Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Judge-supplied metadata can override the stored score value; extraction and rendering trust quoted JSON and unfenced role lines

Aperta
  • Qualcosa non va?
#3,323 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 2 giorni

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
46/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
ai, security, testing-qa

Direzione di ricerca

Start with the scorer paths named in the issue: normalize_score_to_float, ConversationScorer, and the sibling metadata stripping in true_false_score_aggregator.py and true_false_inverter_scorer.py. Review the JSON handling precedent in decision_scorer.py and the existing retry boundary, then reproduce each reported case with mocked LLM transport. Done means quoted JSON and forged role lines cannot alter the verdict, and metadata cannot override the validated score.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Judge-supplied metadata can override the stored score value; extraction and rendering trust quoted JSON and unfenced role lines

Summary

Three verdict-integrity defects in the scorer stack, each demonstrated end to end against real scorers (LLM transport mocked, everything else real):

  1. Metadata override (fixed in the companion PR): normalize_score_to_float prefers a judge-supplied original_float_value metadata key over the validated score_value. A raw float-scale scorer with a judge body of score_value: "0.0" + metadata: {"original_float_value": "1.0"} stores 0.0 while every consumer computes 1.0, and a 7.5 escapes [0,1]. TAP's success gate and Crescendo's feedback prompt consume the raw float.

  2. Earliest-JSON-wins extraction (fixed in the companion PR): a judge reply quoting a target-embedded JSON object before its own verdict has the decoy parsed as the verdict. Repro: judge authored score_value: false, persisted Score was True with the attacker's rationale verbatim. No injection needed. Eleven judge prompts instruct JSON but none forbid quoting, and the refusal prompts' few-shot rationales quote the reply.

  3. Transcript forgery (fixed in the companion PR): ConversationScorer's unfenced {role}: {text} rendering lets a target reply forge User:/Assistant: turns in the judge's view. Control refusal scored False. The same conversation with two embedded role lines scored True.

Context

The judged text is by design the adversary's output (the tool exists to grade hostile content), so the structural defenses (parse-time key strip, ambiguity rejection, turn fencing) carry the load that prompt-level instructions cannot. Each fix follows an in-repo precedent: the sibling metadata strips (true_false_score_aggregator.py:153, true_false_inverter_scorer.py:132), the decision scorer's JSON-encoding of target text (decision_scorer.py:208-236), and the existing retry boundary.

Repros available on request. Each is self-contained and exits 0 with the exploit confirmed at HEAD and blocked on the fix branches.

Lingua principale
Python
Stelle
4.6k
Fork
962
Merge medio
2g 15h
PR unite (30g)
398

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/PyRIT

Tutte le issue di microsoft/PyRIT

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.