BUG TokenBijectionConverter cannot represent a literal hyphen, so "e-mail" encodes identically to "email" and decodes without the hyphen
维护者通常 2 天内回复
评估
调研方向
Start with pyrit/converter/bijection_converter.py and inspect TokenBijectionConverter's encoding, decoding pattern, and teaching instructions. Run the reproduction with the provided mapping, then check the converter tests under tests/unit/converter. Done means literal hyphens round-trip and e-mail encodes differently from email; the issue author says they already have a fix and regression tests ready to submit.
由索引模型根据 Issue 内容生成。
描述
Describe the bug
TokenBijectionConverter (pyrit/converter/bijection_converter.py) joins the code words of one plaintext word with - (_TOKEN_DELIMITER), and encode() passes every unmapped character through unchanged. A hyphen in the plaintext is therefore emitted as the same character as the delimiter, and lands between two code-word runs exactly where an inserted delimiter would. decode()'s pattern (\b(tok)(?:-(tok))*\b) consumes it as a delimiter, so the hyphen disappears:
| plaintext | encoded (mapping x -> xxx) |
decoded |
|---|---|---|
email |
eee-mmm-aaa-iii-lll |
email |
e-mail |
eee-mmm-aaa-iii-lll |
email |
self-harm |
sss-eee-lll-fff-hhh-aaa-rrr-mmm |
selfharm |
The class docstring says the delimiter is there "to keep them legible and unambiguously decodable", and the teaching instructions tell the target to "join adjacent code words with hyphens", which leaves the model no way to write a literal hyphen either. So the prompt sent to the target loses hyphens on the way in ("self-harm" becomes "selfharm" once decoded), and any hyphen in the target's answer is lost on the way back.
This is the same collision class that has already been fixed twice in this file: #2696 (literal apostrophes vs. _CASE_MARKER) and #2741 (literal digits vs. digit tokens) in DigitBijectionConverter. The hyphen case in TokenBijectionConverter was not covered.
Steps/Code to Reproduce
import string
from pyrit.converter import TokenBijectionConverter
mapping = {c: c * 3 for c in string.ascii_lowercase} # explicit mapping, no tokenizer needed
conv = TokenBijectionConverter(tokenizer=None, mapping=mapping)
for text in ("e-mail", "email", "self-harm"):
enc = conv.encode(prompt=text)
print(text, "->", enc, "->", conv.decode(enc))
Expected Results
Each input round-trips, and e-mail does not encode to the same text as email.
e-mail -> eee--mmm-aaa-iii-lll -> e-mail
email -> eee-mmm-aaa-iii-lll -> email
self-harm -> sss-eee-lll-fff--hhh-aaa-rrr-mmm -> self-harm
Actual Results
e-mail -> eee-mmm-aaa-iii-lll -> email
email -> eee-mmm-aaa-iii-lll -> email
self-harm -> sss-eee-lll-fff-hhh-aaa-rrr-mmm -> selfharm
Hyphens that are not directly between two letters (a - b, -lead, trail-) happen to survive because the decode pattern requires a code word on both sides, so the loss is specific to hyphenated words, which is the common case.
Suggested fix
Escape a literal hyphen as a doubled delimiter (--) on encode, the same way DigitBijectionConverter doubles a literal apostrophe or tilde, and have the decode pattern match -- first and restore it to one hyphen. A doubled delimiter can never be produced by joining code words, so it is unambiguous. The teaching instructions should tell the target to write a literal hyphen as two hyphens.
I have the fix with regression tests ready and can open the PR. The new round-trip cases fail on main (6 failed) and pass with the change; tests/unit/converter passes in full.
Versions
- OS: macOS 26.5
- Python version: 3.14.8
- PyRIT version: 1.2.0.dev0, installed from
main(0a5abbf9) in editable mode
- 主要语言
- Python
- 星标
- 4.6k
- 派生
- 944
- 平均合并
- 2 天 20 小时
- 30 天内合并 PR
- 309
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
microsoft/PyRIT 的其他 Issue
-
BUG UnicodeReplacementConverter writes characters outside the BMP as invalid five-digit \u escapes可能已有人在做 @ShivamSharma43 于 2 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 2 天内回复
-
BUG: label queries only return the final conversation of an attack可能已有人在做 @richlundeen 于 2 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 85/100
microsoft/PyRIT#3095 · 1 条评论 · 已指派 1 人 ·
维护者通常 2 天内回复
-
BUG Configuration keeps runtime-status errors after polling recovers可能已有人在做 @joeyvictorino 于 2 天前认领。 未关闭Bug: triage GUI help wanted
难度 2/5 1-3 小时 新手友好度 86/100
microsoft/PyRIT#2868 · 4 条评论 · 已指派 1 人 ·
维护者通常 2 天内回复
-
BUG JailBreakV-28K loader reads a `transfer_attack_type` column that does not exist upstream and drops the real `from` / `transfer_from_llm` provenance可能已有人在做 @kushaltalati 于 1 天前认领。 未关闭
难度 1/5 1-3 小时 新手友好度 35/100
microsoft/PyRIT#3161 · 1 条评论 ·
维护者通常 2 天内回复
-
BUG QuestionAnswerScorer counts a wrong option as correct when the answer appears inside a longer word or number可能已有人在做 @barkha1research-ai 于 1 天前认领。 未关闭Bug: triage
难度 2/5 1-3 小时 新手友好度 25/100
维护者通常 2 天内回复
相似的 Issue
-
python triage
难度 2/5 1-3 小时 新手友好度 82/100
microsoft/semantic-kernel#14590 ·
维护者通常 3 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 85/100
pinterest/pymemcache#662 ·
维护者通常 1 天内回复
-
难度 2/5 半天 新手友好度 62/100
gnocchixyz/gnocchi#1527 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 64/100
tenstorrent/tt-model-manager#181 ·
维护者通常 1 天内回复