MAINT: Standardize system prompts on prepended_conversation

[adrian-gavrila]

Description

Standardizes objective-target system prompts on prepended_conversation, the existing path that supports one or more system messages and composes with seeded conversation history.

SingleTurnAttackContext.system_prompt was exposed but never consumed, so setting it silently did nothing. This PR keeps the field temporarily for compatibility, emits a DeprecationWarning when it is used, and schedules its removal for 0.17.0.

Callers should instead use:

prepended_conversation=[
    Message.from_system_prompt("You are a helpful assistant.")
]

For multiple system prompts, this PR adds Message.from_system_prompts(...), which returns the same list[Message] callers could build manually.

Changes

• Deprecates the unused SingleTurnAttackContext.system_prompt field.
• Adds Message.from_system_prompts(...).
• Documents prepended_conversation as the standard system-prompt channel.
• Adds coverage for the deprecation warning and message builder.

Implements ADO #9697’s framework-standardization track. The CoPyRIT GUI work was delivered separately in #2056.

Validation

• All PR checks pass.
• The paired documentation .py and .ipynb files were synchronized and executed.

[Copilot]

⚠️ Human review recommended

It changes a core execution chokepoint and parameter contract across many attacks, so a human reviewer should validate compatibility and any downstream behavioral impact beyond the added unit coverage.

Pull request overview

Standardizes system_prompt= as a first-class, consumed attack argument by lifting it into AttackParameters and reliably lowering it into a single leading system message at the shared AttackStrategy.execute_with_context_async entrypoint, ensuring delivery for both direct (execute_async) and executor-driven (AttackExecutor) runs.

Changes:

• Add system_prompt: str | None to AttackParameters and lower it into context.prepended_conversation at AttackStrategy.execute_with_context_async, with a conflict ValueError when a system-role prepended message is already present.
• Remove the dead SingleTurnAttackContext.system_prompt field and update tests to assert behavioral delivery rather than no-op state.
• Explicitly exclude system_prompt from self-seeding / internally-constructed prompt attacks’ params_type and add unit coverage for rejection and executor-path regression.

File summaries

File	Description
pyrit/executor/attack/core/attack_parameters.py	Adds system_prompt to the canonical attack parameter contract.
pyrit/executor/attack/core/attack_strategy.py	Lowers system_prompt into a prepended system message at the shared chokepoint and enforces conflict rules.
pyrit/executor/attack/single_turn/single_turn_attack_strategy.py	Removes unused SingleTurnAttackContext.system_prompt field.
pyrit/executor/attack/single_turn/flip_attack.py	Excludes system_prompt from a self-seeding attack’s accepted params.
pyrit/executor/attack/single_turn/skeleton_key.py	Excludes system_prompt from a self-seeding attack’s accepted params.
pyrit/executor/attack/single_turn/many_shot_jailbreak.py	Excludes system_prompt from a self-seeding attack’s accepted params.
pyrit/executor/attack/single_turn/context_compliance.py	Excludes system_prompt from a self-seeding attack’s accepted params.
pyrit/executor/attack/single_turn/role_play.py	Excludes system_prompt from a self-seeding attack’s accepted params.
pyrit/executor/attack/compound/sequential_attack.py	Excludes system_prompt from compound attack per-call overrides.
tests/unit/executor/attack/core/test_attack_strategy.py	Adds unit coverage for lowering behavior, ordering, conflict errors, and executor-bypass simulation.
tests/unit/executor/attack/core/test_attack_executor.py	Regression test ensuring executor-path lowering happens via the shared chokepoint.
tests/unit/executor/attack/single_turn/test_prompt_sending.py	Updates assertions to validate lowering behavior and adds delivery-to-conversation-manager test.
tests/unit/executor/attack/single_turn/test_role_play.py	Verifies system_prompt exclusion from params_type and explicit rejection at runtime.

Copilot's findings

• Files reviewed: 13/13 changed files
• Comments generated: 0

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.