FEAT: Add Insecure Code Scorer

[KutalVolkan]

Overview

This PR introduces a basic implementation of an LLM-based scorer, InsecureCodeScorer, which uses a float_scale scoring system to evaluate potential security vulnerabilities in code snippets. The scorer leverages an LLM to analyze code for security issues and returns a normalized float score based on the severity of detected vulnerabilities.

Work Completed

• pyrit/score/__init__.py:

  • Added InsecureCodeScorer to the module’s imports, enabling it to be used throughout the package.

• assets/demo_scorer_definitions/insecure_code_scorer.yaml:

  • Created a YAML configuration file to store prompts and instructions for InsecureCodeScorer. This enables easy adjustments to LLM prompts and scoring instructions.

• pyrit/score/insecure_code_scorer.py:

  • Implemented the core functionality of InsecureCodeScorer, leveraging _score_value_with_llm to retrieve scores from the LLM and normalize them on a float_scale.

• doc/code/scoring/insecure_code_scorer.ipynb:

  • Created a Jupyter Notebook documentation for InsecureCodeScorer, showcasing example usage, scoring results, and explanations of the scoring process.

Next Steps

• Fix the KeyError in the Jupyter Notebook and optimize the insecure_code_scorer.yaml configuration file.

Related Issue

Issue #513

[KutalVolkan]

Hello @rdheekonda ,

Thank you so much for the feedback! I believe I’ve resolved all the issues and cleaned up the code. Could you please verify? Of course, feel free to add any further feedback, and I’ll address it.

I have one question, though—I think you may address this anyway: I'm not sure where exactly I should place the insecure_code_scorer.yaml file. Currently, it’s located at assets/demo_scorer_definitions/insecure_code_scorer.yaml.

Thank you!

[rdheekonda]

Hello @rdheekonda ,

Thank you so much for the feedback! I believe I’ve resolved all the issues and cleaned up the code. Could you please verify? Of course, feel free to add any further feedback, and I’ll address it.

I have one question, though—I think you may address this anyway: I'm not sure where exactly I should place the insecure_code_scorer.yaml file. Currently, it’s located at assets/demo_scorer_definitions/insecure_code_scorer.yaml.

Thank you!

Thank you for your contribution. We're organizing all scoring system prompts in this path https://github.com/Azure/PyRIT/tree/main/pyrit/datasets/score. Could you create a directory named insecure_code and place the file system_prompt.yaml inside it? Path could be something like pyrit/datasets/score/insecure_code/system_prompt.yaml

[rdheekonda]

Hello @rdheekonda ,

Thank you so much for the feedback! I believe I’ve resolved all the issues and cleaned up the code. Could you please verify? Of course, feel free to add any further feedback, and I’ll address it.

I have one question, though—I think you may address this anyway: I'm not sure where exactly I should place the insecure_code_scorer.yaml file. Currently, it’s located at assets/demo_scorer_definitions/insecure_code_scorer.yaml.

Thank you!

Thank you for your contribution. We're organizing all scoring system prompts in this path https://github.com/Azure/PyRIT/tree/main/pyrit/datasets/score. Could you create a directory named insecure_code and place the file system_prompt.yaml inside it? Path could be something like pyrit/datasets/score/insecure_code/system_prompt.yaml

[KutalVolkan]

Hello @rdheekonda ,
Thank you so much for the feedback! I believe I’ve resolved all the issues and cleaned up the code. Could you please verify? Of course, feel free to add any further feedback, and I’ll address it.
I have one question, though—I think you may address this anyway: I'm not sure where exactly I should place the insecure_code_scorer.yaml file. Currently, it’s located at assets/demo_scorer_definitions/insecure_code_scorer.yaml.
Thank you!

Thank you for your contribution. We're organizing all scoring system prompts in this path https://github.com/Azure/PyRIT/tree/main/pyrit/datasets/score. Could you create a directory named insecure_code and place the file system_prompt.yaml inside it? Path could be something like pyrit/datasets/score/insecure_code/system_prompt.yaml

Hello @rdheekonda.

Thank you!

I made the changes. Feel free to review and let me know if any further adjustments are needed! 😃

[KutalVolkan]

Hi Raja,

I encountered an issue when running pre-commit run --all. The mypy hook failed due to attribute errors in attack_manager.py, specifically with np.infty not being recognized.

Error Output:

pyrit/auxiliary_attacks/gcg/attack/base/attack_manager.py:1124: error: Module has no attribute "infty" [attr-defined]

Fix Applied: I replaced np.infty with np.inf to resolve these errors. If I made any errors, I can easily revert the changes.

238d923

[rdheekonda]

Hi Raja,

I encountered an issue when running pre-commit run --all. The mypy hook failed due to attribute errors in attack_manager.py, specifically with np.infty not being recognized.

Error Output:

pyrit/auxiliary_attacks/gcg/attack/base/attack_manager.py:1124: error: Module has no attribute "infty" [attr-defined]

Fix Applied: I replaced np.infty with np.inf to resolve these errors. If I made any errors, I can easily revert the changes.

238d923

Sounds good. Thanks.