Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Crescendo backtracking keeps the refused prompt when the objective target made a tool call

オープン
  • 何か問題がありますか？
#3,252 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

@RachelWanggg がすでに取り組んでいます。

2026年10月15日 から。

  • #3253 @RachelWanggg による — オープン

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
30/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python
領域
ai, databases

調査の方向性

The fixed-count slice is in duplicate_conversation_excluding_last_turn_async in pyrit/memory/memory_interface.py, and its only caller is pyrit/executor/attack/multi_turn/crescendo.py. Run the reproduction script in the issue to see the backtracked conversation keep question 2 and its function_call. Pull request #3253 is already open against this, so read it first. Done means a backtrack removes every message of the refused turn, including tool-call and tool-output messages, and leaves no orphan function_call.

索引モデルが issue の本文から書いたものです。

説明

Describe the bug

When CrescendoAttack backtracks after a refusal, duplicate_conversation_excluding_last_turn_async is supposed to drop the last turn, "before the last user request" per its docstring. It instead drops a fixed number of sequences: 1 if the last message is user or system, otherwise 2. That assumes a turn is one user message plus one assistant message.

An OpenAIResponseTarget with tools (custom_functions, tools or tool_providers) returns several messages per turn: the function call, the tool output and the final answer, and PromptNormalizer stores each one as its own sequence. If the refused turn made a tool call, the backtracked conversation keeps the refused prompt and that turn's function call, and drops only the tool output and the refusal. The next turn then sends the refused prompt again, plus a function_call with no matching function_call_output.

This is the only caller of the method in the library (crescendo.py).

Steps/Code to Reproduce
import asyncio
import json

from pyrit.memory import CentralMemory
from pyrit.models import MessagePiece
from pyrit.setup import IN_MEMORY, initialize_pyrit_async

CONVERSATION_ID = "crescendo-with-tools"


def tool_calling_turn(sequence: int, prompt: str, call_id: str, answer: str) -> list[MessagePiece]:
    # What OpenAIResponseTarget's tool loop stores for one turn: the prompt, the model's function_call,
    # the tool output and the final answer, each as its own message.
    return [
        MessagePiece(role="user", original_value=prompt, conversation_id=CONVERSATION_ID, sequence=sequence),
        MessagePiece(
            role="assistant",
            original_value=json.dumps({"type": "function_call", "call_id": call_id, "name": "lookup", "arguments": "{}"}),
            original_value_data_type="function_call",
            conversation_id=CONVERSATION_ID,
            sequence=sequence + 1,
        ),
        MessagePiece(
            role="tool",
            original_value=json.dumps({"type": "function_call_output", "call_id": call_id, "output": "result"}),
            original_value_data_type="function_call_output",
            conversation_id=CONVERSATION_ID,
            sequence=sequence + 2,
        ),
        MessagePiece(role="assistant", original_value=answer, conversation_id=CONVERSATION_ID, sequence=sequence + 3),
    ]


async def main() -> None:
    await initialize_pyrit_async(memory_db_type=IN_MEMORY)
    memory = CentralMemory.get_memory_instance()
    pieces = tool_calling_turn(0, "question 1", "call_1", "answer 1")
    pieces += tool_calling_turn(4, "question 2", "call_2", "I can't help with that")
    await memory.add_message_pieces_to_memory_async(message_pieces=pieces)

    # What CrescendoAttack does after the refusal scorer flags "question 2"
    backtracked_id = await memory.duplicate_conversation_excluding_last_turn_async(conversation_id=CONVERSATION_ID)
    for piece in await memory.get_message_pieces_async(conversation_id=backtracked_id):
        print(piece.api_role, piece.original_value_data_type, piece.original_value)


if __name__ == "__main__":
    asyncio.run(main())
Expected Results

Only the first turn is kept:

user text question 1
assistant function_call {"type": "function_call", "call_id": "call_1", "name": "lookup", "arguments": "{}"}
tool function_call_output {"type": "function_call_output", "call_id": "call_1", "output": "result"}
assistant text answer 1
Actual Results

The refused prompt and its function call are kept:

user text question 1
assistant function_call {"type": "function_call", "call_id": "call_1", "name": "lookup", "arguments": "{}"}
tool function_call_output {"type": "function_call_output", "call_id": "call_1", "output": "result"}
assistant text answer 1
user text question 2
assistant function_call {"type": "function_call", "call_id": "call_2", "name": "lookup", "arguments": "{}"}

With a real OpenAIResponseTarget (only the OpenAI client mocked) and PromptNormalizer, the request sent after the backtrack still contains the refused question, and its input has function_call ids ['call_1', 'call_2'] but function_call_output ids only ['call_1'].

Versions
  • OS: macOS (Apple Silicon)
  • Python version: 3.12.13
  • PyRIT version: installed from main (68487b2e) in editable mode
主要言語
Python
スター
4.6k
フォーク
944
平均マージ
2日 18時間
マージ済み PR（30日）
358

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoft/PyRIT のほかの issue

microsoft/PyRIT の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。