[Siddhant Rajhans (siddhant-rajhans)]

Description

PyRIT loads HarmBench's behaviors but has no scorer for HarmBench's attack-success classifier (Mazeika et al., 2024, arXiv:2402.04249), the fine-tuned cais/HarmBench-Llama-2-13b-cls that answers whether a response is an instance of a behavior. This adds HarmBenchScorer, which reproduces HarmBench's classification step.

• HarmBenchScorer sends HarmBench's classifier prompt, standard or contextual, to a target serving the classifier and returns True when it answers "Yes", so it can serve as an attack's objective scorer. The objective is the behavior; a contextual behavior is read the way harmbench_dataset.py builds it. HarmBench's copyright behaviors are scored by hashing and are out of scope.
• The bundled prompts are HarmBench's (MIT), including the Llama 2 [INST] wrapper the classifier was trained on, so the classifier is served from a completions endpoint (OpenAICompletionTarget), as with WildGuardScorer.
• Like HarmBench, each response is clipped to 512 tokens of the classifier's tokenizer (pinned revision, loaded on first use; needs the huggingface extra), which also keeps long responses inside the classifier's 2,048-token context. clip_generations=False sends full responses.
• The parser reads "yes" or "no" case-insensitively, as HarmBench does, and raises InvalidJsonException otherwise, so the judge retry applies. Judgments replay like LlamaGuard's.

With the real classifier on the 395 human-labelled responses in scorer_evals/objective, the scorer gives the same label as HarmBench's own pipeline (evaluate_completions.py clipping, then vllm.LLM.generate at temperature 0) for 394 of 395 responses; the one difference is between vLLM's offline and server modes on an identical request. Against the human labels, ObjectiveScorerEvaluator gives accuracy 0.878, precision 0.918, recall 0.822 and F1 0.867.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.