vangrail 0.1.0 → 0.2.0

data/lib/vangrail/rails/paraphrase.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require_relative '../nlp'
+require_relative '../rail'
+
+module Vangrail
+  module Rails
+    # Catches the injection that was reworded.
+    #
+    # Rails::InjectedInstructions and Rails::Jailbreak match strings, and a
+    # string is what an attacker edits first. "Ignore all previous
+    # instructions" is one thesaurus away from "discard every guideline stated
+    # so far", which no pattern in this gem matches and which asks for exactly
+    # the same thing. That gap is stated plainly in the coverage page, and this
+    # rail is the part of it that can be closed without a model.
+    #
+    # The move is to stop matching words. The text is reduced to concepts
+    # first (NLP.concepts), and what gets matched is a pair of concepts close
+    # together: an override next to an instruction, a revealing verb next to a
+    # secret, concealment next to an audience, a persona next to a state with
+    # no rules in it. A rewording that keeps the meaning keeps the concepts,
+    # because the concepts are what the sentence is for.
+    #
+    # Two concepts rather than one, always. A document that mentions
+    # instructions is a handbook; a document that mentions overriding them is
+    # an attack. Every single-concept rule tried against the corpus flagged
+    # ordinary documentation, and the pair is what separates the two without a
+    # judgement call.
+    #
+    # Because concepts are language-independent, a second language costs a word
+    # list rather than a second rail. English and Dutch are both read by
+    # default: the pattern rails in this gem are English-only, so a Dutch wiki
+    # page is a page nothing else here can read, and at a Dutch institution
+    # that page is the ordinary case rather than the exotic one.
+    #
+    # The limits are worth being exact about, because this is the rail most
+    # likely to be mistaken for understanding. A synonym outside NLP::CONCEPTS
+    # is a miss. A sentence in another language is a miss. An attacker who
+    # reads this file can pick words that are in no list here, exactly as they
+    # can with the patterns. What it buys is that rewording no longer costs an
+    # attacker one edit, and that the cheap rewrites that beat a regexp do not
+    # beat this.
+    class Paraphrase < Rail
+      # Each entry is two concepts and how far apart they may sit, in tokens.
+      # The windows are short because closeness is the whole claim: two
+      # concepts in one clause are one statement, and the same two concepts
+      # nine lines apart are two unrelated sentences in a long page.
+      # Cancel the standing instruction, however it is named. Ordered, because
+      # an override governs its object: "ignore the guidelines" is an attack
+      # and "follow the guidance and ignore stale copies of it" has the same
+      # two concepts in the other order and is a handbook sentence.
+      TEMPLATES = [
+        { label: 'instruction_override', concepts: %i[override instruction], window: 6, ordered: true },
+        # Cancel what came before without naming it. "Ignore the earlier
+        # warning" is a page; "dismiss anything stated earlier" is an attack,
+        # and the quantifier is the difference. An attacker cancels the lot
+        # because they do not know what they are cancelling.
+        { label: 'instruction_override', concepts: %i[override prior], window: 4, ordered: true,
+          requires: %i[totality] },
+        # Move a secret out. The clause has to address the assistant: "print
+        # the configuration with scontrol" tells a reader to run a command,
+        # "print your configuration" talks to the thing reading the page.
+        { label: 'prompt_disclosure', concepts: %i[reveal secret], window: 8, ordered: true,
+          requires: %i[self] },
+        # Keep something from the person reading the answer. Both halves are
+        # needed: concealment alone is security advice ("never mention a
+        # password in a ticket"), and an audience alone is every support page.
+        { label: 'answer_shaping', concepts: %i[conceal audience], window: 10 },
+        { label: 'answer_shaping', concepts: %i[conceal answering], window: 10 },
+        # Be something without rules.
+        { label: 'unrestricted_persona', concepts: %i[persona unrestricted], window: 8 },
+      ].freeze
+
+      attr_reader :templates, :languages
+
+      # Both languages by default. A deployment whose corpus is genuinely
+      # single-language can say so and pay a shorter lexicon; one that thinks
+      # it is single-language usually has a Dutch page in it somewhere, which
+      # is the case the default is for.
+      def initialize(templates: TEMPLATES, languages: NLP::LANGUAGES, name: 'paraphrase',
+                     sides: %i[input context])
+        super(name: name, sides: sides)
+        @templates = templates
+        @languages = Array(languages).map(&:to_sym)
+        unknown = @languages - NLP::LANGUAGES
+        raise ArgumentError, "unknown language(s): #{unknown.join(', ')}" unless unknown.empty?
+      end
+
+      def cache_key(text, _context)
+        "#{languages.join('+')}\n#{text}"
+      end
+
+      def decide(text, _context)
+        # Clause by clause: a rule that reaches across a full stop is reading
+        # two statements as one, and a long page has a full stop every line.
+        # Anaphora is applied across that cut: "Ignore them" after a clause
+        # that named an instruction is the same pair as "Ignore the instructions".
+        clauses = NLP.clauses(text)
+        hits = NLP.clause_concepts(text, languages: languages).flat_map.with_index do |found, i|
+          clause_hits(clauses[i], found)
+        end
+        return pass if hits.empty?
+
+        block(categories: hits.map { |hit| hit[:label] }.uniq,
+              reason: "reworded instruction: #{hits.map { |hit| describe(hit) }.uniq.join('; ')}")
+      end
+
+      private
+
+      def clause_hits(clause, found = nil)
+        found ||= NLP.concepts(clause, languages: languages)
+        return [] if found.empty?
+
+        present = found.to_set { |(_, concept, _)| concept }
+        length = NLP.words(clause).size
+        templates.filter_map do |template|
+          next unless Array(template[:requires]).all? { |concept| present.include?(concept) }
+
+          match(found, template, length)
+        end
+      end
+
+      # Pairs within a window, found by walking the window rather than by
+      # comparing everything with everything.
+      #
+      # The obvious loop is lefts against rights, and it is quadratic in the
+      # number of concepts a document carries. That is invisible on ordinary
+      # prose, where a clause holds two or three, and it is reachable on
+      # purpose: a retrieved page is written by whoever wants it retrieved, and
+      # a page of "ignore ignore ignore ... instructions instructions" carries
+      # thousands of each with no pair close enough to match, so every one gets
+      # compared against every one. Measured before this rewrite: 51 ms at 5 KB,
+      # 1,298 ms at 39 KB, four times the work for twice the page, and the
+      # decoding pass runs it again per transform.
+      #
+      # A window is at most ten tokens, so walking it costs the same per concept
+      # whatever the page weighs.
+      def match(found, template, length)
+        first, second = template[:concepts]
+        seconds = Hash.new { |hash, key| hash[key] = [] }
+        found.each { |(index, concept, word)| seconds[index] << word if concept == second }
+        window = template[:window]
+
+        found.each do |(i, concept, left_word)|
+          next unless concept == first
+
+          ((i - window)..(i + window)).each do |j|
+            # One word carrying both concepts is one fact, not two. "prompt" is
+            # an instruction and a secret at the same index, and a page that
+            # says it once has not said anything twice.
+            next if j == i
+            next if template[:ordered] && j < i && !verb_final_object?(i, length, left_word)
+
+            right_word = seconds[j].first
+            next unless right_word
+
+            return { label: template[:label], words: [left_word, right_word] }
+          end
+        end
+        nil
+      end
+
+      # Dutch subordinates put the verb last, so the object of an override
+      # sits to its left: "dat je de richtlijnen negeert". English "follow
+      # the guidance and ignore stale copies" has the override mid-clause
+      # with its own object after it, and stays unflagged.
+      #
+      # The verb has to be a Dutch one, because the rule is Dutch grammar and
+      # English ends clauses with these verbs constantly. Measured over 699
+      # installed manual pages, the position test alone took this rail from
+      # 1.6% of documents to 5.2%, and every added flag was a documentation URL
+      # whose last token happened to be "overrides":
+      #
+      #   <https://doc.rust-lang.org/cargo/reference/config.html#command-line-overrides>
+      #
+      # The two override lexicons are disjoint, so asking which language the
+      # verb came from costs one lookup and gives the rule back its subject.
+      DUTCH_OVERRIDES = NLP::CONCEPTS[:nl][:override].map { |word| NLP.stem(word) }.to_set.freeze
+
+      def verb_final_object?(verb_index, length, word)
+        verb_index == length - 1 && DUTCH_OVERRIDES.include?(NLP.stem(NLP.normalize(word)))
+      end
+
+      def describe(hit)
+        "#{hit[:label]} (#{hit[:words].join(' ... ')})"
+      end
+    end
+  end
+end

data/lib/vangrail/rails/pattern.rb

@@ -21,16 +21,12 @@ module Vangrail
         @reason = reason
       end
 
-      def offline?
-        true
-      end
-
       def cache_key(text, _context)
         text
       end
 
-      def call(text, _context)
-        hit = patterns.find { |_label, pattern| pattern.match?(text.to_s) }
+      def decide(text, _context)
+        hit = patterns.detect { |_label, pattern| pattern.match?(text.to_s) }
         return pass unless hit
 
         label = hit.first

data/lib/vangrail/rails/perplexity.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require_relative '../completion'
+require_relative '../rail'
+
+module Vangrail
+  module Rails
+    # Reads how surprised a model is by the text, and blocks the span that is
+    # not language.
+    #
+    # The optimised attacks in the literature do not produce sentences. A
+    # gradient-search suffix reads like a hash with punctuation in it, and it
+    # works on the model while meaning nothing to a reader. No pattern catches
+    # it, because there is no pattern: the string is different every time it is
+    # searched for. What it has instead is a signature that is hard to remove
+    # while keeping the attack, which is that a language model finds it wildly
+    # improbable.
+    #
+    # So the check is the model's own log probabilities, which is the published
+    # detector for exactly this family. It needs an endpoint that will echo a
+    # prompt and score it, and many will not; when that is the case this rail
+    # reports uncertain and the deployment knows the family is uncovered rather
+    # than believing it is handled.
+    #
+    # Windowed rather than averaged over the whole text, because an attack is a
+    # short span inside an ordinary question. Twenty improbable tokens after a
+    # hundred readable ones barely move the mean, and the window is what keeps
+    # the signal from being diluted by the sentence the attacker wrapped it in.
+    #
+    # The threshold is not a constant of nature. Log probabilities depend on the
+    # model, its tokenizer, and its quantisation, so the default here is a
+    # starting point and script/perplexity_probe.rb is what turns it into a
+    # measured number for the endpoint in use. A deployment that has not run it
+    # is running an uncalibrated detector, and this rail is off by default for
+    # that reason as much as for the round trip.
+    class Perplexity < Rail
+      # Mean negative log likelihood per token, in nats. Ordinary prose under a
+      # small instruct model sits around 2 to 4; a gradient-search suffix sits
+      # far above it. Calibrate before trusting.
+      THRESHOLD = 7.0
+
+      # Tokens per window. Short enough that a twenty-token suffix fills one,
+      # long enough that a rare proper noun does not.
+      WINDOW = 16
+
+      # Below this many scored tokens there is no window worth taking, and a
+      # three-word question is not evidence of anything.
+      FLOOR = 8
+
+      attr_reader :completion, :threshold, :window
+
+      def initialize(completion:, threshold: THRESHOLD, window: WINDOW, floor: FLOOR,
+                     name: 'perplexity', sides: %i[input context])
+        super(name: name, sides: sides)
+        @completion = completion
+        @threshold = threshold
+        @window = window
+        @floor = floor
+      end
+
+      def offline?
+        false
+      end
+
+      def cache_key(text, _context)
+        "#{completion.model}\n#{threshold}\n#{window}\n#{text}"
+      end
+
+      def decide(text, _context)
+        body = text.to_s
+        return pass if body.strip.empty?
+
+        score = worst_window(body)
+        return pass if score.nil? || score < threshold
+
+        block(categories: ['high_perplexity'],
+              reason: format('a span of %<window>d tokens scores %<score>.1f nats against a threshold of ' \
+                             '%<threshold>.1f: this is not language',
+                             window: window, score: score, threshold: threshold))
+      rescue Error => e
+        unchecked("perplexity check did not run: #{e.message}")
+      end
+
+      # The highest mean negative log likelihood of any window, or nil when the
+      # text is too short to have one. Raises what the transport raises, so a
+      # probe script sees the error and a rail sees a Result.
+      def worst_window(text)
+        logprobs = completion.token_logprobs(text)
+        return nil if logprobs.size < @floor
+
+        size = [window, logprobs.size].min
+        means = (0..(logprobs.size - size)).map do |start|
+          slice = logprobs[start, size]
+          -slice.sum / slice.size
+        end
+        means.max
+      end
+    end
+  end
+end

data/lib/vangrail/rails/personal_data.rb

@@ -25,11 +25,18 @@ module Vangrail
     # follows it. All three are in the corpus, because a rail that eats login
     # examples is worse for a handbook than no rail at all.
     #
-    # Deliberately not included: national identity numbers. The Dutch BSN is
-    # nine digits with a checksum, a Slurm job id is six to eight digits, and
-    # one in eleven job ids passes the checksum by accident. A rail that
-    # redacts job ids from a cluster support question is unusable, and the
-    # trade is not close.
+    # National identity numbers are matched only beside their own name, and the
+    # reason is the same false-positive budget. The Dutch BSN is nine digits
+    # with a checksum that one number in eleven passes by accident, so a rail
+    # reading bare nine-digit runs redacts job ids and project numbers out of
+    # cluster questions, which makes it unusable.
+    #
+    # A label changes that trade completely. "Mijn BSN is 123456782" carries
+    # the word and the checksum, and nothing on a cluster desk writes both by
+    # accident; a bare 123456782 keeps passing through untouched. It is the
+    # same pair-of-signals rule the rest of this gem uses, and it is what makes
+    # the most sensitive identifier a Dutch reader can paste into a support
+    # question something this rail can actually catch.
     class PersonalData < Rail
       PLACEHOLDER = '[redacted]'
 
@@ -55,7 +62,13 @@ module Vangrail
         'phone' => /(?:\+|\b00)[1-9]\d{0,2}[\s.-]?(?:\(?\d{1,4}\)?[\s.-]?){2,5}\d{2,4}\b
                     |\b0\d{1,3}[\s.-]\d{3}[\s.-]?\d{3,4}\b/x,
         'iban' => /\b[A-Z]{2}\d{2}\s?(?:[A-Z0-9]{4}\s?){2,7}[A-Z0-9]{1,4}\b/,
-        'card' => /\b(?:\d[ -]?){13,19}\b/
+        # Separators between the digits rather than after them: the trailing
+        # form eats the space before the next word and redacts it away.
+        'card' => /\b\d(?:[ -]?\d){12,18}\b/,
+        # The number beside its own name, in the words a Dutch reader uses for
+        # it. The digits may carry the dots or spaces a form prints them with.
+        'bsn' => /\b(?:bsn|burgerservicenummer|sofinummer|sofi[\s-]?nummer)\b
+                  [^\n]{0,24}?((?:\d[\s.-]?){8}\d)\b/xi,
       }.freeze
 
       attr_reader :patterns, :placeholder
@@ -67,7 +80,7 @@ module Vangrail
         @placeholder = placeholder
       end
 
-      def offline?
+      def language_agnostic?
         true
       end
 
@@ -75,7 +88,7 @@ module Vangrail
         text
       end
 
-      def call(text, _context)
+      def decide(text, _context)
         body = text.to_s
         found = []
         redacted = patterns.reduce(body) do |acc, (label, pattern)|
@@ -95,7 +108,10 @@ module Vangrail
           next match unless redact?(label, match, m.pre_match, m.post_match)
 
           found << label
-          placeholder
+          # Where the pattern had to read a label to be sure, only the value
+          # goes. The reader still sees what the desk was told about, the same
+          # way the secrets rail keeps the setting name and loses the key.
+          m[1] ? match.sub(m[1], placeholder) : placeholder
         end
       end
 
@@ -105,6 +121,7 @@ module Vangrail
         case label
         when 'email' then mailbox?(match, before, after)
         when 'card' then card?(match)
+        when 'bsn' then bsn?(match)
         else true
         end
       end
@@ -127,6 +144,21 @@ module Vangrail
         luhn?(digits)
       end
 
+      # The elfproef, which is the check the Dutch government applies: the nine
+      # digits weighted 9 down to 2, with the last subtracted rather than
+      # added, and the total divisible by eleven. Nine identical digits pass it
+      # arithmetically and are a placeholder rather than a person, so they do
+      # not count.
+      def bsn?(match)
+        digits = match.gsub(/\D/, '')
+        return false unless digits.length == 9
+        return false if digits.chars.uniq.size == 1
+
+        weights = [9, 8, 7, 6, 5, 4, 3, 2, -1]
+        total = digits.chars.each_with_index.sum { |c, i| c.to_i * weights[i] }
+        (total % 11).zero?
+      end
+
       def luhn?(digits)
         sum = digits.reverse.chars.each_with_index.sum do |c, i|
           n = c.to_i

data/lib/vangrail/rails/prompt_leak.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require_relative '../nlp'
+require_relative '../rail'
+
+module Vangrail
+  module Rails
+    # Catches the answer that is reproducing the system prompt.
+    #
+    # Rails::Canary catches the exact token and nothing else, which its own
+    # documentation says: a model asked to summarise its instructions rather
+    # than repeat them leaks the content and not the marker. That is the
+    # published shape of the attack, and it is the row the coverage page marks
+    # as verbatim-only.
+    #
+    # The application already has the text that must not come back out. So
+    # nothing here has to guess what a system prompt looks like: the answer's
+    # sentences are compared against the protected text's sentences by n-gram
+    # containment, and a sentence made largely of the prompt's n-grams is the
+    # prompt, however it was introduced.
+    #
+    # Sentence against sentence, for the reason Rails::Similarity gives:
+    # containment saturates with length, so a short answer compared against a
+    # whole prompt scores high on nothing at all.
+    #
+    # Redacted rather than refused. An answer that quotes one line of its
+    # instructions is usually a useful answer with one bad sentence in it, and
+    # blocking throws away the help to prevent the leak while rewriting keeps
+    # both. What comes back is the answer with those sentences replaced.
+    class PromptLeak < Rail
+      PLACEHOLDER = '[redacted: system prompt]'
+
+      # Two thresholds, because reproducing a rule and applying one are not the
+      # same act and score alike.
+      #
+      # "I cannot speculate about quotas; ask the service desk" restates a line
+      # of the prompt and is exactly what the prompt is for. "My instructions
+      # say I cannot speculate about quotas" restates the same line and hands
+      # the reader the instruction. What separates them is not how much text
+      # they share; it is that the second one says whose words they are.
+      #
+      # So: a sentence that reproduces the protected text closely is a leak
+      # whatever frame it carries, and a sentence that reproduces it loosely is
+      # a leak only when it announces that it is quoting the assistant's own
+      # instructions. Measured in test/test_prompt_leak.rb: ordinary answers
+      # top out at 0.27, and quotes start at 0.45.
+      THRESHOLD = 0.7
+      FRAMED_THRESHOLD = 0.4
+
+      # A sentence naming the assistant's own instructions. Written here rather
+      # than in the shared lexicon on purpose: first-person possessives belong
+      # to an answer, and adding them to NLP's `self` concept would have the
+      # input side read "print my configuration" as an extraction attempt.
+      FRAME = /
+        \b(?:my|these|those|the|its|your)\s+
+          (?:instructions?|rules?|guidelines?|system\s+(?:prompt|message)|prompt|directives?)\b
+        |
+        \bI\s+(?:was|am|have\s+been)\s+(?:told|instructed|configured|programmed|asked)\b
+        |
+        \b(?:system|developer)\s+(?:prompt|message)\s+(?:says|states|reads|is)\b
+        |
+        \b(?:mijn|deze|die|jouw|uw)\s+
+          (?:instructies?|regels?|richtlijnen?|systeemprompt|voorschriften?)\b
+        |
+        \bik\s+(?:ben|werd|was)\s+(?:geïnstrueerd|geïnstrueerd|verteld|geconfigureerd|geprogrammeerd|gevraagd)\b
+        |
+        \bsysteemprompt\s+(?:zegt|staat|luidt|is)\b
+      /xi
+
+      # Shorter than this, a sentence is not evidence. "You may not." is inside
+      # the n-gram set of almost any prompt, and redacting it would cost a
+      # reader an answer to prevent nothing.
+      FLOOR = 40
+
+      attr_reader :threshold, :framed_threshold, :placeholder
+
+      def initialize(protected_text:, threshold: THRESHOLD, framed_threshold: FRAMED_THRESHOLD,
+                     floor: FLOOR, placeholder: PLACEHOLDER, name: 'prompt_leak', sides: [:output])
+        super(name: name, sides: sides)
+        @threshold = threshold
+        @framed_threshold = framed_threshold
+        @floor = floor
+        @placeholder = placeholder
+        @protected = protect(protected_text)
+        raise ArgumentError, 'a prompt_leak rail needs protected text' if @protected.empty?
+      end
+
+      def cache_key(text, _context)
+        "#{threshold}\n#{text}"
+      end
+
+      def decide(text, _context)
+        body = text.to_s
+        leaked = sentences(body).select { |sentence| leak?(sentence) }
+        return pass if leaked.empty?
+
+        redacted = leaked.reduce(body) { |acc, sentence| acc.sub(sentence, placeholder) }
+        modify(redacted, categories: ['system_prompt'],
+                         reason: "redacted #{leaked.size} sentence(s) reproducing the protected text")
+      end
+
+      # How much of the protected text a sentence reproduces, for a caller that
+      # wants the number rather than the verdict.
+      def score(sentence)
+        shingles = NLP.shingles(sentence)
+        @protected.map { |candidate| NLP.containment(shingles, candidate) }.max || 0.0
+      end
+
+      private
+
+      def sentences(text)
+        NLP.clauses(text).select { |clause| clause.length >= @floor }
+      end
+
+      def leak?(sentence)
+        found = score(sentence)
+        return true if found >= threshold
+
+        found >= framed_threshold && sentence.match?(FRAME)
+      end
+
+      # The protected text as one shingle set per sentence. Sentences below the
+      # floor are dropped from it as well: a prompt's one-word line is not
+      # something an answer can leak.
+      def protect(text)
+        Array(text).flat_map { |part| NLP.clauses(part) }
+                   .select { |clause| clause.length >= @floor }
+                   .map { |clause| NLP.shingles(clause) }
+      end
+    end
+  end
+end

data/lib/vangrail/rails/remote.rb

@@ -20,13 +20,17 @@ module Vangrail
         @client = client || Client.new(base_url: base_url, config_id: config_id, api_key: api_key)
       end
 
+      def offline?
+        false
+      end
+
       def cache_key(text, context)
         return text if context[:side] == :input
 
         "#{context[:user_input]} #{text}"
       end
 
-      def call(text, context)
+      def decide(text, context)
         result =
           if context[:side] == :output
             client.check_output(text, user_input: context[:user_input])

data/lib/vangrail/rails/secrets.rb

@@ -40,7 +40,7 @@ module Vangrail
         @placeholder = placeholder
       end
 
-      def offline?
+      def language_agnostic?
         true
       end
 
@@ -48,7 +48,7 @@ module Vangrail
         text
       end
 
-      def call(text, _context)
+      def decide(text, _context)
         body = text.to_s
         found = []
         redacted = patterns.reduce(body) do |acc, (label, pattern)|

data/lib/vangrail/rails/self_check.rb

@@ -35,23 +35,26 @@ module Vangrail
         end
       end
 
+      def offline?
+        false
+      end
+
       def cache_key(text, context)
         return text if context[:side] == :input
 
         "#{context[:user_input]} #{text}"
       end
 
-      def call(text, context)
+      def decide(text, context)
         rendered = Prompt.render(policy, template_context(text, context))
         answer = chat.ask([
                             { 'role' => 'system', 'content' => rendered },
-                            { 'role' => 'user', 'content' => text.to_s }
+                            { 'role' => 'user', 'content' => text.to_s },
                           ])
         parsed = Parsers.policy(answer.text)
         unless parsed[:decided]
-          return Result.new(status: :passed, rail: name, certain: false, model: model,
-                            latency_ms: answer.latency_ms, raw: answer.raw,
-                            reason: "unparsed judge response: #{parsed[:reason]}")
+          return unchecked("unparsed judge response: #{parsed[:reason]}",
+                           model: model, latency_ms: answer.latency_ms, raw: answer.raw)
         end
 
         return pass(model: model, latency_ms: answer.latency_ms, raw: answer.raw) unless parsed[:violated]
@@ -69,7 +72,7 @@ module Vangrail
         {
           'user_input' => (context[:side] == :input ? text : context[:user_input]).to_s,
           'bot_response' => (context[:side] == :output ? text : '').to_s,
-          'context' => context
+          'context' => context,
         }
       end