Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

FEAT: Add Echo Chamber multi-turn attack strategy

未关闭
  • 哪里不对？
#3,269 2 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 2 天内回复

@shashank03-dev 已经在做这个了。

开始于 2026年10月20日。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
34/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
python
领域
ai, security

调研方向

Start with the existing Crescendo attack under pyrit/executor/attack/multi_turn/, since the issue reuses its turn loop, backtracking, AttackAdversarialConfig, AttackScoringConfig and SelfAskRefusalScorer. Confirm scope with maintainers first, since the issue's three questions are still open. Done means a new EchoChamberAttack class with its prompt under pyrit/datasets/executors/echo_chamber/, plus unit tests using mocked adversarial and objective targets that cover the seed phase, the echo turn, refusal with backtrack, and stop conditions.

由索引模型根据 Issue 内容生成。

描述

Is your feature request related to a problem? Please describe.

PyRIT's multi-turn attacks (Crescendo, TAP, PAIR, RedTeaming) all escalate the request turn by turn. Echo Chamber (NeuralTrust, 2025) works differently. It gets the target to write benign text related to the objective, then keeps asking it to expand on its own earlier answers. The conversation drifts toward the objective through the model's own outputs, and no single user turn looks harmful, so per-turn filters and refusal checks don't catch it.

The paper reports 45.0% attack success on an AdvBench-derived set, against 28.6% for Crescendo and 9.5% for DAN on the same tasks. It covers a failure mode the current strategies don't.

I couldn't find an existing issue or PR for it.

Describe the solution you'd like

A new EchoChamberAttack in pyrit/executor/attack/multi_turn/, following the published flow:

  1. Seed. Derive neutral keywords from the objective, have the target write a few sentences from them, pick the one closest to the objective, and ask the target to expand on it.
  2. Echo loop. Each turn, the adversarial chat reads the transcript and writes a follow-up that builds on what the target already said, without stating the objective.
  3. Backtrack. On refusal, drop the exchange and retry from another angle.
  4. Score. Run the objective scorer each turn and stop on success or at max_turns.

It would reuse what Crescendo uses: AttackAdversarialConfig, AttackScoringConfig, AttackConverterConfig, SelfAskRefusalScorer as the default refusal scorer, conversation-duplication backtracking, and MULTI_TURN + EDITABLE_HISTORY target requirements. The adversarial system prompt would go in pyrit/datasets/executors/echo_chamber/, adapted from NeuralTrust's MIT-licensed reference code with attribution.

The PR would include unit tests with mocked adversarial and objective targets (seed phase, echo turn, refusal and backtrack, stop conditions) and a doc entry next to the other multi-turn attacks.

Describe alternatives you've considered, if relevant
  • Subclassing CrescendoAttack. The turn loop and backtracking are the same, but the seed phase and the adversarial prompt differ, so I think a separate class is clearer. I'm fine going the other way if you prefer.
  • A converter. Wouldn't work, since the attack depends on what the target said in earlier turns.
Additional context

The paper's numbers come from 12 objectives across GPT-4.1, GPT-5, and Gemini models, so the sample is small. I'll run it against a target I can reach and post the results here before opening the PR.

Questions:

  1. Is this in scope as a new multi-turn attack?
  2. Separate class or Crescendo subclass?
  3. Any preference for how the NeuralTrust attribution should look in the prompt YAML?
主要语言
Python
星标
4.6k
派生
962
平均合并
2 天 15 小时
30 天内合并 PR
398

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/PyRIT 的其他 Issue

查看 microsoft/PyRIT 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。