Skip to content

FEAT: Add 0DIN JEF keyword scorers and n-day seed datasets#1398

Merged
romanlutz merged 8 commits into
microsoft:mainfrom
athal7:athal/0din-900-submit-jef-scorers-n-day-seed-datasets-upstream-to-microsoft
Jun 1, 2026
Merged

FEAT: Add 0DIN JEF keyword scorers and n-day seed datasets#1398
romanlutz merged 8 commits into
microsoft:mainfrom
athal7:athal/0din-900-submit-jef-scorers-n-day-seed-datasets-upstream-to-microsoft

Conversation

@athal7

@athal7 athal7 commented Feb 23, 2026

Copy link
Copy Markdown

Description

Adds four lightweight 0DIN keyword-based scorers and six n-day jailbreak seed datasets from Mozilla's 0DIN vulnerability disclosure program.

Scorers (pyrit/score/true_false/):

  • MethKeywordScorer — methamphetamine synthesis terminology
  • NerveAgentKeywordScorer — nerve-agent synthesis terminology
  • FentanylKeywordScorer — fentanyl synthesis terminology
  • AnthraxKeywordScorerB. anthracis weaponisation terminology

Each scorer extends RegexScorer with a domain-specific keyword list and returns True when any keyword is found in the model output.

Seed datasets (pyrit/datasets/seed_datasets/local/0din/):

Six .prompt files containing real-world jailbreak prompts disclosed through 0DIN:

  • placeholder_injection — copyright bypass via placeholder text insertion
  • incremental_table_completion — pattern completion with restricted chemicals
  • technical_field_guide — law-enforcement framing for synthesis instructions
  • chemical_compiler_debug — obfuscated chemical notation as a debug task
  • correction — forensic document error correction bypass
  • hex_recipe_book — multi-turn hex-encoded instruction attack with 3 sequential prompts

Tests

  • Added unit coverage for all four keyword scorers
  • Added unit coverage for all six 0DIN seed datasets, including dataset metadata and multi-turn sequencing
  • Verified the new tests locally: 104 passed

@athal7

athal7 commented Feb 23, 2026

Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree company="0din"

@athal7
athal7 marked this pull request as ready for review February 23, 2026 22:04
@pedramamini

Copy link
Copy Markdown

Neat work!

@romanlutz

Copy link
Copy Markdown
Contributor

Thanks for putting this together! Two suggestions on the scorers side (the seed datasets look great):

  1. Subclass RegexScorer instead of adding _JEFKeywordScorer. The new base class is functionally equivalent to RegexScorer with re.escaped patterns — same OR-join, same true_false output. Subclassing RegexScorer would shrink each scorer to ~10 lines and reuse its "Matched: <name1>, <name2>" rationale, which is more useful for triage than the generic hit/miss strings. We''d just pass patterns={kw: re.escape(kw) for kw in METH_KEYWORDS} (or pre-escape the dict at module scope) and categories=["meth"].
  2. Drop the JEF prefix from the class names. MethKeywordScorer, NerveAgentKeywordScorer, etc. — JEF isn''t a widely-known acronym and users will mostly find these by the substance name. We''d absolutely keep the attribution: module docstring, class docstrings, and See Also links pointing to https://github.com/0din-ai/0din-JEF stay as-is, and the keyword lists themselves remain credited to JEF.

Would you like to make these changes, or would you prefer we take it from here? Happy either way — if we don''t hear back, we''ll pick it up sometime in June.

Subclass RegexScorer for meth, nerve-agent, fentanyl, and anthrax
keyword detection. One scorer per file, following codebase convention.
JEF attribution in module and class docstrings.

Co-Authored-By: anthropic/claude-opus-4-6 <noreply@opencode.ai>
@athal7
athal7 force-pushed the athal/0din-900-submit-jef-scorers-n-day-seed-datasets-upstream-to-microsoft branch from 909036d to 2c4f30a Compare May 25, 2026 19:54
@athal7

athal7 commented May 25, 2026

Copy link
Copy Markdown
Author

Thanks for the suggestions! Both addressed:

  1. Scorers now subclass RegexScorer — each is ~10 lines with {kw: re.escape(kw) ...} patterns and substance-specific categories.
  2. Dropped JEF prefix from class names and split into individual files (meth_keyword_scorer.py, etc.) to match codebase convention. Attribution stays in module and class docstrings.

Also rebased onto current main to pick up RegexScorer from #1704.

romanlutz and others added 3 commits May 30, 2026 15:29
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-jef-scorers-n-day-seed-datasets-upstream-to-microsoft
@romanlutz
romanlutz enabled auto-merge May 30, 2026 23:29
romanlutz added 3 commits June 1, 2026 06:28
…-jef-scorers-n-day-seed-datasets-upstream-to-microsoft
…ef-scorers-n-day-seed-datasets-upstream-to-microsoft' into athal/0din-900-submit-jef-scorers-n-day-seed-datasets-upstream-to-microsoft
@romanlutz
romanlutz added this pull request to the merge queue Jun 1, 2026
Merged via the queue into microsoft:main with commit 860d0c5 Jun 1, 2026
48 checks passed
romanlutz pushed a commit to romanlutz/PyRIT that referenced this pull request Jun 17, 2026
… n-day datasets

PR microsoft#1398 already added six static, hand-curated 0din_* local n-day disclosure datasets. This live API loader pulls the gated 0DIN threat feed, so name it 0din_threatfeed to clearly distinguish the dynamic full feed from the static disclosures and parallel the existing 0din_* naming.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants