BUG TAP/PAIR skip their first turn after a prepended conversation (no adversarial system prompt, next_message ignored)
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 68/100
Research direction
Start by tracing TAP and PAIR through _TreeOfAttacksNode._is_first_turn(), then inspect the mock-target scenario described in the issue. Done means a prepended conversation does not suppress the first turn: the adversarial system prompt is set, next_message is used, and the scorer can receive the initial prompt instead of both attacks reporting FAILURE.
Written by the indexing model from the issue text.
Description
If you pass a prepended_conversation to TAP or PAIR, the first turn never happens properly.
_TreeOfAttacksNode._is_first_turn() checks whether the objective conversation in memory is empty, but the prepended messages are written into that same conversation. So after any prepend it's never the first turn, which means:
set_adversarial_system_promptnever runs, so the adversarial chat has no system prompt at all, and the prepended context is never usednext_messageis silently ignored- with a system-only prepend, the subsequent-turn path raises "Cannot proceed without an assistant response", every node gets pruned, and the attack reports FAILURE without sending anything
With mock targets, a scorer that would succeed right away, and just a system message prepended:
TreeOfAttacksWithPruningAttack: FAILURE | prompts sent to target: [] | adversarial system prompts set: 0
PAIRAttack: FAILURE | prompts sent to target: [] | adversarial system prompts set: 0
Fix: don't count the prepended messages when deciding whether it's the first turn.
- Dominant language
- Python
- Stars
- 4.5k
- Forks
- 896
- Avg merge
- 3d 8h
- Merged PRs (30d)
- 191
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/PyRIT
-
BUG HarmBench loader drops ContextString, so contextual behaviors are sent without their context Open
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
Similar issues
-
agent-ready documentation needs-triage
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 91/100
-
workflow-status page template still says reusable workflows are "triggered only by workflow_call:" Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
instance instance add
Difficulty 1/5 Under an hour Newbie friendliness 72/100
searxng/searx-instances#939 · 1 comment ·
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100