MicrosoftPyRIT (Python Risk Identification Tool for generative AI) is a red-teaming framework for assessing the security and safety of generative AI systems. Security professionals and engineers use it to probe models and AI applications for risks, through both automated attacks and human-led sessions.
It is built from interchangeable parts: targets (the system under test, such as an OpenAI, Azure, Anthropic, Google, or Hugging Face model, a custom HTTP or WebSocket endpoint, or a web app driven through Playwright), converters that transform attack content, scorers that judge responses with an LLM, Azure AI Content Safety, or custom logic, and single-turn or multi-turn attack strategies such as Crescendo, TAP, and Skeleton Key. Conversations, scores, and attack results are stored in SQLite or Azure SQL, and datasets package standard assessments.
PyRIT runs in three modes: a command-line scanner for built-in scenarios, a web GUI (CoPyRIT) for interactive red teaming and team collaboration, and a Python framework for writing custom attacks. A whitepaper describes the approach.
Features
- Targets: OpenAI, Azure, Anthropic, Google, and Hugging Face models, custom HTTP and WebSocket endpoints, and web apps through Playwright
- Attack strategies: single-turn and multi-turn attacks, including Crescendo, TAP, and Skeleton Key
- Converters: transform prompts and attack content before they reach the target
- Scorers: LLM-based, Azure AI Content Safety, or custom scoring of responses
- Memory: conversations, scores, and attack results stored in SQLite or Azure SQL
- Datasets: composable datasets for standardized assessments
- Scanner CLI: runs built-in red-teaming scenarios from the command line
- CoPyRIT GUI: web interface for interactive, collaborative red teaming
