Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

FEAT: Add supports_prefill capability and PrefillAttack strategy

未关闭
  • 哪里不对？
#3,270 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 2 天内回复

@shashank03-dev 已经在做这个了。

开始于 2026年10月17日。

  • #3283 来自 @shashank03-dev —— 未关闭

评估

难度
3/5
预计耗时
1-2 天
新手友好度
35/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
huggingface, python
领域
ai, security

调研方向

Start with TargetCapabilities and CapabilityName to see how existing flags are declared, then read SkeletonKeyAttack in pyrit/executor/attack/single_turn/ to see how a trailing assistant message is already used to prime a target. The open questions (one PR or two, which targets set the flag) need a maintainer decision before the work starts. Done means the flag exists and round-trips through serialization, and PrefillAttack raises on targets without PREFILL in TARGET_REQUIREMENTS.

由索引模型根据 Issue 内容生成。

描述

Is your feature request related to a problem? Please describe.

Some targets let the caller write the first part of the model's reply: the request ends with an open assistant turn, and the model continues it. Prefill attacks rely on this, and recent work shows they're effective against current open-weight models (arXiv:2602.14689 tested more than 20 strategies). PyRIT can't test for this properly:

  1. TargetCapabilities doesn't record whether a target continues a trailing assistant message. Completion endpoints and local Hugging Face models do. Most hosted chat APIs ignore it or reject the request. Without a flag, an attack that depends on prefill can't require it.
  2. You can end a prepended_conversation on an assistant message, the same way SkeletonKeyAttack primes a target, but no attack is built around it. On a target that drops the assistant turn, the model just answers the user message, and the result looks like the model resisted the attack.
Describe the solution you'd like
  1. Capability. Add CapabilityName.PREFILL = "supports_prefill" and supports_prefill: bool = False on TargetCapabilities. Set it for targets that continue a trailing assistant turn (completion-style and locally hosted ones) and leave it false for hosted chat APIs.
  2. Attack. Add PrefillAttack(PromptSendingAttack) in pyrit/executor/attack/single_turn/, next to SkeletonKeyAttack. It takes the objective and a prefill_text, ends the conversation with an assistant message carrying that text, sends it, and scores the continuation. TARGET_REQUIREMENTS requires PREFILL, so an unsupported target raises an error up front.

Unit tests would cover the prefill being the final assistant piece, the error on an unsupported target, scoring, and the new field round-tripping through serialization. The PR would also add a doc entry.

Describe alternatives you've considered, if relevant
  • Only the capability flag. Users would build the prepended_conversation by hand each time, and nothing would check the target.
  • A converter. Converters change prompt text and can't add an assistant turn.
Additional context

Hosted APIs are dropping support for caller-set assistant turns, so this mostly matters for open-weight and completion-style targets. PyRIT tests those too.

Questions:

  1. Do you want a supports_prefill capability?
  2. One PR, or the capability first and the attack second?
  3. Which targets should have the flag set, beyond the obvious ones?
主要语言
Python
星标
4.6k
派生
944
平均合并
2 天 18 小时
30 天内合并 PR
369

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/PyRIT 的其他 Issue

查看 microsoft/PyRIT 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。