Skip to content

v1.0.0

Choose a tag to compare

View all tags
@romanlutz romanlutz released this 24 Jul 02:23
· 934 commits to main since this release
v1.0.0
729b7dd

What's changed?

Welcome to PyRIT v1.0.0! This major release establishes the v1 architecture for composing scenarios, attack techniques, executors, registries, identifiers, and memory. It includes intentional breaking changes, so review the changes below carefully before upgrading.

⚠️ Breaking changes

  • Scenarios now compose registered techniques — scenario strategies were renamed to techniques, the Scenario registry became the construction path, and legacy scenario scaffolding was removed (#2115, #2123, #2153).
  • Component construction moved to registries — the BuildableRegistry foundation now powers attack techniques, targets, scorers, converters, scenarios, and initializers (#1963, #2057, #2087, #2101, #2122).
  • Converters and attack framing were reorganized — PromptConverter is now Converter; role play, FlipAttack, and context-compliance behavior moved into techniques; system prompts are standardized on prepended_conversation, and the expired single-turn path was removed (#2040, #2160, #2161, #2177, #2178, #2245).
  • Conversation and memory models changed — conversation-scoped state moved from MessagePiece into the new Conversation model, MemoryExporter/export_conversations were removed, and memory operations were consolidated (#1856, #1950, #2207).
  • Pre-v1 compatibility paths are gone — APIs deprecated for 0.15 and the remaining pre-v1 internal/public compatibility shims were removed (#1951, #2111, #2195).
  • Several scenario contracts changed — Jailbreak now follows a dataset × techniques × jailbreaks model, Psychosocial uses a per-subharm cross-product, and CLI/backend component construction now uses the v1 model and registry layers (#1997, #2191, #2192).

🧩 Framework, identity, and memory

  • Introduced strongly typed component identifiers and persisted them as normalized, content-addressed graphs, making evaluation identity stable and queryable across targets, scorers, converters, scenarios, and attacks (#2007, #2050, #2164).
  • Added explicit architecture boundaries for scenarios, techniques, executors, and shared layers, alongside registry-backed construction throughout PyRIT (#2089, #2107, #2124).
  • Added the v1 conversation and identifier schema, a deliberate production migration guard/runbook, and bounded migration backfills for production-scale databases (#1950, #2028, #2164, #2266).

🎯 Attacks and scenarios

  • Added Prompt Decomposition/DrAttack, word-game decomposition, Garak Web Injection, Garak Doctor, Policy Puppetry, and fully wired GCG extension protocols (#1902, #2003, #2051, #2064, #2067, #2070).
  • Added capability-aware multimodal feedback for Crescendo, RedTeaming, and TAP; unified adversarial-chat context; and made end-of-technique converters configurable (#1377, #2053, #2066).
  • Improved adaptive scenarios, iterative image state, technique metadata, scenario resume behavior, and registry alignment (#2152, #2167, #2186, #2188, #2210, #2220).

📊 Scoring

  • Added composable response handlers and a pure-composition API for True/False scorers, completed by typed rubrics across the LLM scorer rollout (#2125, #2146, #2157).
  • Added a dedicated LlamaGuard scorer and OWASP LLM02 output-side scorers for SSRF, SSTI, XXE, open redirect, and LDAP injection (#1867, #2118).
  • Improved scorer behavior for blocked/content-filtered responses, identity configuration, and duplicate memory writes (#1989, #2022, #2072).

📚 Datasets

  • Added MM-SafetyBench, XL-SafetyBench, 0DIN Threat Feed, WildGuardMix, Garak remote datasets, and a local Jailbreak dataset (#1790, #1791, #1827, #2034, #2063, #2068).
  • Added JSON-schema validation to seed and scorer datasets, refactored dataset configuration, exposed dataset parameters from memory, and standardized harm categories across loaders (#1432, #2017, #2071, #2120, #2158).

🖥️ Targets, CLI, and CoPyRIT

  • Added LiteLLMChatTarget, Azure Key Vault secret loading, Azure Entra authentication fallback for text embeddings, and Round Robin target support in the GUI (#1944, #1961, #2154, #2235).
  • Added guided onboarding, shareable URL-driven views, a feedback dialog, and objective-target system-prompt configuration; improved accessibility and responsive chat/target configuration (#1956, #1981, #1990, #1994, #2056, #2069, #2224, #2226).
  • Improved CLI usability with dataset discovery, typed parameter coercion, underlying-model display, local server URLs, robust Windows output, and clearer target initializer guidance (#2092, #2106, #2194, #2196, #2212, #2213, #2215, #2248).

🔒 Security and reliability

  • Hardened archive extraction, Azure Blob URL validation and metadata filenames, Entra-auth forwarding, and Key Vault provisioning (#1957, #2049, #2180, #2183, #2193).
  • Fixed Windows configuration/output encoding, non-blocking Hugging Face model loading, retry handling for malformed JSON, and several GUI/CLI failure paths (#2047, #2110, #2145, #2184, #2211, #2247).

Full list of changes

New Contributors

Full Changelog: v0.14.0...v1.0.0

Contributors

Raulster24, fitzpr, and 23 other contributors
Assets 2
Loading