Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

FEAT: Add supports_prefill capability and PrefillAttack strategy

Aperta
  • Qualcosa non va?
#3,270 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
huggingface, python
Ambito
ai, security

Direzione di ricerca

Start with TargetCapabilities and CapabilityName to see how existing flags are declared, then read SkeletonKeyAttack in pyrit/executor/attack/single_turn/ to see how a trailing assistant message is already used to prime a target. The open questions (one PR or two, which targets set the flag) need a maintainer decision before the work starts. Done means the flag exists and round-trips through serialization, and PrefillAttack raises on targets without PREFILL in TARGET_REQUIREMENTS.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Is your feature request related to a problem? Please describe.

Some targets let the caller write the first part of the model's reply: the request ends with an open assistant turn, and the model continues it. Prefill attacks rely on this, and recent work shows they're effective against current open-weight models (arXiv:2602.14689 tested more than 20 strategies). PyRIT can't test for this properly:

  1. TargetCapabilities doesn't record whether a target continues a trailing assistant message. Completion endpoints and local Hugging Face models do. Most hosted chat APIs ignore it or reject the request. Without a flag, an attack that depends on prefill can't require it.
  2. You can end a prepended_conversation on an assistant message, the same way SkeletonKeyAttack primes a target, but no attack is built around it. On a target that drops the assistant turn, the model just answers the user message, and the result looks like the model resisted the attack.
Describe the solution you'd like
  1. Capability. Add CapabilityName.PREFILL = "supports_prefill" and supports_prefill: bool = False on TargetCapabilities. Set it for targets that continue a trailing assistant turn (completion-style and locally hosted ones) and leave it false for hosted chat APIs.
  2. Attack. Add PrefillAttack(PromptSendingAttack) in pyrit/executor/attack/single_turn/, next to SkeletonKeyAttack. It takes the objective and a prefill_text, ends the conversation with an assistant message carrying that text, sends it, and scores the continuation. TARGET_REQUIREMENTS requires PREFILL, so an unsupported target raises an error up front.

Unit tests would cover the prefill being the final assistant piece, the error on an unsupported target, scoring, and the new field round-tripping through serialization. The PR would also add a doc entry.

Describe alternatives you've considered, if relevant
  • Only the capability flag. Users would build the prepended_conversation by hand each time, and nothing would check the target.
  • A converter. Converters change prompt text and can't add an assistant turn.
Additional context

Hosted APIs are dropping support for caller-set assistant turns, so this mostly matters for open-weight and completion-style targets. PyRIT tests those too.

Questions:

  1. Do you want a supports_prefill capability?
  2. One PR, or the capability first and the attack second?
  3. Which targets should have the flag set, beyond the obvious ones?
Lingua principale
Python
Stelle
4.6k
Fork
944
Merge medio
2g 18h
PR unite (30g)
358

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/PyRIT

Tutte le issue di microsoft/PyRIT

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.