FEAT plumb media output through adversarial feedback loop (#6a)

[fitzpr]

Description

When the red teaming attack loop targets an image/video generator (e.g. DALL-E), the adversarial chat (e.g. GPT-4o) never sees the generated media - only the scorer's text feedback is sent back. The adversarial LLM refines its prompts blindly.

This PR makes media outputs flow through the feedback loop as multimodal messages (text + image/video), so the adversarial chat can see what the target actually produced and give better-informed follow-up prompts.

Before: Target → image → Scorer → "missing a hat" (text only) → Adversarial LLM
After: Target → image → Scorer → "missing a hat" + image → Adversarial LLM

Microsoft Security Hackathon 2026, project #6a. @romanlutz for visibility.

Changes

red_teaming.py - core change (3 methods):

• _handle_adversarial_file_response now returns a (feedback_text, media_piece) tuple instead of just a string
• _build_adversarial_prompt returns Union[str, tuple] - string for text responses, tuple for media
• _generate_next_prompt_async builds a multimodal Message with text + media pieces when a tuple is returned

openai_chat_target.py - 1-line bug fix:

• Content-filtered responses have data type error, which crashed multimodal message building with ValueError: Multimodal data type error is not yet supported. Now treated as text alongside "text".

No new files, classes, or dependencies. Fully backward compatible - text-only workflows are unchanged.

Tests and Documentation

test_red_teaming.py - 5 new tests, 2 updated:

• test_generate_next_prompt_sends_multimodal_message_for_image_response - verifies 2-piece multimodal message construction (text + image)
• test_generate_next_prompt_sends_multimodal_message_for_video_response - same for video
• test_generate_next_prompt_text_response_stays_text_only - regression test ensuring text path is unaffected
• test_build_adversarial_prompt_returns_tuple_for_image_response - return type assertion
• test_build_adversarial_prompt_returns_str_for_text_response - return type assertion
• 2 existing tests updated to assert tuple returns from _handle_adversarial_file_response

All 161 tests pass (70 red_teaming + 91 chat_target). JupyText not run - no notebook changes in this PR.

[Copilot]

Pull request overview

This PR updates the red-teaming multi-turn attack loop so that when an objective target returns generated media (e.g., images/videos), that media is included alongside scorer feedback when prompting the adversarial chat model, enabling multimodal refinement rather than text-only “blind” iteration.

Changes:

• Plumbs (feedback_text, media_piece) through the adversarial feedback path and constructs a multimodal Message (text + media) when applicable.
• Adjusts _handle_adversarial_file_response to return both feedback and the originating media MessagePiece.
• Treats OpenAI chat “error” pieces as text content parts when building multimodal chat messages.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
pyrit/executor/attack/multi_turn/red_teaming.py	Builds multimodal adversarial prompts for media responses and changes handler return types.
pyrit/prompt_target/openai/openai_chat_target.py	Allows converted_value_data_type == "error" to be serialized as a text content-part in multimodal mode.
tests/unit/executor/attack/multi_turn/test_red_teaming.py	Adds/updates unit tests to validate tuple return types and multimodal message construction.

[Copilot]

This is an async method but its name doesn’t end with the required _async suffix. Please rename it (e.g., _build_adversarial_prompt_async) and update the call site(s) and tests accordingly to match the project’s async naming convention.

[Copilot]

Treating converted_value_data_type == "error" as a text content part avoids the previous exception, but note that any conversation containing an "error" piece will still route through the multimodal message format (content array) because _is_text_message_format only accepts "text". For OpenAI-compatible endpoints that don’t support the content-parts schema, this can still fail even though the payload is effectively text-only. Consider also treating "error" as text in the text-format detection (or normalizing error pieces to "text") so purely textual conversations continue using the plain string format.

[Copilot]

_generate_next_prompt_async now builds a multimodal Message containing the objective target’s media piece. This can break when the adversarial chat target doesn’t support that data type (notably, OpenAIChatTarget only validates text/image_path/audio_path and will reject video_path). Consider detecting/whitelisting supported prompt data types for the adversarial target (or catching the validation error) and falling back to a text-only prompt (e.g., include the feedback text + a textual reference to the media path) to preserve backward compatibility.