Repository navigation
FIX: Do not score write-only target deliveries as attack responses - #3757
Open
Dev3 ^~^ (shashank03-dev) wants to merge 2 commits into
Open
Dev3 ^~^ (shashank03-dev) wants to merge 2 commits into
Dev3 ^~^ (shashank03-dev) wants to merge 2 commits into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #3701
When a write-only target such as
TextTargetreturns no response,PromptNormalizerhands back the sent request, and attacks scored that request as if it were the target's reply. A scorer matching the objective then reported SUCCESS with no response at all. The normalizer now marks that case explicitly (PromptNormalizer.is_write_only_delivery()), and every caller that scores objective-target output uses it.PromptSendingAttack,MultiPromptSendingAttack: a delivered request is never scored as response text and never becomeslast_response. Scorers that judge side effects (FileWriteScorer,OtelToolCallScorer) still score the turn; with none configured the result isUNDETERMINED. Multi-prompt judges only the final send.ChunkedRequestAttack: scores the chunks that were received;UNDETERMINEDonly when no chunk produced output.RedTeamingAttack,CrescendoAttack,TreeOfAttacksWithPruningAttack: raise a clear error, since they need a response on every turn.The fuzzer and the XPIA workflow also score target output; I left them out since they aren't attacks.
Tests: end-to-end runs of each attack with write-only targets (including assistant-role requests, mixed delivery/response sequences, and a
FileWriteScoreragent that writes a file and returns nothing), normalizer and scoring contract tests, and a backend chat-scoring test.