Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

FEAT: Add supports_prefill capability and PrefillAttack strategy

オープン
  • 何か問題がありますか？
#3,270 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 2 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
35/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
huggingface, python
領域
ai, security

調査の方向性

Start with TargetCapabilities and CapabilityName to see how existing flags are declared, then read SkeletonKeyAttack in pyrit/executor/attack/single_turn/ to see how a trailing assistant message is already used to prime a target. The open questions (one PR or two, which targets set the flag) need a maintainer decision before the work starts. Done means the flag exists and round-trips through serialization, and PrefillAttack raises on targets without PREFILL in TARGET_REQUIREMENTS.

索引モデルが issue の本文から書いたものです。

説明

Is your feature request related to a problem? Please describe.

Some targets let the caller write the first part of the model's reply: the request ends with an open assistant turn, and the model continues it. Prefill attacks rely on this, and recent work shows they're effective against current open-weight models (arXiv:2602.14689 tested more than 20 strategies). PyRIT can't test for this properly:

  1. TargetCapabilities doesn't record whether a target continues a trailing assistant message. Completion endpoints and local Hugging Face models do. Most hosted chat APIs ignore it or reject the request. Without a flag, an attack that depends on prefill can't require it.
  2. You can end a prepended_conversation on an assistant message, the same way SkeletonKeyAttack primes a target, but no attack is built around it. On a target that drops the assistant turn, the model just answers the user message, and the result looks like the model resisted the attack.
Describe the solution you'd like
  1. Capability. Add CapabilityName.PREFILL = "supports_prefill" and supports_prefill: bool = False on TargetCapabilities. Set it for targets that continue a trailing assistant turn (completion-style and locally hosted ones) and leave it false for hosted chat APIs.
  2. Attack. Add PrefillAttack(PromptSendingAttack) in pyrit/executor/attack/single_turn/, next to SkeletonKeyAttack. It takes the objective and a prefill_text, ends the conversation with an assistant message carrying that text, sends it, and scores the continuation. TARGET_REQUIREMENTS requires PREFILL, so an unsupported target raises an error up front.

Unit tests would cover the prefill being the final assistant piece, the error on an unsupported target, scoring, and the new field round-tripping through serialization. The PR would also add a doc entry.

Describe alternatives you've considered, if relevant
  • Only the capability flag. Users would build the prepended_conversation by hand each time, and nothing would check the target.
  • A converter. Converters change prompt text and can't add an assistant turn.
Additional context

Hosted APIs are dropping support for caller-set assistant turns, so this mostly matters for open-weight and completion-style targets. PyRIT tests those too.

Questions:

  1. Do you want a supports_prefill capability?
  2. One PR, or the capability first and the attack second?
  3. Which targets should have the flag set, beyond the obvious ones?
主要言語
Python
スター
4.6k
フォーク
944
平均マージ
2日 18時間
マージ済み PR（30日）
358

環境構築

Codespaces で開く

このプロジェクトの開発コンテナを、あなたの GitHub アカウントでブラウザ上に起動します。

  • Dockerfile・Docker Compose ファイルなし
  • プルリクエストのテンプレートあり
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoft/PyRIT のほかの issue

microsoft/PyRIT の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。