Microsoft PyRIT Automates Multi-Turn LLM Red-Team Testing

Summary

A practical overview of Microsoft’s open-source PyRIT framework for automating LLM red-team tests, explaining its targets, converters, scorers, and orchestrators for multi-turn and indirect prompt-injection testing.

Key points

PyRIT combines targets, converters, scorers, and orchestrators to automate structured tests against LLM systems.
Converters can be chained to transform prompts before they reach a target; scorers assess responses for outcomes such as compliance, refusal, or harmful content.
CrescendoOrchestrator automates gradual multi-turn tests, while TreeOfAttacksWithPruningOrchestrator explores parallel paths and prunes unsuccessful branches.
XPIAOrchestrator is described as testing cross-domain prompt injection through external data sources processed by agents.
The article says PyRIT records prompts, transformations, scores, and responses in SQLite or Azure SQL for reviewing campaign transcripts.
The author says Microsoft’s AI Red Team used PyRIT in more than 100 internal operations, including tests involving Phi-3 and Copilot.

Article Details

Topic: PyRIT for automated, multi-turn LLM red teaming

Vendors

MicrosoftPyRIT is Microsoft’s open-source AI red team framework for automating multi-turn attack campaigns against LLM systems, and it has been validated on more than 100 internal operations including Phi-3 and Copilot.

Products

Azure OpenAIA target is whatever we point prompts at: Azure OpenAI, a Hugging Face model, a local Ollama instance, or a custom HTTP endpoint via the HTTPTarget class.CopilotPyRIT is Microsoft’s open-source AI red team framework for automating multi-turn attack campaigns against LLM systems, and it has been validated on more than 100 internal operations including Phi-3 and Copilot.Phi-3PyRIT is Microsoft’s open-source AI red team framework for automating multi-turn attack campaigns against LLM systems, and it has been validated on more than 100 internal operations including Phi-3 and Copilot.

Tools

GarakGarak is NVIDIA’s broad-spectrum vulnerability scanner, closer to Nmap for LLMs.PromptfooPromptfoo is CI/CD-first, built for regression-testing safety layers in a pipeline.PyRITPyRIT is Microsoft’s open-source AI red team framework for automating multi-turn attack campaigns against LLM systems, and it has been validated on more than 100 internal operations including Phi-3 and Copilot.