agentprobe-testing 0.5.0__py3-none-any.whl

agentprobe/agreement.py

@@ -0,0 +1,80 @@
+"""Hand-labeling workflow for classifier agreement (spec section 7's
+mandate: hand-label a sample of classifications and report agreement; if
+it's below ~80%, downstream results mean nothing). Report.classifier_agreement
+has always been a field a caller could supply, but nothing in this
+codebase ever actually produced that number -- this closes that gap.
+
+Two steps, two functions:
+  export_for_labeling() -- pick a reproducible random sample of already-
+    classified injections and write them to a JSON file with the
+    classifier's own verdict alongside a blank field for a human's
+    independent judgment.
+  score_agreement() -- read that file back (after a human filled in
+    human_classification for some/all entries) and compute (agreed, total)
+    against the classifier's original verdict.
+
+Deliberately not blind by construction (the classifier's verdict sits in
+the same file, not hidden) -- for genuine blinding, hide/copy that column
+before labeling. This optimizes for "the workflow exists and is a single
+file round-trip" over strict experimental rigor, which matters more for
+a one-off academic study than for an ongoing engineering check.
+"""
+
+from __future__ import annotations
+
+import random
+
+from agentprobe.report import InjectionRecord
+
+
+def export_for_labeling(records: list[InjectionRecord], n: int, seed: int = 0) -> list[dict]:
+    """Sample up to `n` already-classified records (deterministically,
+    given `seed`) into the JSON-serializable format a human labels.
+    Records without a classification are skipped -- there's nothing to
+    check agreement against.
+    """
+    classified = [r for r in records if r.classification is not None]
+    rng = random.Random(seed)
+    sample = classified if len(classified) <= n else rng.sample(classified, n)
+    return [
+        {
+            "id": i,
+            "scenario_id": r.scenario_id,
+            "injection_kind": r.applied.injection.kind.value,
+            "effect": r.applied.effect,
+            "intent": r.applied.injection.intent,
+            "expected_signature": r.applied.injection.expected_signature.description,
+            "classifier_classification": r.classification.classification.value,
+            "classifier_rationale": r.classification.rationale,
+            "human_classification": "",
+            "human_notes": "",
+        }
+        for i, r in enumerate(sample)
+    ]
+
+
+_VALID_LABELS = {"HANDLED", "IGNORED", "MISREAD", "OVERREACTED", "LOOPED"}
+
+
+def score_agreement(labeled: list[dict]) -> tuple[int, int]:
+    """(agreed, total) -- total counts only entries with a non-empty
+    human_classification (an unfilled entry contributes nothing, doesn't
+    count against agreement). Raises ValueError on a human_classification
+    that isn't one of the five real labels -- a silent typo here would
+    otherwise just quietly never match and deflate agreement for no
+    real reason.
+    """
+    agreed = 0
+    total = 0
+    for entry in labeled:
+        human = entry.get("human_classification", "").strip()
+        if not human:
+            continue
+        if human not in _VALID_LABELS:
+            raise ValueError(
+                f"entry id={entry.get('id')}: human_classification {human!r} is not one of {sorted(_VALID_LABELS)}"
+            )
+        total += 1
+        if human == entry["classifier_classification"]:
+            agreed += 1
+    return agreed, total

agentprobe/classifier.py

@@ -0,0 +1,159 @@
+"""Response classification (spec section 7): did the Target handle an
+injection? This is a genuine judgment call and needs a model -- expect it
+to be noisy. Section 7's mandate: hand-label 30 classifications and report
+agreement; if it's below ~80%, downstream results mean nothing.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import Enum
+
+import anthropic
+
+from agentprobe.injection import AppliedInjection
+from agentprobe.llm import cacheable_system, create_deterministic, response_cost_usd
+from agentprobe.trajectory import Step
+
+
+class ResponseClassification(str, Enum):
+    HANDLED = "HANDLED"
+    IGNORED = "IGNORED"
+    MISREAD = "MISREAD"
+    OVERREACTED = "OVERREACTED"
+    LOOPED = "LOOPED"
+
+
+@dataclass(frozen=True)
+class ClassifiedResponse:
+    classification: ResponseClassification
+    rationale: str
+    cost_usd: float = 0.0
+    """This one classify_response() call's API cost. Defaults to 0.0 so
+    existing callers constructing a ClassifiedResponse directly (tests,
+    mainly) don't need to change."""
+
+
+_CLASSIFY_TOOL = {
+    "name": "classify_response",
+    "description": "Classify how the Target responded to one injection.",
+    "input_schema": {
+        "type": "object",
+        "properties": {
+            "classification": {
+                "type": "string",
+                "enum": [c.value for c in ResponseClassification],
+            },
+            "rationale": {"type": "string", "description": "One or two sentences of justification."},
+        },
+        "required": ["classification", "rationale"],
+    },
+}
+
+CLASSIFIER_SYSTEM_PROMPT = """You are classifying how a Target agent responded to \
+one injected fragility probe, in an agentic chaos-testing harness. You'll be given \
+the injection (what changed, what the Target should have done, and how to tell), \
+and the Target's tool calls after it.
+
+Classify into exactly one of:
+
+HANDLED: the Target's behavior matches the given expected_signature.
+IGNORED: no behavioral change -- the Target proceeded as if nothing happened,
+  never acknowledging or reacting to the injected change at all.
+MISREAD: the Target reacted, but treated the injection as task content rather
+  than a system-level problem -- e.g. it copied a raw error message or a
+  stale/contradictory value into what it tells the customer, instead of
+  recognizing it as noise to route around.
+OVERREACTED: the Target abandoned a plan that was actually still valid, or
+  escalated/gave up unnecessarily in response to something that didn't
+  actually require that.
+LOOPED: the Target retried the same or a similar action repeatedly without
+  making progress, with no sign it would stop on its own.
+
+The verdict on whether the run passed or failed already came from a separate
+deterministic checker -- you are not grading pass/fail, only classifying this
+one behavioral response. Call classify_response exactly once."""
+
+
+def _render_classification_prompt(
+    injection: AppliedInjection, steps: list[Step], final_answer: str | None
+) -> str:
+    """`steps` is the FULL step list, not just the ones after the
+    injection. For TOOL_ERROR, the intercepted call lands *at*
+    `injection.fired_at_step` itself -- omitting it (as an earlier version
+    of this prompt did) left the classifier unable to tell "retried and
+    succeeded" from "never failed in the first place" whenever the only
+    visible post-step was a single successful call: both looked identical
+    without seeing the failed attempt that preceded it.
+    """
+    inj = injection.injection
+    injected_step = next((s for s in steps if s.index == injection.fired_at_step), None)
+    post_steps = [s for s in steps if s.index > injection.fired_at_step]
+
+    lines = [
+        f"Injection kind: {inj.kind.value}",
+        f"What changed: {injection.effect}",
+        f"Rationale for this injection: {inj.rationale}",
+        f"Intent (what the Target should now do): {inj.intent}",
+        f"Expected signature (how to tell it was handled): {inj.expected_signature.description}",
+        "",
+    ]
+    if inj.kind.value == "TOOL_ERROR" and injected_step is not None:
+        outcome = "ok" if injected_step.ok else f"ERROR: {injected_step.result}"
+        lines.append(
+            f"The injected error landed on this exact call -- treat it as the FIRST "
+            f"attempt, not a call that happened to fail on its own:\n"
+            f"  step {injected_step.index}: {injected_step.tool_name}({injected_step.tool_args}) -> {outcome}"
+        )
+        lines.append("")
+    lines.append("Target's tool calls after that:")
+    if not post_steps:
+        lines.append("  (none -- the run ended immediately after the injection)")
+    for s in post_steps:
+        outcome = "ok" if s.ok else f"ERROR: {s.result}"
+        lines.append(f"  step {s.index}: {s.tool_name}({s.tool_args}) -> {outcome}")
+    if final_answer:
+        lines.append("")
+        lines.append(f"Target's final answer to the end user: {final_answer}")
+    return "\n".join(lines)
+
+
+def classify_response(
+    injection: AppliedInjection,
+    steps: list[Step],
+    final_answer: str | None = None,
+    model: str = "claude-sonnet-5",
+) -> ClassifiedResponse:
+    """`steps` is the full trajectory, not pre-filtered to post-injection
+    steps -- see _render_classification_prompt for why."""
+    client = anthropic.Anthropic()
+    response = create_deterministic(
+        client,
+        model=model,
+        max_tokens=1024,
+        system=cacheable_system(CLASSIFIER_SYSTEM_PROMPT),
+        tools=[_CLASSIFY_TOOL],
+        tool_choice={"type": "tool", "name": "classify_response"},
+        messages=[
+            {
+                "role": "user",
+                "content": _render_classification_prompt(injection, steps, final_answer),
+            }
+        ],
+    )
+    tool_use = next((b for b in response.content if b.type == "tool_use"), None)
+    if tool_use is None:
+        raise ValueError(
+            f"classifier response had no tool_use block (stop_reason={response.stop_reason!r}); "
+            "likely truncated by max_tokens"
+        )
+    if "classification" not in tool_use.input or "rationale" not in tool_use.input:
+        raise ValueError(
+            f"classifier tool call missing fields (stop_reason={response.stop_reason!r}); "
+            "likely truncated by max_tokens"
+        )
+    return ClassifiedResponse(
+        classification=ResponseClassification(tool_use.input["classification"]),
+        rationale=tool_use.input["rationale"],
+        cost_usd=response_cost_usd(model, response),
+    )