Improve adversarial benchmark dataset and scoring - #2551
Draft
hannahwestra25 wants to merge 25 commits into
Draft
hannahwestra25 wants to merge 25 commits into
hannahwestra25 wants to merge 25 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
This reverts commit cd131ef.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Use task-achievement evaluation so benchmark objectives outside Azure Content Safety categories are scored correctly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Balance capped objective selection across harm categories and classify Azure cyber policy rejections as blocked scorer responses so benchmark attacks finish undetermined instead of erroring. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Treat blocked adversarial-chat responses as completed attack failures, including simulated-conversation preparation, while preserving unrelated error propagation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
hannahwestra25
added a commit
to hannahwestra25/PyRIT
that referenced
this pull request
Sep 16, 2026
- New build_scripts/import_adversarial_benchmark_snapshot.py upserts an externally-produced technique-metrics.json (e.g. downloaded from an Azure DevOps pipeline artifact) into the committed benchmark metrics store, reusing the same upsert_benchmark_metrics() as the local exporter. - Supports --default-objective-target/--default-objective-scorer/ --default-dataset to backfill identity fields on rows produced by an exporter version that predates them, without overwriting a field a row already has. - Ingested the 6 real technique-metrics rows from Azure DevOps build 16150 (a preview run of PR microsoft#2551's not-yet-merged dataset/pipeline updates), backfilling objective_target=openai_chat and dataset=adversarial_benchmark_v1 per the run's actual pipeline parameters; objective_scorer is <unknown> since it wasn't captured by that pipeline version. - Documented the provenance of these rows and the new ingestion path in the dashboard docs, and regenerated the benchmark leaderboard HTML fragment. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Add stable objective identity fields, committed-store reuse, exporter upserts, and the rerunnable benchmark wrapper while preserving this branch's exact-result cache and balanced sampling behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Run the benchmark exporter with committed-store updates enabled and cover the pipeline command contract. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Match the persisted identifier shape, query both planned and inner attack hashes, and recover scorer identity for scoreless terminal refusals. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Gate committed-store updates behind an opt-in parameter and use a secret GitHub token to publish changes on an automation branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a4b6deb5-a62a-403d-9ed9-2eb369b5174d
Adds a one-line diagnostic to the 'Publish benchmark store update as a PR' step that prints only the character count of GITHUB_PAT (never the value) before the existing not-configured guard. To be reverted once diagnosed. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Azure DevOps macro substitution ($(var)) rewrites a literal $(GITHUB_PAT)
reference anywhere it textually appears in a task's script body, not just
in the env: mapping. The guard's "unresolved macro" fallback compared
$GITHUB_PAT against that same literal text written directly in the
script, so once the secret was actually configured, ADO substituted the
real secret into both sides of the comparison -- making it always match
and incorrectly report "GITHUB_PAT is not configured" even when it was
correctly set (confirmed live: a genuine 93-char PAT still tripped the
guard).
Build the comparison sentinel from separate bash-only parts
(dollar='$'; unresolved_macro="${dollar}(GITHUB_PAT)") so ADO's
compile-time scanner never sees a literal $(GITHUB_PAT) substring to
rewrite in the script; it's reassembled only once bash runs. Verified
locally (bash -n, and running the extracted guard with bash) that this
now correctly falls through when GITHUB_PAT holds a real value, and
still reports "not configured" both when the variable is empty and
when its macro is genuinely left unresolved.
Also removes the temporary debug diagnostic added while investigating
this, and updates the pipeline unit test to assert the corrected guard
construction plus the absence of the vulnerable literal comparison.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the adversarial benchmark with a balanced 120-objective P2M dataset, Role Play/Crescendo/TAP defaults, and task-achievement scoring.
The Azure DevOps pipeline now defaults to a deterministic quick profile: 24 objectives with exactly three from each of the eight harm categories and reduced TAP search settings. A full 120-objective profile remains available. Completed success/failure results are restored from and republished to a same-branch SQLite artifact using exact objective, technique, target, scorer, slot, and scenario-version compatibility checks.
Benchmark scoring treats provider-blocked scorer responses as undetermined and retryable. Adversarial-model refusals are now completed attack failures—including refusals during simulated-conversation preparation—rather than incomplete objectives that fail the entire scenario. Unrelated provider, parsing, target, and scorer errors still propagate.
Validation on the latest merged main: