Merge branch 'main' into redteam

Author: pamelafox

.devcontainer/devcontainer.json

@@ -29,13 +29,18 @@
 			"extensions": [
 				"ms-python.python",
 				"ms-python.vscode-pylance",
+				"ms-python.vscode-python-envs",
 				"charliermarsh.ruff",
 				"mtxr.sqltools",
 				"mtxr.sqltools-driver-pg",
+				"esbenp.prettier-vscode",
+				"mechatroner.rainbow-csv",
 				"ms-vscode.vscode-node-azure-pack",
 				"esbenp.prettier-vscode",
 				"twixes.pypi-assistant",
-				"ms-python.vscode-python-envs"
+				"ms-python.vscode-python-envs",
+				"teamsdevapp.vscode-ai-foundry",
+				"ms-windows-ai-studio.windows-ai-studio"
 			],
 			// Set *default* container specific settings.json values on container create.
 			"settings": {

.env.sample

@@ -5,9 +5,9 @@ POSTGRES_PASSWORD=postgres
 POSTGRES_DATABASE=postgres
 POSTGRES_SSL=disable
 
-# OPENAI_CHAT_HOST can be either azure, openai, or ollama:
+# OPENAI_CHAT_HOST can be either azure, openai, ollama, or github:
 OPENAI_CHAT_HOST=azure
-# OPENAI_EMBED_HOST can be either azure or openai:
+# OPENAI_EMBED_HOST can be either azure, openai, ollama, or github:
 OPENAI_EMBED_HOST=azure
 # Needed for Azure:
 # You also need to `azd auth login` if running this locally
@@ -28,10 +28,17 @@ AZURE_OPENAI_KEY=
 OPENAICOM_KEY=YOUR-OPENAI-API-KEY
 OPENAICOM_CHAT_MODEL=gpt-3.5-turbo
 OPENAICOM_EMBED_MODEL=text-embedding-3-large
-OPENAICOM_EMBED_MODEL_DIMENSIONS=1024
+OPENAICOM_EMBED_DIMENSIONS=1024
 OPENAICOM_EMBEDDING_COLUMN=embedding_3l
 # Needed for Ollama:
 OLLAMA_ENDPOINT=http://host.docker.internal:11434/v1
 OLLAMA_CHAT_MODEL=llama3.1
 OLLAMA_EMBED_MODEL=nomic-embed-text
 OLLAMA_EMBEDDING_COLUMN=embedding_nomic
+# Needed for GitHub Models:
+GITHUB_TOKEN=YOUR-GITHUB-TOKEN
+GITHUB_BASE_URL=https://models.inference.ai.azure.com
+GITHUB_MODEL=gpt-4o
+GITHUB_EMBED_MODEL=text-embedding-3-large
+GITHUB_EMBED_DIMENSIONS=1024
+GITHUB_EMBEDDING_COLUMN=embedding_3l

.github/workflows/app-tests.yaml

@@ -85,7 +85,7 @@ jobs:
             architecture: x64
 
         - name: Install uv
-          uses: astral-sh/setup-uv@v5
+          uses: astral-sh/setup-uv@v6
           with:
             enable-cache: true
             version: "0.4.20"
@@ -123,7 +123,7 @@ jobs:
             key: mypy${{ matrix.os }}-${{ matrix.python_version }}-${{ hashFiles('requirements-dev.txt', 'src/backend/requirements.txt', 'src/backend/pyproject.toml') }}
 
         - name: Run MyPy
-          run: python3 -m mypy .
+          run: python3 -m mypy . --python-version ${{ matrix.python_version }}
 
         - name: Run Pytest
           run: python3 -m pytest -s -vv --cov --cov-fail-under=85

.github/workflows/evaluate.yaml

@@ -82,7 +82,7 @@ jobs:
           python-version: '3.12'
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
         with:
           enable-cache: true
           version: "0.4.20"

evals/evaluate.py

@@ -66,6 +66,10 @@ def get_openai_config() -> dict:
             # azure-ai-evaluate will call DefaultAzureCredential behind the scenes,
             # so we must be logged in to Azure CLI with the correct tenant
         openai_config["model"] = os.environ["AZURE_OPENAI_EVAL_MODEL"]
+    elif os.environ.get("OPENAI_CHAT_HOST") == "ollama":
+        raise NotImplementedError("Ollama is not supported. Switch to Azure or OpenAI.com")
+    elif os.environ.get("OPENAI_CHAT_HOST") == "github":
+        raise NotImplementedError("GitHub Models is not supported. Switch to Azure or OpenAI.com")
     else:
         logger.info("Using OpenAI Service with API Key from OPENAICOM_KEY")
         openai_config = {"api_key": os.environ["OPENAICOM_KEY"], "model": "gpt-4"}

evals/generate_ground_truth.py

@@ -101,7 +101,9 @@ def get_openai_client() -> tuple[Union[AzureOpenAI, OpenAI], str]:
             )
         model = os.environ["AZURE_OPENAI_CHAT_DEPLOYMENT"]
     elif OPENAI_CHAT_HOST == "ollama":
-        raise NotImplementedError("Ollama OpenAI Service is not supported. Switch to Azure or OpenAI.com")
+        raise NotImplementedError("Ollama is not supported. Switch to Azure or OpenAI.com")
+    elif OPENAI_CHAT_HOST == "github":
+        raise NotImplementedError("GitHub Models is not supported. Switch to Azure or OpenAI.com")
     else:
         logger.info("Using OpenAI Service with API Key from OPENAICOM_KEY")
         openai_client = OpenAI(api_key=os.environ["OPENAICOM_KEY"])

evals/safety_evaluation.py

@@ -1,9 +1,11 @@
 import argparse
 import asyncio
+import datetime
 import logging
 import os
 import pathlib
 import sys
+from typing import Optional
 
 import requests
 from azure.ai.evaluation import AzureAIProject
@@ -52,7 +54,7 @@ async def callback(
     return {"messages": messages + [message]}
 
 
-async def run_simulator(target_url: str, max_simulations: int):
+async def run_simulator(target_url: str, max_simulations: int, scan_name: Optional[str] = None):
     credential = get_azure_credential()
     azure_ai_project: AzureAIProject = {
         "subscription_id": os.getenv("AZURE_SUBSCRIPTION_ID"),
@@ -64,26 +66,25 @@ async def run_simulator(target_url: str, max_simulations: int):
         credential=credential,
         risk_categories=[
             RiskCategory.Violence,
-            # RiskCategory.HateUnfairness,
-            # RiskCategory.Sexual,
-            # RiskCategory.SelfHarm,
+            RiskCategory.HateUnfairness,
+            RiskCategory.Sexual,
+            RiskCategory.SelfHarm,
         ],
         num_objectives=1,
     )
+    if scan_name is None:
+        timestamp = datetime.datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
+        scan_name = f"Safety evaluation {timestamp}"
     await model_red_team.scan(
         target=lambda messages, stream=False, session_state=None, context=None: callback(messages, target_url),
-        scan_name="Advanced-Callback-Scan",
+        scan_name=scan_name,
         attack_strategies=[
-            AttackStrategy.EASY,  # Group of easy complexity attacks
-            # AttackStrategy.MODERATE,  # Group of moderate complexity attacks
-            # AttackStrategy.CharacterSpace,  # Add character spaces
-            # AttackStrategy.ROT13,  # Use ROT13 encoding
-            # AttackStrategy.UnicodeConfusable,  # Use confusable Unicode characters
-            # AttackStrategy.CharSwap,  # Swap characters in prompts
-            # AttackStrategy.Morse,  # Encode prompts in Morse code
-            # AttackStrategy.Leetspeak,  # Use Leetspeak
-            # AttackStrategy.Url,  # Use URLs in prompts
-            # AttackStrategy.Binary,  # Encode prompts in binary
+            AttackStrategy.DIFFICULT,
+            AttackStrategy.Baseline,
+            AttackStrategy.UnicodeConfusable,  # Use confusable Unicode characters
+            AttackStrategy.Morse,  # Encode prompts in Morse code
+            AttackStrategy.Leetspeak,  # Use Leetspeak
+            AttackStrategy.Url,  # Use URLs in prompts
         ],
         output_path="Advanced-Callback-Scan.json",
     )
@@ -97,28 +98,29 @@ async def run_simulator(target_url: str, max_simulations: int):
     parser.add_argument(
         "--max_simulations", type=int, default=200, help="Maximum number of simulations (question/response pairs)."
     )
+    # argument for the name
+    parser.add_argument("--scan_name", type=str, default=None, help="Name of the safety evaluation (optional).")
     args = parser.parse_args()
 
     # Configure logging to show tracebacks for warnings and above
     logging.basicConfig(
-        level=logging.DEBUG,
+        level=logging.WARNING,
         format="%(message)s",
         datefmt="[%X]",
         handlers=[RichHandler(rich_tracebacks=False, show_path=True)],
     )
 
     # Set urllib3 and azure libraries to WARNING level to see connection issues
     logging.getLogger("urllib3").setLevel(logging.WARNING)
-    logging.getLogger("azure").setLevel(logging.DEBUG)
-    logging.getLogger("RedTeamLogger").setLevel(logging.DEBUG)
+    logging.getLogger("azure").setLevel(logging.WARNING)
 
     # Set our application logger to INFO level
     logger.setLevel(logging.INFO)
 
     load_azd_env()
 
     try:
-        asyncio.run(run_simulator(args.target_url, args.max_simulations))
+        asyncio.run(run_simulator(args.target_url, args.max_simulations, args.scan_name))
     except Exception:
         logging.exception("Unhandled exception in safety evaluation")
         sys.exit(1)

infra/main.bicep

@@ -302,7 +302,7 @@ var webAppEnv = union(azureOpenAIKeyEnv, openAIComKeyEnv, [
     value: openAIEmbedHost
   }
   {
-    name: 'OPENAICOM_EMBED_MODEL_DIMENSIONS'
+    name: 'OPENAICOM_EMBED_DIMENSIONS'
     value: openAIEmbedHost == 'openaicom' ? '1024' : ''
   }
   {

pyproject.toml

@@ -7,7 +7,6 @@ lint.isort.known-first-party = ["fastapi_app"]
 
 [tool.mypy]
 check_untyped_defs = true
-python_version = 3.9
 exclude = [".venv/*"]
 
 [tool.pytest.ini_options]

src/backend/fastapi_app/__init__.py

@@ -34,7 +34,13 @@ class State(TypedDict):
 @asynccontextmanager
 async def lifespan(app: fastapi.FastAPI) -> AsyncIterator[State]:
     context = await common_parameters()
-    azure_credential = await get_azure_credential()
+    azure_credential = None
+    if (
+        os.getenv("OPENAI_CHAT_HOST") == "azure"
+        or os.getenv("OPENAI_EMBED_HOST") == "azure"
+        or os.getenv("POSTGRES_HOST", "").endswith(".database.azure.com")
+    ):
+        azure_credential = await get_azure_credential()
     engine = await create_postgres_engine_from_env(azure_credential)
     sessionmaker = await create_async_sessionmaker(engine)
     chat_client = await create_openai_chat_client(azure_credential)
@@ -53,6 +59,7 @@ def create_app(testing: bool = False):
         if not testing:
             load_dotenv(override=True)
         logging.basicConfig(level=logging.INFO)
+
     # Turn off particularly noisy INFO level logs from Azure Core SDK:
     logging.getLogger("azure.core.pipeline.policies.http_logging_policy").setLevel(logging.WARNING)
     logging.getLogger("azure.identity").setLevel(logging.WARNING)