dreadnode 2.0.49__tar.gz → 2.0.51__tar.gz

{dreadnode-2.0.49 → dreadnode-2.0.51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dreadnode
-Version: 2.0.49
+Version: 2.0.51
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io
@@ -12,7 +12,7 @@ Requires-Dist: aiofiles<25.0.0,>=24.1.0
 Requires-Dist: art<7.0.0,>=6.5
 Requires-Dist: aws-sdk-bedrock-runtime>=0.7.0; python_version >= '3.12'
 Requires-Dist: awscrt>=0.27.0; python_version >= '3.12'
-Requires-Dist: boto3<=1.41.5,>=1.40.0
+Requires-Dist: boto3<2.0.0,>=1.40.0
 Requires-Dist: coolname<3.0.0,>=2.2.0
 Requires-Dist: croniter<7.0.0,>=6.0.0
 Requires-Dist: cyclopts>=4.2.0
@@ -20,31 +20,31 @@ Requires-Dist: datasets>=4.5.0
 Requires-Dist: ddgs>=9.0.0
 Requires-Dist: fastapi>=0.115.0
 Requires-Dist: fastmcp>=2.14.0
-Requires-Dist: fsspec[s3]<=2025.10.0,>=2025.10.0
+Requires-Dist: fsspec[s3]<2027.0.0,>=2025.10.0
 Requires-Dist: gepa>=0.1.1
 Requires-Dist: httpx<1.0.0,>=0.28.0
 Requires-Dist: jsonpath-ng>=1.7.0
 Requires-Dist: jsonref>=1.1.0
 Requires-Dist: jsonschema>=4.26.0
-Requires-Dist: litellm<=1.84.0,>=1.84.0
-Requires-Dist: logfire<=3.20.0,>=3.5.3
+Requires-Dist: litellm==1.101.3
+Requires-Dist: logfire<5.0.0,>=3.5.3
 Requires-Dist: loguru>=0.7.3
 Requires-Dist: markdown-it-py[linkify]>=2.1.0
 Requires-Dist: markdownify<2.0.0,>=1.1.0
 Requires-Dist: mcp<2.0.0,>=1.25.0
 Requires-Dist: networkx>=3.6.1
-Requires-Dist: numpy<=2.3.5,>=2.3.0
+Requires-Dist: numpy<2.5.0,>=2.3.0
 Requires-Dist: optuna<5.0.0,>=4.5.0
 Requires-Dist: orjson>=3.11.5
 Requires-Dist: packaging>=24.0
-Requires-Dist: pandas<3.0.0,>=2.2.3
+Requires-Dist: pandas<4.0.0,>=2.2.3
 Requires-Dist: pillow<13.0.0,>=11.0.0
 Requires-Dist: prompt-toolkit<4.0.0,>=3.0.52
 Requires-Dist: pyarrow>=4.0.0
 Requires-Dist: pydantic-xml>=2.14.0
 Requires-Dist: pydantic<3.0.0,>=2.9.2
 Requires-Dist: pyyaml>=6.0.2
-Requires-Dist: s3fs<=2025.10.0,>=2025.10.0
+Requires-Dist: s3fs<2027.0.0,>=2025.10.0
 Requires-Dist: scipy<2.0.0,>=1.11.0
 Requires-Dist: smithy-aws-core>=0.7.0; python_version >= '3.12'
 Requires-Dist: soundfile<1.0.0,>=0.13.1
@@ -84,6 +84,10 @@ Requires-Dist: scikit-learn<2.0.0,>=1.7.1; extra == 'scoring'
 Requires-Dist: sentence-transformers<6.0.0,>=5.1.0; extra == 'scoring'
 Requires-Dist: textblob<1.0.0,>=0.19.0; extra == 'scoring'
 Requires-Dist: textstat<1.0.0,>=0.7.10; extra == 'scoring'
+Provides-Extra: slip
+Requires-Dist: sentence-transformers<6.0.0,>=5.1.0; extra == 'slip'
+Requires-Dist: spacy<4,>=3.7; extra == 'slip'
+Requires-Dist: wordfreq<4,>=3; extra == 'slip'
 Provides-Extra: training
 Requires-Dist: ray[default,serve]<3.0.0,>=2.10.0; extra == 'training'
 Requires-Dist: torch>=2.9.0; extra == 'training'

{dreadnode-2.0.49 → dreadnode-2.0.51}/dreadnode/airt/__init__.py

@@ -26,6 +26,7 @@ LLM jailbreak attacks:
 - genetic_persona_attack: GA-based persona prompt evolution
 - nexus_attack: NEXUS multi-module attack with ThoughtNet reasoning
 - siren_attack: Siren multi-turn attack with turn-level LLM feedback
+- slip_attack: SLIP self-jailbreaking via lexical insertion prompting (target as its own guide)
 - j2_meta_attack: J2 meta-jailbreak (jailbreak a model to jailbreak others)
 - attention_shifting_attack: ASJA dialogue history mutation attack
 - cot_jailbreak_attack: Chain-of-thought reasoning exploitation attack
@@ -170,6 +171,7 @@ from dreadnode.airt.reward_hacking import reward_hacking_attack
 from dreadnode.airt.salami_slicing import salami_slicing_attack
 from dreadnode.airt.self_persuasion import self_persuasion_attack
 from dreadnode.airt.siren import siren_attack
+from dreadnode.airt.slip import litellm_embedder, slip_attack
 from dreadnode.airt.tap import tap_attack
 from dreadnode.airt.target import extract_response_text, extract_tool_calls
 from dreadnode.airt.targets import (
@@ -252,6 +254,7 @@ __all__ = [
     "knockoff_extraction",
     "label_only_membership",
     "lira_membership",
+    "litellm_embedder",
     "loss_membership",
     "lrm_autonomous_attack",
     "mapf_attack",
@@ -286,6 +289,7 @@ __all__ = [
     "simba_attack",
     "simba_evasion",
     "siren_attack",
+    "slip_attack",
     "square_evasion",
     "tap_attack",
     "templatefuzz_attack",

dreadnode-2.0.51/dreadnode/airt/_slip_anchors.py

@@ -0,0 +1,313 @@
+"""Anchor-word identification for the SLIP jailbreak attack (arXiv:2601.02670).
+
+An "anchor word" is a content word (NOUN/VERB/ADJ/ADV) in the goal prompt P* that is
+semantically distant from every content word in a pool prompt p. Inserting such words
+into child pairs steers the pool toward the goal without naming the goal directly.
+
+Preferred path uses spaCy static word vectors (``en_core_web_md``) for POS + similarity
+and ``wordfreq`` for rarity ranking. Both are OPTIONAL. If either the import or the model
+is unavailable, we fall back to:
+  - content words  = whitespace tokens minus a small stopword list,
+  - similarity     = paraphrase-MiniLM token embeddings (sentence-transformers, a core
+    scoring dep), and
+  - rarity         = uniform (no wordfreq ranking).
+One loguru warning is emitted the first time we fall back. The fallback keeps the module
+importable and the attack runnable in CI, where spaCy and its model are absent.
+"""
+
+import re
+import typing as t
+
+from loguru import logger
+
+from dreadnode.scorers.cosine_sim import cosine_similarity
+
+if t.TYPE_CHECKING:
+    from sentence_transformers import SentenceTransformer
+
+# Minimal closed-class stopword set for the no-spaCy fallback. We only need to drop
+# obvious function words so the remaining tokens approximate content words.
+_STOPWORDS = frozenset(
+    {
+        "a",
+        "an",
+        "the",
+        "and",
+        "or",
+        "but",
+        "if",
+        "then",
+        "else",
+        "of",
+        "to",
+        "in",
+        "on",
+        "at",
+        "by",
+        "for",
+        "with",
+        "about",
+        "as",
+        "into",
+        "like",
+        "through",
+        "after",
+        "over",
+        "between",
+        "out",
+        "against",
+        "during",
+        "without",
+        "before",
+        "under",
+        "around",
+        "among",
+        "is",
+        "am",
+        "are",
+        "was",
+        "were",
+        "be",
+        "been",
+        "being",
+        "have",
+        "has",
+        "had",
+        "do",
+        "does",
+        "did",
+        "will",
+        "would",
+        "shall",
+        "should",
+        "may",
+        "might",
+        "must",
+        "can",
+        "could",
+        "this",
+        "that",
+        "these",
+        "those",
+        "i",
+        "you",
+        "he",
+        "she",
+        "it",
+        "we",
+        "they",
+        "me",
+        "him",
+        "her",
+        "us",
+        "them",
+        "my",
+        "your",
+        "his",
+        "its",
+        "our",
+        "their",
+        "what",
+        "which",
+        "who",
+        "whom",
+        "how",
+        "when",
+        "where",
+        "why",
+        "not",
+        "no",
+        "so",
+        "than",
+        "too",
+        "very",
+        "s",
+        "t",
+        "just",
+        "now",
+        "also",
+    }
+)
+
+_TOKEN_RE = re.compile(r"[A-Za-z][A-Za-z'-]*")
+
+# Cached fallback embedder and a one-shot flag so the warning fires at most once.
+_g_fallback_model: "SentenceTransformer | None" = None
+_g_warned_fallback = False
+
+# Cached spaCy pipeline. None means "not yet tried"; False means "tried and unavailable".
+_g_spacy_nlp: "t.Any | None | t.Literal[False]" = None
+
+
+def _load_spacy() -> "t.Any | None":
+    """Load the spaCy ``en_core_web_md`` pipeline once, or return ``None`` if unavailable."""
+    global _g_spacy_nlp  # noqa: PLW0603 - process-wide pipeline cache
+    if _g_spacy_nlp is False:
+        return None
+    if _g_spacy_nlp is not None:
+        return _g_spacy_nlp
+    try:
+        import spacy
+
+        nlp = spacy.load("en_core_web_md")
+    except Exception:
+        _g_spacy_nlp = False
+        return None
+    # A pipeline with no vectors can't give meaningful word similarity; treat as absent.
+    if not nlp.vocab.vectors_length:
+        _g_spacy_nlp = False
+        return None
+    _g_spacy_nlp = nlp
+    return nlp
+
+
+def _warn_fallback_once() -> None:
+    global _g_warned_fallback  # noqa: PLW0603 - one-shot warning flag
+    if not _g_warned_fallback:
+        _g_warned_fallback = True
+        logger.warning(
+            "SLIP anchor identification: spaCy vectors (en_core_web_md) unavailable; "
+            "falling back to token embeddings for similarity and uniform rarity "
+            "(install dreadnode[slip] + 'python -m spacy download en_core_web_md' for "
+            "the paper-faithful path)."
+        )
+
+
+def _fallback_model() -> "SentenceTransformer":
+    """Load and cache the paraphrase-MiniLM embedder used by the fallback path."""
+    global _g_fallback_model  # noqa: PLW0603 - process-wide embedder cache
+    if _g_fallback_model is None:
+        from sentence_transformers import SentenceTransformer
+
+        _g_fallback_model = SentenceTransformer("paraphrase-MiniLM-L6-v2")
+    return _g_fallback_model
+
+
+def _fallback_content_words(text: str) -> list[str]:
+    """Content words = alphabetic tokens minus stopwords (lowercased, order-preserving)."""
+    out: list[str] = []
+    seen: set[str] = set()
+    for match in _TOKEN_RE.finditer(text):
+        word = match.group(0).lower()
+        if word in _STOPWORDS or len(word) <= 1 or word in seen:
+            continue
+        seen.add(word)
+        out.append(word)
+    return out
+
+
+def _lexical_similarity(a: str, b: str) -> float:
+    """Cheap no-dependency word similarity: exact match, else character-ratio overlap."""
+    from difflib import SequenceMatcher
+
+    if a == b:
+        return 1.0
+    return SequenceMatcher(a=a, b=b).ratio()
+
+
+def _fallback_anchors(
+    pool_prompt: str,
+    goal: str,
+    *,
+    tau_word: float,
+    top_n: int,
+) -> list[str]:
+    """spaCy-absent path: token-embedding similarity, uniform rarity (input order).
+
+    When ``sentence-transformers`` is also unavailable (bare CI), degrade once more to a
+    character-ratio lexical similarity so anchor extraction still works with zero optional
+    dependencies.
+    """
+    _warn_fallback_once()
+    goal_words = _fallback_content_words(goal)
+    pool_words = _fallback_content_words(pool_prompt)
+    if not goal_words:
+        return []
+    if not pool_words:
+        # Nothing to compare against: every goal content word is an anchor.
+        return goal_words[:top_n]
+
+    try:
+        model = _fallback_model()
+    except Exception:
+        # No sentence-transformers: lexical similarity only.
+        anchors = [
+            w for w in goal_words if max(_lexical_similarity(w, u) for u in pool_words) < tau_word
+        ]
+        return anchors[:top_n]
+
+    goal_vecs = model.encode(goal_words)
+    pool_vecs = model.encode(pool_words)
+
+    anchors = []
+    for word, gvec in zip(goal_words, goal_vecs, strict=True):
+        max_sim = max(
+            cosine_similarity(list(map(float, gvec)), list(map(float, pvec))) for pvec in pool_vecs
+        )
+        if max_sim < tau_word:
+            anchors.append(word)
+    return anchors[:top_n]
+
+
+_CONTENT_POS = frozenset({"NOUN", "VERB", "ADJ", "ADV"})
+
+
+def _spacy_content_tokens(nlp: "t.Any", text: str) -> list["t.Any"]:
+    """Return spaCy tokens whose POS is a content class and that carry a vector."""
+    doc = nlp(text)
+    return [tok for tok in doc if tok.pos_ in _CONTENT_POS and tok.has_vector and not tok.is_stop]
+
+
+def identify_anchor_words(
+    pool_prompt: str,
+    goal: str,
+    *,
+    tau_word: float = 0.8,
+    top_n: int = 5,
+) -> list[str]:
+    """Identify anchor words in ``goal`` relative to ``pool_prompt`` (SLIP Phase 2.1).
+
+    For each content word ``w`` in ``goal``, compute the maximum cosine similarity to any
+    content word ``u`` in ``pool_prompt``; ``w`` is an anchor when that maximum is below
+    ``tau_word`` (i.e. the pool does not already express ``w``'s meaning). Anchors are
+    ranked by inverse word frequency (rarer first) via ``wordfreq`` when available.
+
+    Args:
+        pool_prompt: A prompt from the current pool P.
+        goal: The target goal prompt P*.
+        tau_word: Similarity threshold below which a goal word counts as an anchor.
+        top_n: Maximum number of anchor words to return.
+
+    Returns:
+        Up to ``top_n`` anchor words (lowercased), rarest first when wordfreq is present.
+    """
+    nlp = _load_spacy()
+    if nlp is None:
+        return _fallback_anchors(pool_prompt, goal, tau_word=tau_word, top_n=top_n)
+
+    goal_tokens = _spacy_content_tokens(nlp, goal)
+    pool_tokens = _spacy_content_tokens(nlp, pool_prompt)
+
+    candidates: list[str] = []
+    seen: set[str] = set()
+    for w in goal_tokens:
+        word = w.text.lower()
+        if word in seen:
+            continue
+        if not pool_tokens:
+            max_sim = 0.0
+        else:
+            max_sim = max(w.similarity(u) for u in pool_tokens)
+        if max_sim < tau_word:
+            seen.add(word)
+            candidates.append(word)
+
+    # Rank by inverse frequency (rarer = more distinctive). Uniform if wordfreq absent.
+    try:
+        from wordfreq import word_frequency
+
+        candidates.sort(key=lambda c: word_frequency(c, "en"))
+    except Exception:
+        _warn_fallback_once()
+
+    return candidates[:top_n]

{dreadnode-2.0.49 → dreadnode-2.0.51}/dreadnode/airt/assessment.py

@@ -79,6 +79,38 @@ def _get_platform_context_with_fallback() -> tuple[ApiClient, Profile] | None:
     return _get_platform_context()
 
 
+_SEVERITY_LABELS = ("critical", "high", "medium", "low", "info")
+
+
+def _validate_severity_policy(policy: dict[str, t.Any]) -> None:
+    """Validate a severity policy client-side (parity with the platform schema).
+
+    Raises ValueError on a malformed policy so the SDK rejects it up front rather
+    than silently falling back to the built-in matrix on the server.
+    """
+    if not isinstance(policy, dict):
+        raise TypeError("severity_policy must be a dict")
+    thresholds = policy.get("thresholds")
+    if thresholds is not None:
+        if not (isinstance(thresholds, list) and len(thresholds) == 5):
+            raise ValueError("severity_policy.thresholds must be a list of 5 numbers")
+        if any(thresholds[i] < thresholds[i + 1] for i in range(4)):
+            raise ValueError("severity_policy.thresholds must be in descending order")
+    for key, row in (policy.get("matrix") or {}).items():
+        if not (isinstance(row, list) and len(row) == 5):
+            raise ValueError(f"severity_policy.matrix[{key!r}] must have exactly 5 labels")
+        bad = [s for s in row if s not in _SEVERITY_LABELS]
+        if bad:
+            raise ValueError(f"severity_policy.matrix[{key!r}] has invalid labels: {bad}")
+    default_row = policy.get("default_row")
+    if default_row is not None and not (
+        isinstance(default_row, list)
+        and len(default_row) == 5
+        and all(s in _SEVERITY_LABELS for s in default_row)
+    ):
+        raise ValueError("severity_policy.default_row must be 5 valid severity labels")
+
+
 class Assessment:
     """Orchestrates multi-attack assessments.
 
@@ -109,6 +141,7 @@ class Assessment:
         judge_model: str | None = None,
         target_config: dict[str, t.Any] | None = None,
         attacker_config: dict[str, t.Any] | None = None,
+        severity_policy: dict[str, t.Any] | None = None,
         attack_manifest: list[dict[str, t.Any]] | None = None,
         workflow_run_id: str | None = None,
         workflow_script: str | None = None,
@@ -139,6 +172,19 @@ class Assessment:
         self.target_config = target_config
         self.attacker_config = attacker_config
 
+        # Fold an optional user severity policy into attacker_config; the platform
+        # reads attacker_config["severity_policy"] and applies it to this
+        # assessment's finding severities (custom thresholds / category matrix).
+        # Validate client-side so the SDK path rejects malformed policies up front
+        # (parity with the platform's CreateAssessmentRequest validation) rather
+        # than silently falling back to the built-in matrix server-side.
+        if severity_policy is not None:
+            _validate_severity_policy(severity_policy)
+            self.attacker_config = {
+                **(self.attacker_config or {}),
+                "severity_policy": severity_policy,
+            }
+
         # Infer first-class model ids from the configs when not passed explicitly,
         # so a user who only provides target_config / attacker_config still gets
         # model metadata on the assessment header AND findings (mirrors the
@@ -397,6 +443,175 @@ class Assessment:
 
         return result
 
+    async def record_attack_result(
+        self,
+        *,
+        attack_name: str,
+        succeeded: bool,
+        best_score: float,
+        goal: str | None = None,
+        goal_category: str | None = None,
+        category: str | None = None,
+        sub_category: str | None = None,
+        attack_domain: str | None = "agentic",
+        candidate: str = "",
+        response: str = "",
+        execution_time_s: float = 0.0,
+        jailbreak_threshold: float = 0.5,
+        compliance_tags: dict[str, t.Any] | None = None,
+        tool_calls: list[dict[str, t.Any]] | None = None,
+    ) -> None:
+        """Record a non-Study (custom-target) attack so it traces and materializes.
+
+        Study-based attacks record via :meth:`run`, which emits a study span and
+        appends an ``AttackResult``. Custom attack loops that return a plain report
+        (multi-step tool attacks, AgentVigil, EVA) bypass that path, so their
+        success is invisible in ClickHouse and the UI. Call this after such an
+        attack to emit an assessment-linked study span (plus one trial span) with
+        the fields the platform reads to materialize a finding, and to append an
+        ``AttackResult`` for the analytics summary.
+
+        Args:
+            attack_name: AIRT attack name (drives ``AirtAttackName``).
+            succeeded: Whether the attack achieved its objective.
+            best_score: Best objective score in ``[0, 1]`` (drives ``AirtBestScore``).
+            goal: Attack goal; falls back to the assessment goal.
+            goal_category: Goal category slug; falls back to the assessment category.
+            category / sub_category: Override the finding category; default to
+                ``goal_category``.
+            attack_domain: AIRT attack domain (default ``"agentic"``).
+            candidate: The winning payload/input (recorded on the trial).
+            response: The target's response (recorded on the trial).
+            execution_time_s: Wall-clock seconds for the attack.
+            jailbreak_threshold: Score at/above which the trial counts as a
+                jailbreak when ``succeeded`` is not already set.
+            compliance_tags: Optional compliance tag map for the analytics result.
+        """
+        await self._ensure_started()
+
+        from opentelemetry import trace as trace_api
+
+        from dreadnode.tracing.constants import (
+            AIRT_ATTRIBUTE_ASR,
+            AIRT_ATTRIBUTE_BEST_CANDIDATE,
+            AIRT_ATTRIBUTE_BEST_RESPONSE,
+            AIRT_ATTRIBUTE_BEST_SCORE,
+            AIRT_ATTRIBUTE_BEST_TOOL_CALLS,
+            AIRT_ATTRIBUTE_CANDIDATE,
+            AIRT_ATTRIBUTE_CATEGORY,
+            AIRT_ATTRIBUTE_EXECUTION_TIME_S,
+            AIRT_ATTRIBUTE_IS_JAILBREAK,
+            AIRT_ATTRIBUTE_RESPONSE,
+            AIRT_ATTRIBUTE_SUB_CATEGORY,
+            AIRT_ATTRIBUTE_TOOL_CALLS,
+        )
+        from dreadnode.tracing.spans import study_span, trial_span
+
+        # Structured tool-call evidence for the UI's Tool Calls panel (same span
+        # attributes the Study/generative + ATLAS paths emit). Custom agentic loops
+        # (multistep_tool_attack, AgentVigil, EVA) go through here, so without this
+        # their fired tool calls only ever appear as text in the response - not in
+        # the structured panel. JSON shape matches api `parse_tool_calls`:
+        # [{"name", "arguments", "agent"?, "result"?}].
+        tool_calls_json = ""
+        if tool_calls:
+            import json as _json
+
+            try:
+                tool_calls_json = _json.dumps(tool_calls, default=str)
+            except (TypeError, ValueError):
+                tool_calls_json = ""
+
+        resolved_goal = goal or self.goal or ""
+        resolved_category = goal_category or self.goal_category or ""
+        is_jailbreak = succeeded or best_score >= jailbreak_threshold
+        score = round(best_score, 4)
+        # The platform counts a trial as finished only when the candidate span
+        # attribute is non-empty (clickhouse.py), so never emit a blank candidate.
+        candidate_attr = candidate or attack_name
+
+        with study_span(
+            name=attack_name,
+            airt_assessment_id=self._assessment_id,
+            airt_attack_name=attack_name,
+            airt_goal=resolved_goal,
+            airt_goal_category=resolved_category,
+            airt_category=category or resolved_category,
+            airt_sub_category=sub_category or resolved_category,
+            airt_target_model=self.target_model,
+            airt_attacker_model=self.attacker_model,
+            airt_evaluator_model=self.judge_model,
+            airt_attack_domain=attack_domain,
+        ):
+            span = trace_api.get_current_span()
+            if span and span.is_recording():
+                span.set_attribute(AIRT_ATTRIBUTE_BEST_SCORE, score)
+                span.set_attribute(AIRT_ATTRIBUTE_ASR, 1.0 if is_jailbreak else 0.0)
+                span.set_attribute(AIRT_ATTRIBUTE_IS_JAILBREAK, "1" if is_jailbreak else "0")
+                span.set_attribute(AIRT_ATTRIBUTE_CATEGORY, category or resolved_category or "")
+                span.set_attribute(
+                    AIRT_ATTRIBUTE_SUB_CATEGORY, sub_category or resolved_category or ""
+                )
+                span.set_attribute(AIRT_ATTRIBUTE_EXECUTION_TIME_S, round(execution_time_s, 6))
+                # best_candidate/best_response drive the finding payload the UI renders.
+                span.set_attribute(AIRT_ATTRIBUTE_BEST_CANDIDATE, candidate_attr)
+                if response:
+                    span.set_attribute(AIRT_ATTRIBUTE_BEST_RESPONSE, response)
+                if tool_calls_json:
+                    span.set_attribute(AIRT_ATTRIBUTE_BEST_TOOL_CALLS, tool_calls_json)
+
+            # One trial span so trial_spans > 0 and jailbreak counting works.
+            with trial_span(
+                f"{attack_name}-0",
+                step=0,
+                airt_assessment_id=self._assessment_id,
+                airt_trial_index=0,
+                airt_attack_name=attack_name,
+                airt_goal=resolved_goal,
+                airt_goal_category=resolved_category,
+                airt_target_model=self.target_model,
+            ):
+                trial = trace_api.get_current_span()
+                if trial and trial.is_recording():
+                    trial.set_attribute(AIRT_ATTRIBUTE_BEST_SCORE, score)
+                    trial.set_attribute(AIRT_ATTRIBUTE_IS_JAILBREAK, "1" if is_jailbreak else "0")
+                    # Non-empty candidate is required for the trial to count as
+                    # finished in ClickHouse (uniqIf on candidate != '').
+                    trial.set_attribute(AIRT_ATTRIBUTE_CANDIDATE, candidate_attr)
+                    if response:
+                        trial.set_attribute(AIRT_ATTRIBUTE_RESPONSE, response)
+                    if tool_calls_json:
+                        trial.set_attribute(AIRT_ATTRIBUTE_TOOL_CALLS, tool_calls_json)
+
+        from dreadnode.airt.analytics.engine import AttackResult
+        from dreadnode.airt.analytics.types import GoalCategory, TrialData
+
+        try:
+            goal_category_enum = GoalCategory(resolved_category)
+        except (ValueError, KeyError):
+            goal_category_enum = GoalCategory.JAILBREAK_GENERAL
+
+        trial_data = TrialData(
+            score=score,
+            status="finished",
+            step=0,
+            candidate=candidate,
+            response=response,
+            scores={"objective": score},
+            execution_time_ms=execution_time_s * 1000.0,
+        )
+        self._attack_results.append(
+            AttackResult(
+                trials=[trial_data],
+                attack_name=attack_name,
+                goal=resolved_goal,
+                goal_category=goal_category_enum,
+                compliance_tags=compliance_tags or {},
+                transforms_applied=[],
+                execution_time_s=execution_time_s,
+            )
+        )
+
     def _build_study(
         self,
         factory: Callable[..., Study[t.Any]],