:

  1. Do you want a supports_prefill capability?
  2. One PR, or the capability first and the attack second?
  3. Which targets should have the flag set, beyond the obvious ones?
Langage dominant
Python
Étoiles
4.6k
Forks
944
Merge moyen
2 j 18 h
PR mergées (30 j)
369

Préparer son environnement

Ouvrir dans Codespaces

Lance le conteneur de développement du projet dans votre navigateur, avec votre propre compte GitHub.

  • Aucun Dockerfile ni fichier Docker Compose
  • Propose un modèle de pull request
  • Aucun guide de contribution

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de microsoft/PyRIT

Toutes les issues de microsoft/PyRIT

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.