Skip to article frontmatterSkip to article content
Site not loading correctly?

This may be due to an incorrect BASE_URL configuration. See the MyST Documentation for reference.

pyrit.prompt_converter

Prompt converters for transforming prompts before sending them to targets in red teaming workflows.

Converters are organized into categories: Text-to-Text (encoding, obfuscation, translation, variation), Audio (text-to-audio, audio-to-text, audio-to-audio), Image (text-to-image, image-to-image), Video (image-to-video), File (text-to-PDF/URL), Selective Converting (partial prompt transformation), and Human-in-the-Loop (interactive review). Converters can be stacked together to create complex transformation pipelines for testing AI system robustness.

Functions

get_converter_modalities

get_converter_modalities() → list[tuple[str, list[PromptDataType], list[PromptDataType]]]

Retrieve a list of all converter classes and their supported input/output modalities by reading the SUPPORTED_INPUT_TYPES and SUPPORTED_OUTPUT_TYPES class attributes.

Returns:

AddImageTextConverter

Bases: PromptConverter

Adds a string to an image and wraps the text into multiple lines if necessary.

This class is similar to :class:AddTextImageConverter except we pass in an image file path as an argument to the constructor as opposed to text.

Constructor Parameters:

ParameterTypeDescription
img_to_addstrFile path of image to add text to.
font_namestrPath of font to use. Must be a TrueType font (.ttf). Defaults to “helvetica.ttf”. Defaults to 'helvetica.ttf'.
colortupleColor to print text in, using RGB values. Defaults to (0, 0, 0). Defaults to (0, 0, 0).
font_sizefloatSize of font to use. Defaults to 15. Defaults to 15.
x_posintX coordinate to place text in (0 is left most). Defaults to 10. Defaults to 10.
y_posintY coordinate to place text in (0 is upper most). Defaults to 10. Defaults to 10.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by adding it as text to the image.

ParameterTypeDescription
promptstrThe text to be added to the image.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

AddImageVideoConverter

Bases: PromptConverter

Adds an image to a video at a specified position.

Currently the image is placed in the whole video, not at a specific timepoint.

Constructor Parameters:

ParameterTypeDescription
video_pathstrFile path of video to add image to.
output_path(str, Optional)File path of output video. Defaults to None. Defaults to None.
img_positiontuplePosition to place image in video. Defaults to (10, 10). Defaults to (10, 10).
img_resize_sizetupleSize to resize image to. Defaults to (500, 500). Defaults to (500, 500).

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'image_path') → ConverterResult

Convert the given prompt (image) by adding it to a video.

ParameterTypeDescription
promptstrThe image path to be added to the video.
input_typePromptDataTypeThe type of input data. Defaults to 'image_path'.

Returns:

Raises:

AddTextImageConverter

Bases: PromptConverter

Adds a string to an image and wraps the text into multiple lines if necessary.

This class is similar to :class:AddImageTextConverter except we pass in text as an argument to the constructor as opposed to an image file path.

Constructor Parameters:

ParameterTypeDescription
text_to_addstrText to add to an image. Defaults to empty string.
font_namestrPath of font to use. Must be a TrueType font (.ttf). Defaults to “helvetica.ttf”. Defaults to 'helvetica.ttf'.
colortupleColor to print text in, using RGB values. Defaults to (0, 0, 0). Defaults to (0, 0, 0).
font_sizefloatSize of font to use. Defaults to 15. Defaults to 15.
x_posintX coordinate to place text in (0 is left most). Defaults to 10. Defaults to 10.
y_posintY coordinate to place text in (0 is upper most). Defaults to 10. Defaults to 10.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'image_path') → ConverterResult

Convert the given prompt (image) by adding text to it.

ParameterTypeDescription
promptstrThe image file path to which text will be added.
input_typePromptDataTypeThe type of input data. Defaults to 'image_path'.

Returns:

Raises:

AllWordsSelectionStrategy

Bases: WordSelectionStrategy

Selects all words (default strategy).

Methods:

select_words

select_words(words: list[str]) → list[int]

Select all words.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

AnsiAttackConverter

Bases: PromptConverter

Generates prompts with ANSI codes to evaluate LLM behavior and system risks.

Constructor Parameters:

ParameterTypeDescription
include_rawboolInclude scenarios with raw ANSI codes. Defaults to True.
include_escapedboolInclude scenarios with escaped ANSI codes. Defaults to True.
include_tasksboolInclude “ASKS + HIGH_LEVEL_TASKS” scenarios. Defaults to True.
include_repeatsboolInclude “repeat this payload” scenarios. Defaults to True.
include_unescapeboolInclude “unescape this payload” scenarios. Defaults to True.
incorporate_user_promptboolIf True, the user’s prompt is integrated into the final scenario. Defaults to True.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into an ANSI attack scenario.

ParameterTypeDescription
promptstrThe original user prompt.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

input_supported

input_supported(input_type: PromptDataType) → bool

Check if the input type is supported.

ParameterTypeDescription
input_typePromptDataTypeThe type of input data.

Returns:

output_supported

output_supported(output_type: PromptDataType) → bool

Check if the output type is supported.

ParameterTypeDescription
output_typePromptDataTypeThe type of output data.

Returns:

AsciiArtConverter

Bases: PromptConverter

Uses the art package to convert text into ASCII art.

Constructor Parameters:

ParameterTypeDescription
fontstrThe font to use for ASCII art. Defaults to “rand” which selects a random font. Defaults to 'rand'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into ASCII art.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

AsciiSmugglerConverter

Bases: SmugglerConverter

Implements encoding and decoding using Unicode Tags.

If ‘control’ is True, the encoded output is wrapped with: - U+E0001 (start control tag) - U+E007F (end control tag)

Replicates the functionality detailed in the following blog post: Rehberger, 2024

Constructor Parameters:

ParameterTypeDescription
actionLiteral['encode', 'decode']The action to perform. Defaults to 'encode'.
unicode_tagsboolWhether to add Unicode tags during encoding. Defaults to False.

Methods:

decode_message

decode_message(message: str) → str

Decode a message encoded with Unicode Tags.

For each character in the Unicode Tags range, subtracts 0xE0000. Skips control tags if present.

ParameterTypeDescription
messagestrThe encoded message.

Returns:

encode_message

encode_message(message: str) → tuple[str, str]

Encode the message using Unicode Tags.

Each ASCII printable character (0x20-0x7E) is mapped to a corresponding Unicode Tag (by adding 0xE0000). If control mode is enabled, wraps the output.

ParameterTypeDescription
messagestrThe message to encode.

Returns:

AskToDecodeConverter

Bases: PromptConverter

Wraps encoded text with prompts that ask a target to decode it.

This converter takes encoded text (e.g., Base64, ROT13, Morse code) and wraps it in various prompt templates that request decoding. The prompts can be generic (“Decode the following text:”) or encoding-specific (“Base64 encoded string:”). This is useful for testing whether AI systems will decode potentially harmful encoded content when explicitly asked.

Credit to Garak: garak/probes/encoding.py

Constructor Parameters:

ParameterTypeDescription
templatestrCustom template for conversion. Should include {encoded_text} placeholder and optionally {encoding_name} placeholder. If None, a random template is selected. Defaults to None. Defaults to None.
encoding_namestrName of the encoding scheme (e.g., “Base64”, “ROT13”, “Morse”). Used in encoding_name_templates to provide context about the encoding type. Defaults to empty string. Defaults to 'cipher'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given encoded text by wrapping it with a decoding request prompt.

ParameterTypeDescription
promptstrThe encoded text to be wrapped with a decoding request.
input_typePromptDataTypeType of input data. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

AtbashConverter

Bases: PromptConverter

‘Hello 123’ would encode to ‘Svool 876’.

Constructor Parameters:

ParameterTypeDescription
append_descriptionboolIf True, appends plaintext “expert” text to the prompt. This includes instructions to only communicate using the cipher, a description of the cipher, and an example encoded using the cipher. Defaults to False.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt using the Atbash cipher.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

AudioEchoConverter

Bases: PromptConverter

Adds an echo effect to an audio file.

The echo is created by mixing a delayed, attenuated copy of the signal back into the original. The delay and decay parameters control the timing and loudness of the echo respectively. Sample rate, bit depth, and channel count are preserved.

Constructor Parameters:

ParameterTypeDescription
output_formatstrThe format of the audio file, defaults to “wav”. Defaults to 'wav'.
delayfloatThe echo delay in seconds. Must be greater than 0. Defaults to 0.3. Defaults to 0.3.
decayfloatThe decay factor for the echo (0.0 to 1.0). A value of 0.0 means no echo, 1.0 means the echo is as loud as the original. Must be between 0 and 1 (exclusive of both). Defaults to 0.5. Defaults to 0.5.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file by adding an echo effect.

ParameterTypeDescription
promptstrFile path to the audio file to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

AudioFrequencyConverter

Bases: PromptConverter

Shifts the frequency of an audio file by a specified value. By default, it will shift it above the human hearing range (=20 kHz).

Constructor Parameters:

ParameterTypeDescription
output_formatstrThe format of the audio file, defaults to “wav”. Defaults to 'wav'.
shift_valueintThe value by which the frequency will be shifted, defaults to 20000 Hz. Defaults to 20000.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file by shifting its frequency.

ParameterTypeDescription
promptstrFile path to the audio file to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

AudioSpeedConverter

Bases: PromptConverter

Changes the playback speed of an audio file without altering pitch or other audio characteristics.

A speed_factor > 1.0 speeds up the audio (shorter duration), while a speed_factor < 1.0 slows it down (longer duration). The converter resamples the audio signal using interpolation so that the sample rate, bit depth, and number of channels remain unchanged.

Constructor Parameters:

ParameterTypeDescription
output_formatstrThe format of the audio file, defaults to “wav”. Defaults to 'wav'.
speed_factorfloatThe factor by which to change the speed. Values > 1.0 speed up the audio, values < 1.0 slow it down. Must be greater than 0 and at most 100. Defaults to 1.5. Defaults to 1.5.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file by changing its playback speed.

The audio is resampled via interpolation so that the output has a different number of samples (and therefore a different duration) while keeping the original sample rate. This preserves the pitch and tonal qualities of the audio.

ParameterTypeDescription
promptstrFile path to the audio file to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

AudioVolumeConverter

Bases: PromptConverter

Changes the volume of an audio file by scaling the amplitude.

A volume_factor > 1.0 increases the volume (louder), while a volume_factor < 1.0 decreases it (quieter). A volume_factor of 1.0 leaves the audio unchanged. The converter scales all audio samples by the given factor and clips the result to the valid range for the original data type. Sample rate, bit depth, and number of channels are preserved.

Constructor Parameters:

ParameterTypeDescription
output_formatstrThe format of the audio file, defaults to “wav”. Defaults to 'wav'.
volume_factorfloatThe factor by which to scale the volume. Values > 1.0 increase volume, values < 1.0 decrease volume. Must be greater than 0. Defaults to 1.5. Defaults to 1.5.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file by changing its volume.

The audio samples are scaled by the volume factor. For integer audio formats the result is clipped to prevent overflow.

ParameterTypeDescription
promptstrFile path to the audio file to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

AudioWhiteNoiseConverter

Bases: PromptConverter

Adds white noise to an audio file.

White noise is generated and mixed into the original signal at a level controlled by the noise_scale parameter. The output preserves the original sample rate, bit depth, channel count, and number of samples.

Constructor Parameters:

ParameterTypeDescription
output_formatstrThe format of the audio file, defaults to “wav”. Defaults to 'wav'.
noise_scalefloatControls the amplitude of the added noise, expressed as a fraction of the signal’s maximum possible value. For int16 audio the noise amplitude will be noise_scale * 32767. Must be greater than 0 and at most 1.0. Defaults to 0.02. Defaults to 0.02.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file by adding white noise.

ParameterTypeDescription
promptstrFile path to the audio file to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

AzureSpeechAudioToTextConverter

Bases: PromptConverter

Transcribes a .wav audio file into text using Azure AI Speech service.

https://learn.microsoft.com/en-us/azure/ai-services/speech-service/speech-to-text

Constructor Parameters:

ParameterTypeDescription
azure_speech_region(str, Optional)The name of the Azure region. Defaults to None.
azure_speech_key(str, Optional)The API key for accessing the service (if not using Entra ID auth). Defaults to None.
azure_speech_resource_id(str, Optional)The resource ID for accessing the service when using Entra ID auth. This can be found by selecting ‘Properties’ in the ‘Resource Management’ section of your Azure Speech resource in the Azure portal. Defaults to None.
use_entra_authboolWhether to use Entra ID authentication. If True, azure_speech_resource_id must be provided. If False, azure_speech_key must be provided. Defaults to False. Defaults to False.
recognition_languagestrRecognition voice language. Defaults to “en-US”. For more on supported languages, see the following link: https://learn.microsoft.com/en-us/azure/ai-services/speech-service/language-support Defaults to 'en-US'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'audio_path') → ConverterResult

Convert the given audio file into its text representation.

ParameterTypeDescription
promptstrFile path to the audio file to be transcribed.
input_typePromptDataTypeThe type of input data. Defaults to 'audio_path'.

Returns:

Raises:

recognize_audio

recognize_audio(audio_bytes: bytes) → str

Recognize audio file and return transcribed text.

ParameterTypeDescription
audio_bytesbytesAudio bytes input.

Returns:

Raises:

stop_cb

stop_cb(evt: Any, recognizer: Any) → None

Stop continuous recognition upon receiving an event ‘evt’.

ParameterTypeDescription
evtspeechsdk.SpeechRecognitionEventArgsEvent.
recognizerspeechsdk.SpeechRecognizerSpeech recognizer object.

Raises:

transcript_cb

transcript_cb(evt: Any, transcript: list[str]) → None

Append transcribed text upon receiving a “recognized” event.

ParameterTypeDescription
evtspeechsdk.SpeechRecognitionEventArgsEvent.
transcriptlistList to store transcribed text.

AzureSpeechTextToAudioConverter

Bases: PromptConverter

Generates a wave file from a text prompt using Azure AI Speech service.

https://learn.microsoft.com/en-us/azure/ai-services/speech-service/text-to-speech

Constructor Parameters:

ParameterTypeDescription
azure_speech_region(str, Optional)The name of the Azure region. Defaults to None.
azure_speech_key(str, Optional)The API key for accessing the service (only if you’re not using Entra authentication). Defaults to None.
azure_speech_resource_id(str, Optional)The resource ID for accessing the service when using Entra ID auth. This can be found by selecting ‘Properties’ in the ‘Resource Management’ section of your Azure Speech resource in the Azure portal. Defaults to None.
use_entra_authboolWhether to use Entra ID authentication. If True, azure_speech_resource_id must be provided. If False, azure_speech_key must be provided. Defaults to False. Defaults to False.
synthesis_languagestrSynthesis voice language. Defaults to 'en_US'.
synthesis_voice_namestrSynthesis voice name, see URL. For more details see the following link for synthesis language and synthesis voice: https://learn.microsoft.com/en-us/azure/ai-services/speech-service/language-support Defaults to 'en-US-AvaNeural'.
output_formatstrEither wav or mp3. Must match the file prefix. Defaults to 'wav'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given text prompt into its audio representation.

ParameterTypeDescription
promptstrThe text prompt to be converted into audio.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

Base2048Converter

Bases: PromptConverter

Converter that encodes text to base2048 format.

This converter takes input text and converts it to base2048 encoding, which uses 2048 different Unicode characters to represent binary data. This can be useful for obfuscating text or testing how systems handle encoded Unicode content.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to base2048 encoding.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeType of data, unused for this converter. Defaults to 'text'.

Returns:

Raises:

Base64Converter

Bases: PromptConverter

Converter that encodes text to base64 format.

This converter takes input text and converts it to base64 encoding, which can be useful for obfuscating text or testing how systems handle encoded content.

Constructor Parameters:

ParameterTypeDescription
encoding_funcEncodingFuncThe base64 encoding function to use. Defaults to “b64encode”. Defaults to 'b64encode'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to base64 encoding.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeType of data, unused for this converter. Defaults to 'text'.

Returns:

Raises:

BinAsciiConverter

Bases: WordLevelConverter

Converts text to various binary-to-ASCII encodings.

Supports hex, quoted-printable, and UUencode formats.

Constructor Parameters:

ParameterTypeDescription
encoding_funcstrThe encoding function to use. Options: “hex”, “quoted-printable”, “UUencode”. Defaults to “hex”. Defaults to 'hex'.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.
word_split_separatorOptional[str]Separator used to split words in the input text. Defaults to " ". Defaults to ' '.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a word using the specified encoding function.

ParameterTypeDescription
wordstrThe word to encode.

Returns:

Raises:

join_words

join_words(words: list[str]) → str

Join words appropriately based on the encoding type and selection mode.

ParameterTypeDescription
wordslist[str]The list of encoded words to join.

Returns:

BinaryConverter

Bases: WordLevelConverter

Transforms input text into its binary representation with configurable bits per character (8, 16, or 32).

Constructor Parameters:

ParameterTypeDescription
bits_per_charBinaryConverter.BitsPerCharNumber of bits to use for each character (8, 16, or 32). Default is 16 bits. Defaults to BitsPerChar.BITS_16.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

join_words

join_words(words: list[str]) → str

Join the converted words with the binary representation of a space.

ParameterTypeDescription
wordslist[str]The list of converted words.

Returns:

validate_input

validate_input(prompt: str) → None

Check if bits_per_char is sufficient for the characters in the prompt.

ParameterTypeDescription
promptstrThe input text prompt to validate.

Raises:

BrailleConverter

Bases: PromptConverter

Converts text into Braille Unicode representation.

This converter transforms standard text into Braille patterns using Unicode Braille characters (U+2800 to U+28FF). It supports lowercase and uppercase letters, numbers, common punctuation, and spaces. Uppercase letters are prefixed with the Braille capitalization indicator.

The Braille mapping is based on the implementation from Garak: garak/probes/encoding.py

Note: This converter is useful for testing how AI systems handle Braille-encoded text, which can be used to obfuscate potentially harmful content.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given text into Braille Unicode representation.

ParameterTypeDescription
promptstrThe text to be converted to Braille.
input_typePromptDataTypeType of input data. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

CaesarConverter

Bases: PromptConverter

Encodes text using the Caesar cipher with a specified offset.

Using offset=1, ‘Hello 123’ would encode to ‘Ifmmp 234’, as each character would shift by 1. Shifts for digits 0-9 only work if the offset is less than 10, if the offset is equal to or greater than 10, any numeric values will not be shifted.

Constructor Parameters:

ParameterTypeDescription
caesar_offsetintOffset for caesar cipher, range 0 to 25 (inclusive). Can also be negative for shifting backwards.
append_descriptionboolIf True, appends plaintext “expert” text to the prompt. This includes instructions to only communicate using the cipher, a description of the cipher, and an example encoded using the cipher. Defaults to False.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt using the Caesar cipher.

ParameterTypeDescription
promptstrThe input prompt to be converted.
input_typePromptDataTypeThe type of the input prompt. Must be “text”. Defaults to 'text'.

Returns:

Raises:

CharSwapConverter

Bases: WordLevelConverter

Applies character swapping to words in the prompt to test adversarial textual robustness.

Constructor Parameters:

ParameterTypeDescription
max_iterationsintNumber of times to generate perturbed prompts. The higher the number the higher the chance that words are different from the original prompt. Defaults to 10.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, defaults to WordProportionSelectionStrategy(proportion=0.2). Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

CharacterSpaceConverter

Bases: PromptConverter

Spaces out the input prompt and removes specified punctuations.

For more information on the bypass strategy, refer to Robust Intelligence, 2024.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by removing punctuation and spacing out characters.

ParameterTypeDescription
promptstrThe input text prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

CodeChameleonConverter

Bases: PromptConverter

Code Chameleon Converter Lv et al., 2024.

Constructor Parameters:

ParameterTypeDescription
encrypt_typestrMust be one of “custom”, “reverse”, “binary_tree”, “odd_even” or “length”.
encrypt_functionCallableUser provided encryption function. Only used if encrypt_mode is “custom”. Used to encode user prompt. Defaults to None.
decrypt_functionCallable or listUser provided encryption function. Only used if encrypt_mode is “custom”. Used as part of markdown code block instructions in system prompt. If list is provided, strings will be treated as single statements for imports or comments. Functions will take the source code of the function. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by applying the specified encryption function.

ParameterTypeDescription
promptstrThe input prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

ColloquialWordswapConverter

Bases: PromptConverter

Converts text by replacing words with regional colloquial alternatives.

Supports loading substitutions from YAML files (e.g., Singaporean, Filipino, Indian) or accepting a custom substitution dictionary. Defaults to Singaporean substitutions.

Constructor Parameters:

ParameterTypeDescription
*argsboolDeprecated positional argument for deterministic. Use deterministic=... instead. Defaults to ().
deterministicboolIf True, use the first substitution for each wordswap. If False, randomly choose a substitution for each wordswap. Defaults to False. Defaults to False.
custom_substitutionsOptional[dict[str, list[str]]]A dictionary of custom substitutions to override the defaults. Defaults to None. Defaults to None.
wordswap_pathOptional[str]Path to a YAML file containing word substitutions. Can be a filename within the built-in colloquial_wordswaps directory (e.g., “filipino.yaml”) or an absolute path to a custom YAML file. Defaults to None (uses singaporean.yaml). Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by replacing words with regional colloquial alternatives.

ParameterTypeDescription
promptstrThe input text prompt to be converted.
input_typePromptDataTypeThe type of the input prompt. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

ConverterResult

The result of a prompt conversion, containing the converted output and its type.

DenylistConverter

Bases: LLMGenericTextConverter

Replaces forbidden words or phrases in a prompt with synonyms using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target for the prompt conversion. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
system_prompt_templateOptional[SeedPrompt]The system prompt template to use for the conversion. If not provided, a default template will be used. Defaults to None.
denylistlist[str]A list of words or phrases that should be replaced in the prompt. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by removing any words or phrases that are in the denylist, replacing them with synonymous words.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

DiacriticConverter

Bases: PromptConverter

Applies diacritics to specified characters in a string.

Constructor Parameters:

ParameterTypeDescription
target_charsstrCharacters to apply the diacritic to. Defaults to “aeiou”. Defaults to 'aeiou'.
accentstrType of diacritic to apply (default is ‘acute’). Available options are: - acute: ́ - grave: ̀ - tilde: ̃ - umlaut: ̈ Defaults to 'acute'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by applying diacritics to specified characters.

ParameterTypeDescription
promptstrThe text prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

EcojiConverter

Bases: PromptConverter

Converter that encodes text using Ecoji encoding.

Ecoji is an encoding scheme that represents binary data using emojis. See https://ecoji.io/ for more details.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to Ecoji encoding.

ParameterTypeDescription
promptstrThe text to encode.
input_typePromptDataTypeThe type of input. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

EmojiConverter

Bases: WordLevelConverter

Converts English text to randomly chosen circle or square character emojis.

Inspired by src/utils.ts

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

FirstLetterConverter

Bases: WordLevelConverter

Replaces each word of the prompt with its first letter (or digit). Whitespace and words that do not contain any letter or digit are ignored.

Constructor Parameters:

ParameterTypeDescription
letter_separatorstrThe string used to join the first letters. Defaults to ' '.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

join_words

join_words(words: list[str]) → str

Join the converted words using the specified letter separator.

ParameterTypeDescription
wordslist[str]The list of converted words.

Returns:

FlipConverter

Bases: PromptConverter

Flips the input text prompt. For example, “hello me” would be converted to “em olleh”.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by reversing the text.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeType of data. Defaults to 'text'.

Returns:

Raises:

HumanInTheLoopConverter

Bases: PromptConverter

Allows review of each prompt sent to a target before sending it.

Users can choose to send the prompt as is, modify the prompt, or run the prompt through one of the passed-in converters before sending it.

.. deprecated:: This converter is deprecated and will be removed in v0.13.0. Use the React-based GUI (CoPyRIT) instead.

Constructor Parameters:

ParameterTypeDescription
converters(List[PromptConverter], Optional)List of possible converters to run input through. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by allowing user interaction before sending it to a target.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

ImageCompressionConverter

Bases: PromptConverter

Compresses images to reduce file size while preserving visual quality.

This converter supports multiple compression strategies across JPEG, PNG, and WEBP formats, each with format-specific optimization settings. It can maintain the original image format or convert between formats as needed.

When converting images with transparency (alpha channel) to JPEG format, the converter automatically composites the transparent areas onto a solid background color.

Supported input types: File paths to any image that PIL can open (or URLs pointing to such images): https://pillow.readthedocs.io/en/stable/handbook/image-file-formats.html#fully-supported-formats

Constructor Parameters:

ParameterTypeDescription
output_formatstrOutput image format. If None, keeps original format (if supported). Defaults to None.
qualityintGeneral quality setting for JPEG and WEBP formats (0-100). For JPEG format, it represents the image quality, on a scale from 0 (worst) to 95 (best). For WEBP format, the value ranges from 0 to 100; for lossy compression: 0-smallest file size and 100-largest; for lossless: 0-fastest/less efficient, and 100 gives the best compression. Defaults to None.
optimizeboolWhether to optimize the image during compression. For JPEG: makes the encoder perform an extra pass over the image to select optimal settings. For PNG: instructs the PNG writer to make the output file as small as possible. Defaults to None.
progressiveboolWhether to save JPEG images as progressive. Defaults to None.
compress_levelintZLIB compression level (0-9): 1=fastest, 9=best, 0=none. Ignored if optimize is True (then it is forced to 9). Defaults to None.
losslessboolWhether to use lossless compression for WEBP format. Defaults to None.
methodintQuality/speed trade-off for WEBP format (0=fast, 6=slower-better). Defaults to None.
background_colortuple[int, int, int]RGB color tuple for background when converting transparent images to JPEG. Defaults to black. Defaults to (0, 0, 0).
min_compression_thresholdintMinimum file size threshold for compression. Defaults to 1024 bytes. Defaults to 1024.
fallback_to_originalboolFallback to original if compression increases file size. Defaults to True. Defaults to True.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'image_path') → ConverterResult

Convert the given prompt (image) by compressing it.

ParameterTypeDescription
promptstrThe image file path or URL pointing to the image to be compressed.
input_typePromptDataTypeThe type of input data. Defaults to 'image_path'.

Returns:

Raises:

IndexSelectionStrategy

Bases: TextSelectionStrategy

Selects text based on absolute character indices.

Constructor Parameters:

ParameterTypeDescription
startintThe starting character index (inclusive). Defaults to 0. Defaults to 0.
endOptional[int]The ending character index (exclusive). If None, selects to end of text. Defaults to None.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select a range based on absolute character indices.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

InsertPunctuationConverter

Bases: PromptConverter

Inserts punctuation into a prompt to test robustness.

Punctuation insertion: inserting single punctuations in string.punctuation. Words in a prompt: a word does not contain any punctuation and space. “a1b2c3” is a word; “a1 2” are 2 words; “a1,b,3” are 3 words.

Constructor Parameters:

ParameterTypeDescription
word_swap_ratiofloatPercentage of words to perturb. Defaults to 0.2. Defaults to 0.2.
between_wordsboolIf True, insert punctuation only between words. If False, insert punctuation within words. Defaults to True. Defaults to True.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text', punctuation_list: Optional[list[str]] = None) → ConverterResult

Convert the given prompt by inserting punctuation.

ParameterTypeDescription
promptstrThe text to convert.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.
punctuation_listOptional[List[str]]List of punctuations to use for insertion. Defaults to None.

Returns:

Raises:

JsonStringConverter

Bases: PromptConverter

Converts a string to a JSON-safe format using json.dumps().

This converter is useful when a string needs to be embedded within a JSON payload, such as when sending prompts to HTTP targets that expect JSON-formatted requests. The converter properly escapes special characters like quotes, newlines, backslashes, and unicode characters.

The output is the escaped string content without the surrounding quotes that json.dumps() adds, making it ready to be inserted into a JSON string field.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to a JSON-safe string.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

KeywordSelectionStrategy

Bases: TextSelectionStrategy

Selects text around a keyword with optional context.

Constructor Parameters:

ParameterTypeDescription
keywordstrThe keyword to search for.
context_beforeintNumber of characters to include before the keyword. Defaults to 0. Defaults to 0.
context_afterintNumber of characters to include after the keyword. Defaults to 0. Defaults to 0.
case_sensitiveboolWhether the keyword search is case-sensitive. Defaults to True. Defaults to True.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select the range around the first occurrence of the keyword.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

LLMGenericTextConverter

Bases: PromptConverter

Represents a generic LLM converter that expects text to be transformed (e.g. no JSON parsing or format).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe endpoint that converts the prompt. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
system_prompt_template(SeedPrompt, Optional)The prompt template to set as the system prompt. Defaults to None.
user_prompt_template_with_objective(SeedPrompt, Optional)The prompt template to set as the user prompt. expects Defaults to None.
kwargsAnyAdditional parameters for the prompt template. Defaults to {}.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt using an LLM via the specified converter target.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

LeetspeakConverter

Bases: WordLevelConverter

Converts a string to a leetspeak version.

Constructor Parameters:

ParameterTypeDescription
deterministicboolIf True, use the first substitution for each character. If False, randomly choose a substitution for each character. Defaults to True.
custom_substitutionsOptional[dict]A dictionary of custom substitutions to override the defaults. Defaults to None.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

MaliciousQuestionGeneratorConverter

Bases: LLMGenericTextConverter

Generates malicious questions using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe endpoint that converts the prompt. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
prompt_templateSeedPromptThe seed prompt template to use. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the input prompt into malicious questions.

ParameterTypeDescription
promptstrThe input prompt to convert.
input_typePromptDataTypeThe type of the input prompt. Must be “text”. Defaults to 'text'.

Returns:

input_supported

input_supported(input_type: PromptDataType) → bool

Check if the input type is supported.

ParameterTypeDescription
input_typePromptDataTypeThe type of the input prompt.

Returns:

output_supported

output_supported(output_type: PromptDataType) → bool

Check if the output type is supported.

ParameterTypeDescription
output_typePromptDataTypeThe desired type of the output prompt.

Returns:

MathObfuscationConverter

Bases: PromptConverter

Convert text into character-level algebraic identities.

This converter encodes each character of the input text into an equation of the form X = nX - (n - 1)X, where n is a randomly chosen integer greater than or equal to 2. This creates a deterministic, reversible obfuscation of the original input.

The transformation follows these rules:

An inline hint is added after the first equation, and a suffix instruction is appended to prompt the model to decode the content.

Constructor Parameters:

ParameterTypeDescription
min_nintMinimum integer value used for n in X = nX - (n - 1)X. Must be greater than or equal to 2. Defaults to 2.
max_nintMaximum integer value used for n. Must be greater than or equal to min_n. Defaults to 9.
hintOptional[str]Inline hint appended to the first equation line. If None, uses the default hint explaining the variable encoding. Set to empty string “” to disable hint entirely. Defaults to None.
suffixOptional[str]Custom suffix to append after the obfuscated text. If None, uses the default suffix prompting the model to decode. Set to empty string “” to disable suffix entirely. Defaults to None.
rngOptional[random.Random]Optional random number generator instance used to produce reproducible obfuscation results. If omitted, a new instance of random.Random() is created. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert text into algebraic obfuscated form.

Each non-space character in the input string is transformed into a corresponding algebraic identity. Space characters are represented as blank output lines, preserving word boundaries. Newline characters are preserved as block breaks in the output.

ParameterTypeDescription
promptstrInput text to be transformed.
input_typePromptDataTypeExpected to be "text". Other types are not supported. Defaults to 'text'.

Returns:

Raises:

MathPromptConverter

Bases: LLMGenericTextConverter

Converts natural language instructions into symbolic mathematics problems using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe endpoint that converts the prompt. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
prompt_templateSeedPromptThe seed prompt template to use. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into a mathematical problem format.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

MorseConverter

Bases: PromptConverter

Encodes prompts using morse code.

Uses ‘-’ and ‘.’ characters, with ’ ’ to separate characters and ‘/’ to separate words. Invalid or unsupported characters are replaced with an error sequence ‘........’.

Constructor Parameters:

ParameterTypeDescription
append_descriptionboolAppend plaintext “expert” text to the prompt. Includes instructions to only communicate using the cipher, a description of the cipher, and an example encoded using cipher. Defaults to False.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to morse code.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeType of input data. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

NatoConverter

Bases: PromptConverter

Converts text into NATO phonetic alphabet representation.

This converter transforms standard text into NATO phonetic alphabet format, where each letter is replaced with its corresponding NATO phonetic code word (e.g., “A” becomes “Alfa”, “B” becomes “Bravo”). Only alphabetic characters are converted; non-alphabetic characters are ignored.

The NATO phonetic alphabet is the most widely used spelling alphabet, designed to improve clarity of voice communication. This converter can be used to test how AI systems handle phonetically encoded text, which can be used to obfuscate potentially harmful content.

Reference: NATO phonetic alphabet

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given text into NATO phonetic alphabet representation.

ParameterTypeDescription
promptstrThe text to be converted to NATO phonetic alphabet.
input_typePromptDataTypeType of input data. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

NegationTrapConverter

Bases: PromptConverter

Converts a prompt into a negation-based logical trap. This technique exploits LLM reasoning patterns by asking the model to confirm or deny a wrong answer, potentially causing it to reveal the correct one.

This technique was discovered during CTF red teaming exercises where targets would leak information when asked to evaluate incorrect statements.

Constructor Parameters:

ParameterTypeDescription
wrong_valuestrA deliberately wrong value to use in the trap. The target may reveal the correct value when correcting this. Defaults to 'incorrect_guess'.
trap_template`strNone`

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the prompt into a negation trap.

This technique works by presenting an obviously wrong answer and asking the target to correct it, which may cause it to reveal protected information.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of the input prompt. Defaults to 'text'.

Returns:

Raises:

input_supported

input_supported(input_type: PromptDataType) → bool

Check if the input type is supported.

ParameterTypeDescription
input_typePromptDataTypeThe type of the input prompt.

Returns:

output_supported

output_supported(output_type: PromptDataType) → bool

Check if the output type is supported.

ParameterTypeDescription
output_typePromptDataTypeThe desired type of the output prompt.

Returns:

NoiseConverter

Bases: LLMGenericTextConverter

Injects noise errors into a conversation using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe endpoint that converts the prompt. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
noisestrThe noise to inject. Grammar error, delete random letter, insert random space, etc. Defaults to None.
number_errorsintThe number of errors to inject. Defaults to 5.
prompt_template(SeedPrompt, Optional)The prompt template for the conversion. Defaults to None.

PDFConverter

Bases: PromptConverter

Converts a text prompt into a PDF file.

Constructor Parameters:

ParameterTypeDescription
prompt_templateOptional[SeedPrompt]A SeedPrompt object representing a template. Defaults to None.
font_typestrFont type for the PDF. Defaults to “Helvetica”. Defaults to 'Helvetica'.
font_sizeintFont size for the PDF. Defaults to 12. Defaults to 12.
font_colortupleFont color for the PDF in RGB format. Defaults to (255, 255, 255). Defaults to (255, 255, 255).
page_widthintWidth of the PDF page in mm. Defaults to 210 (A4 width). Defaults to 210.
page_heightintHeight of the PDF page in mm. Defaults to 297 (A4 height). Defaults to 297.
column_widthintWidth of each column in the PDF. Defaults to 0 (full page width). Defaults to 0.
row_heightintHeight of each row in the PDF. Defaults to 10. Defaults to 10.
existing_pdfOptional[Path]Path to an existing PDF file. Defaults to None. Defaults to None.
injection_itemsOptional[List[Dict]]A list of injection items for modifying an existing PDF. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into a PDF.

If a template is provided, it injects the prompt into the template, otherwise, it generates a simple PDF with the prompt as the content. Further it can modify existing PDFs.

ParameterTypeDescription
promptstrThe prompt to be embedded in the PDF.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

PersuasionConverter

Bases: PromptConverter

Rephrases prompts using a variety of persuasion techniques.

Based on Zeng et al., 2024.

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe chat target used to perform rewriting on user prompts. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
persuasion_techniquestrPersuasion technique to be used by the converter, determines the system prompt to be used to generate new prompts. Must be one of “authority_endorsement”, “evidence_based”, “expert_endorsement”, “logical_appeal”, “misrepresentation”.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt using the persuasion technique specified during initialization.

ParameterTypeDescription
promptstrThe input prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

send_persuasion_prompt_async

send_persuasion_prompt_async(request: Message) → str

Send the prompt to the converter target and process the response.

ParameterTypeDescription
requestMessageThe message containing the prompt to be converted.

Returns:

Raises:

PositionSelectionStrategy

Bases: TextSelectionStrategy

Selects text based on proportional start and end positions.

Constructor Parameters:

ParameterTypeDescription
start_proportionfloatThe starting position as a proportion (0.0 to 1.0).
end_proportionfloatThe ending position as a proportion (0.0 to 1.0).

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select a range based on the relative position in the text.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

PromptConverter

Bases: Identifiable

Base class for converters that transform prompts into a different representation or format.

Concrete subclasses must declare their supported input and output modalities using class attributes:

These attributes are enforced at class definition time for all non-abstract subclasses.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into the target format supported by the converter.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

convert_tokens_async

convert_tokens_async(prompt: str, input_type: PromptDataType = 'text', start_token: str = '⟪', end_token: str = '⟫') → ConverterResult

Convert substrings within a prompt that are enclosed by specified start and end tokens. If there are no tokens present, the entire prompt is converted.

ParameterTypeDescription
promptstrThe input prompt containing text to be converted.
input_typestrThe type of input data. Defaults to “text”. Defaults to 'text'.
start_tokenstrThe token indicating the start of a substring to be converted. Defaults to “⟪” which is relatively distinct. Defaults to '⟪'.
end_tokenstrThe token indicating the end of a substring to be converted. Defaults to “⟫” which is relatively distinct. Defaults to '⟫'.

Returns:

Raises:

input_supported

input_supported(input_type: PromptDataType) → bool

Check if the input type is supported by the converter.

ParameterTypeDescription
input_typePromptDataTypeThe input type to check.

Returns:

output_supported

output_supported(output_type: PromptDataType) → bool

Check if the output type is supported by the converter.

ParameterTypeDescription
output_typePromptDataTypeThe output type to check.

Returns:

ProportionSelectionStrategy

Bases: TextSelectionStrategy

Selects a proportion of text anchored to a specific position (start, end, middle, or random).

Constructor Parameters:

ParameterTypeDescription
proportionfloatThe proportion of text to select (0.0 to 1.0).
anchorstrWhere to anchor the selection. Valid values: - ‘start’: Select from the beginning - ‘end’: Select from the end - ‘middle’: Select from the middle - ‘random’: Select from a random position Defaults to 'start'.
seedOptional[int]Random seed for reproducible random selections. Defaults to None. Defaults to None.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select a proportion of text based on the anchor position.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

QRCodeConverter

Bases: PromptConverter

Converts a text string to a QR code image.

Constructor Parameters:

ParameterTypeDescription
scale(int, Optional)Scaling factor that determines the width/height in pixels of each black/white square (known as a “module”) in the QR code. Defaults to 3. Defaults to 3.
border(int, Optional)Controls how many modules thick the border should be. Defaults to recommended value of 4. Defaults to 4.
dark_color(tuple, Optional)Sets color of dark modules, using RGB values. Defaults to black: (0, 0, 0). Defaults to (0, 0, 0).
light_color(tuple, Optional)Sets color of light modules, using RGB values. Defaults to white: (255, 255, 255). Defaults to (255, 255, 255).
data_dark_color(tuple, Optional)Sets color of dark data modules (the modules that actually stores the data), using RGB values. Defaults to dark_color. Defaults to None.
data_light_color(tuple, Optional)Sets color of light data modules, using RGB values. Defaults to light_color. Defaults to None.
finder_dark_color(tuple, Optional)Sets dark module color of finder patterns (squares located in three corners), using RGB values. Defaults to dark_color. Defaults to None.
finder_light_color(tuple, Optional)Sets light module color of finder patterns, using RGB values. Defaults to light_color. Defaults to None.
border_color(tuple, Optional)Sets color of border, using RGB values. Defaults to light_color. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt to a QR code image.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

ROT13Converter

Bases: WordLevelConverter

Encodes prompts using the ROT13 cipher.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

RandomCapitalLettersConverter

Bases: PromptConverter

Takes a prompt and randomly capitalizes it by a percentage of the total characters.

Constructor Parameters:

ParameterTypeDescription
percentagefloatThe percentage of characters to capitalize in the prompt. Must be between 1 and 100. Defaults to 100.0. This includes decimal points in that range. Defaults to 100.0.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by randomly capitalizing a percentage of its characters.

ParameterTypeDescription
promptstrThe input text prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

generate_random_positions

generate_random_positions(total_length: int, set_number: int) → list[int]

Generate a list of unique random positions within the range of total_length.

ParameterTypeDescription
total_lengthintThe total length of the string.
set_numberintThe number of unique random positions to generate.

Returns:

Raises:

is_percentage

is_percentage(input_string: float) → bool

Check if the input string is a valid percentage between 1 and 100.

ParameterTypeDescription
input_stringstrThe input string to check.

Returns:

string_to_upper_case_by_percentage

string_to_upper_case_by_percentage(percentage: float, prompt: str) → str

Convert a string by randomly capitalizing a percentage of its characters.

ParameterTypeDescription
percentagefloatThe percentage of characters to capitalize.
promptstrThe input string to be converted.

Returns:

Raises:

RandomTranslationConverter

Bases: LLMGenericTextConverter, WordLevelConverter

Translates each individual word in a prompt to a random language using an LLM.

An existing PromptChatTarget is used to perform the translation (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target for the prompt conversion. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
system_prompt_templateOptional[SeedPrompt]The system prompt template to use for the conversion. If not provided, a default template will be used. Defaults to None.
languagesOptional[List[str]]The list of available languages to use for translation. Defaults to None.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into the target format supported by the converter.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

RangeSelectionStrategy

Bases: TextSelectionStrategy

Selects text based on proportional start and end positions.

Constructor Parameters:

ParameterTypeDescription
start_proportionfloatThe starting position as a proportion (0.0 to 1.0). Defaults to 0.0. Defaults to 0.0.
end_proportionfloatThe ending position as a proportion (0.0 to 1.0). Defaults to 1.0. Defaults to 1.0.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select a range based on proportional positions.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

RegexSelectionStrategy

Bases: TextSelectionStrategy

Selects text based on the first regex match.

Constructor Parameters:

ParameterTypeDescription
patternUnion[str, Pattern[str]]The regex pattern to match.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select the range of the first regex match.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

RepeatTokenConverter

Bases: PromptConverter

Repeats a specified token a specified number of times in addition to a given prompt.

Based on: https://dropbox.tech/machine-learning/bye-bye-bye-evolution-of-repeated-token-attacks-on-chatgpt-models

Constructor Parameters:

ParameterTypeDescription
token_to_repeatstrThe string to be repeated.
times_to_repeatintThe number of times the string will be repeated.
token_insert_modestrThe mode of insertion for the repeated token. Can be “split”, “prepend”, “append”, or “repeat”. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by repeating the specified token a specified number of times.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of the input prompt. Defaults to 'text'.

Returns:

Raises:

ScientificTranslationConverter

Bases: LLMGenericTextConverter

Uses an LLM to transform simple or direct prompts into scientifically-framed versions using technical terminology, chemical notation, or academic phrasing. This can be useful for red-teaming scenarios to test whether safety filters can be bypassed through scientific translation.

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe LLM target to perform the conversion. Defaults to REQUIRED_VALUE.
modestrThe translation mode to use. Built-in options are: - academic: Use academic/homework style framing - technical: Use technical jargon and terminology - smiles: Uses chemical notation (e.g., SMILES or IUPAC notation such as “2-(acetyloxy)benzoic acid” or “CC(=O)Oc1ccccc1C(=O)O” for aspirin) - research: Frame as research/safety study or question - reaction: Frame as a step-by-step chemistry mechanism problem - math: Frame as the answer key to a mathematical problem or equation for a homework/exam setting - combined: Use combination of above techniques together (default) You can also use a custom mode name if you provide a prompt_template. Defaults to 'combined'.
prompt_template(SeedPrompt, Optional)Custom prompt template. Required if using a custom mode not in the built-in list. Defaults to None.

SearchReplaceConverter

Bases: PromptConverter

Converts a string by replacing chosen phrase with a new phrase of choice.

Constructor Parameters:

ParameterTypeDescription
patternstrThe regex pattern to replace.
replace`strlist[str]`
regex_flagsintRegex flags to use for the replacement. Defaults to 0 (no flags). Defaults to 0.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by replacing the specified pattern with a random choice from the replacement list.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

SelectiveTextConverter

Bases: PromptConverter

A wrapper converter that applies another converter to selected portions of text.

This converter supports multiple selection strategies:

Most use cases will use word-level strategies for more intuitive selection.

Constructor Parameters:

ParameterTypeDescription
converterPromptConverterThe converter to apply to the selected text.
selection_strategyTextSelectionStrategyThe strategy for selecting which text to convert. Can be character-level or word-level strategy.
preserve_tokensboolIf True, wraps converted text with start/end tokens. This allows subsequent converters in a chain to target different regions. Defaults to False. Defaults to False.
start_tokenstrThe token to place before converted text when preserve_tokens=True. Defaults to “⟪”. Defaults to '⟪'.
end_tokenstrThe token to place after converted text when preserve_tokens=True. Defaults to “⟫”. Defaults to '⟫'.
word_separatorstrThe separator to use when working with word-level strategies. Defaults to " ". Defaults to ' '.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert selected portions of the prompt using the wrapped converter.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Must be “text”. Defaults to 'text'.

Returns:

Raises:

SneakyBitsSmugglerConverter

Bases: SmugglerConverter

Encodes and decodes text using a bit-level approach.

Constructor Parameters:

ParameterTypeDescription
actionLiteral['encode', 'decode']The action to perform. Defaults to 'encode'.
zero_charOptional[str]Character to represent binary 0 in sneaky_bits mode (default: U+2062). Defaults to None.
one_charOptional[str]Character to represent binary 1 in sneaky_bits mode (default: U+2064). Defaults to None.

Methods:

decode_message

decode_message(message: str) → str

Decode the message encoded using Sneaky Bits mode.

The method filters out only the valid invisible characters (self.zero_char and self.one_char), groups them into 8-bit chunks, reconstructs each byte, and finally decodes the byte sequence using UTF-8.

ParameterTypeDescription
messagestrThe message encoded with Sneaky Bits.

Returns:

encode_message

encode_message(message: str) → tuple[str, str]

Encode the message using Sneaky Bits mode.

The message is first converted to its UTF-8 byte sequence. Then each byte is represented as 8 bits, with each bit replaced by an invisible character (self.zero_char for 0 and self.one_char for 1).

ParameterTypeDescription
messagestrThe message to encode.

Returns:

StringJoinConverter

Bases: WordLevelConverter

Converts text by joining its characters with the specified join value.

Constructor Parameters:

ParameterTypeDescription
join_valuestrThe string used to join characters of each word. Defaults to '-'.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

SuffixAppendConverter

Bases: PromptConverter

Appends a specified suffix to the prompt. E.g. with a suffix !!!, it converts a prompt of test to test !!!.

See https://github.com/Azure/PyRIT/tree/main/pyrit/auxiliary_attacks/gcg for adversarial suffix generation.

Constructor Parameters:

ParameterTypeDescription
suffixstrThe suffix to append to the prompt.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by appending the specified suffix.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeType of input data. Defaults to “text”. Defaults to 'text'.

Returns:

Raises:

SuperscriptConverter

Bases: WordLevelConverter

Converts text to superscript.

This converter leaves characters that do not have a superscript equivalent unchanged.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

TemplateSegmentConverter

Bases: PromptConverter

Uses a template to randomly split a prompt into segments defined by the template.

This converter is a generalized version of this: https://adversa.ai/blog/universal-llm-jailbreak-chatgpt-gpt-4-bard-bing-anthropic-and-beyond/

Constructor Parameters:

ParameterTypeDescription
prompt_template(SeedPrompt, Optional)The prompt template for the conversion. Must have two or more parameters. If not provided, uses the default tom_and_jerry.yaml template. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by splitting it into random segments and using them to fill the template parameters. The prompt is split into N segments (where N is the number of template parameters) at random word boundaries. Each segment is then used to fill the corresponding template parameter.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

TenseConverter

Bases: LLMGenericTextConverter

Converts a conversation to a different tense using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target chat support for the conversion which will translate. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
tensestrThe tense the converter should convert the prompt to. E.g. past, present, future.
prompt_template(SeedPrompt, Optional)The prompt template for the conversion. Defaults to None.

TextJailbreakConverter

Bases: PromptConverter

Uses a jailbreak template to create a prompt.

Constructor Parameters:

ParameterTypeDescription
jailbreak_templateTextJailBreakThe jailbreak template to use for conversion.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt using the jailbreak template.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

TextSelectionStrategy

Bases: abc.ABC

Base class for text selection strategies used by SelectiveTextConverter and WordLevelConverter. Defines how to select a region of text or words for conversion.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Select a range of characters in the text to be converted.

ParameterTypeDescription
textstrThe input text to select from.

Returns:

TokenSelectionStrategy

Bases: TextSelectionStrategy

A special selection strategy that signals SelectiveTextConverter to auto-detect and convert text between start/end tokens (e.g., ⟪ and ⟫).

This strategy is used when chaining converters with preserve_tokens=True. Instead of programmatically selecting text, it relies on tokens already present in the text from a previous converter.

Methods:

select_range

select_range(text: str) → tuple[int, int]

Do not use this method for TokenSelectionStrategy. SelectiveTextConverter handles token detection separately.

ParameterTypeDescription
textstrThe input text (ignored).

Returns:

ToneConverter

Bases: LLMGenericTextConverter

Converts a conversation to a different tone using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target chat support for the conversion which will translate. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
tonestrThe tone for the conversation. E.g. upset, sarcastic, indifferent, etc.
prompt_template(SeedPrompt, Optional)The prompt template for the conversion. Defaults to None.

ToxicSentenceGeneratorConverter

Bases: LLMGenericTextConverter

Generates toxic sentence starters using an LLM.

An existing PromptChatTarget is used to perform the conversion (like Azure OpenAI).

Based on Project Moonshot’s attack module that generates toxic sentences to test LLM safety guardrails: attack-modules/toxic_sentence_generator.py

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe endpoint that converts the prompt. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
prompt_templateSeedPromptThe seed prompt template to use. If not provided, defaults to the toxic_sentence_generator.yaml. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into a toxic sentence starter.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

input_supported

input_supported(input_type: PromptDataType) → bool

Check if the input type is supported.

ParameterTypeDescription
input_typePromptDataTypeThe type of input data.

Returns:

output_supported

output_supported(output_type: PromptDataType) → bool

Check if the output type is supported.

ParameterTypeDescription
output_typePromptDataTypeThe type of output data.

Returns:

TranslationConverter

Bases: PromptConverter

Translates prompts into different languages using an LLM.

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target chat support for the conversion which will translate. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
languagestrThe language for the conversion. E.g. Spanish, French, leetspeak, etc.
prompt_template(SeedPrompt, Optional)The prompt template for the conversion. Defaults to None.
max_retriesintMaximum number of retries for the conversion. Defaults to 3.
max_wait_time_in_secondsintMaximum wait time in seconds between retries. Defaults to 60.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by translating it using the converter target.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

TransparencyAttackConverter

Bases: PromptConverter

Currently, only JPEG images are supported as input. Output images will always be saved as PNG with transparency.

Constructor Parameters:

ParameterTypeDescription
benign_image_pathPathPath to the benign image file. Must be a JPEG file (.jpg or .jpeg).
sizetupleSize that the images will be resized to (width, height). It is recommended to use a size that matches aspect ratio of both attack and benign images. Since the original study resizes images to 150x150 pixels, this is the default size used. Bigger values may significantly increase computation time. Defaults to (150, 150).
stepsintNumber of optimization steps to perform. Recommended range: 100-2000 steps. Default is 1500. Generally, the higher the steps, the better end result you can achieve, but at the cost of increased computation time. Defaults to 1500.
learning_ratefloatControls the magnitude of adjustments in each step (used by the Adam optimizer). Recommended range: 0.0001-0.01. Default is 0.001. Values close to 1 may lead to instability and lower quality blending, while values too low may require more steps to achieve a good blend. Defaults to 0.001.
convergence_thresholdfloatMinimum change in loss required to consider improvement. If the change in loss between steps is below this value, it’s counted as no improvement. Default is 1e-6. Recommended range: 1e-6 to 1e-4. Defaults to 1e-06.
convergence_patienceintNumber of consecutive steps with no improvement before stopping. Default is 10. Defaults to 10.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'image_path') → ConverterResult

Convert the given prompt by blending an attack image (potentially harmful) with a benign image. Uses the Novel Image Blending Algorithm from McKee & Noever, 2024.

ParameterTypeDescription
promptstrThe image file path to the attack image.
input_typePromptDataTypeThe type of input data. Must be “image_path”. Defaults to 'image_path'.

Returns:

Raises:

UnicodeConfusableConverter

Bases: PromptConverter

Applies substitutions to words in the prompt to test adversarial textual robustness by replacing characters with visually similar ones.

Constructor Parameters:

ParameterTypeDescription
source_packageLiteral['confusable_homoglyphs', 'confusables']The package to use for homoglyph generation. Can be either: - “confusable_homoglyphs” (https://pypi.org/project/confusable-homoglyphs/): Used by default as it is more regularly maintained and up to date with the latest Unicode-provided confusables found here: https://www.unicode.org/Public/security/latest/confusables.txt - “confusables” (https://pypi.org/project/confusables/): Provides additional methods of matching characters (not just Unicode list), so each character has more possible substitutions. Defaults to 'confusable_homoglyphs'.
deterministicboolThis argument is for unittesting only. Defaults to False.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by applying confusable substitutions. This leads to a prompt that looks similar, but is actually different (e.g., replacing a Latin ‘a’ with a Cyrillic ‘а’).

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

UnicodeReplacementConverter

Bases: WordLevelConverter

Converts a prompt to its unicode representation.

Constructor Parameters:

ParameterTypeDescription
encode_spacesboolIf True, spaces in the prompt will be replaced with unicode representation. Defaults to False.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

join_words

join_words(words: list[str]) → str

Join a list of words into a single string, optionally encoding spaces as unicode.

ParameterTypeDescription
wordslist[str]The list of words to join.

Returns:

UnicodeSubstitutionConverter

Bases: PromptConverter

Encodes the prompt using any unicode starting point.

Constructor Parameters:

ParameterTypeDescription
start_valueintThe unicode starting point to use for encoding. Defaults to 917504.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by encoding it using any unicode starting point. Default is to use invisible flag emoji characters.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

UrlConverter

Bases: PromptConverter

Converts a prompt to a URL-encoded string.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into a URL-encoded string.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

VariationConverter

Bases: PromptConverter

Generates variations of the input prompts using the converter target.

Constructor Parameters:

ParameterTypeDescription
converter_targetPromptChatTargetThe target to which the prompt will be sent for conversion. Can be omitted if a default has been configured via PyRIT initialization. Defaults to REQUIRED_VALUE.
prompt_templateSeedPromptThe template used for generating the system prompt. If not provided, a default template will be used. Defaults to None.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by generating variations of it using the converter target.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

send_variation_prompt_async

send_variation_prompt_async(request: Message) → str

Send the message to the converter target and retrieve the response.

ParameterTypeDescription
requestMessageThe message to be sent to the converter target.

Returns:

Raises:

VariationSelectorSmugglerConverter

Bases: SmugglerConverter

Extension: In addition to embedding into a base character, we also support appending invisible variation selectors directly to visible text—enabling mixed visible and hidden content within a single string.

Constructor Parameters:

ParameterTypeDescription
actionLiteral['encode', 'decode']The action to perform. Defaults to 'encode'.
base_char_utf8Optional[str]Base character for variation_selector_smuggler mode (default: 😊). Defaults to None.
embed_in_baseboolIf True, the hidden payload is embedded directly into the base character. If False, a visible separator (space) is inserted between the base and payload. Default is True. Defaults to True.

Methods:

decode_message

decode_message(message: str) → str

Decode a message encoded using Unicode variation selectors. The decoder scans the string for variation selectors, ignoring any visible separator.

ParameterTypeDescription
messagestrThe encoded message.

Returns:

decode_visible_hidden

decode_visible_hidden(combined: str) → tuple[str, str]

Extract the visible text and decodes the hidden text from a combined string.

It searches for the first occurrence of the base character (self.utf8_base_char) and treats everything from that point on as the hidden payload.

ParameterTypeDescription
combinedstrThe combined text containing visible and hidden parts.

Returns:

encode_message

encode_message(message: str) → tuple[str, str]

Encode the message using Unicode variation selectors.

The message is converted to UTF-8 bytes, and each byte is mapped to a variation selector: - 0x00-0x0F => U+FE00 to U+FE0F. - 0x10-0xFF => U+E0100 to U+E01EF.

If embed_in_base is True, the payload is embedded directly into the base character; otherwise, a visible separator (a space) is inserted between the base and payload.

ParameterTypeDescription
messagestrThe message to encode.

Returns:

encode_visible_hidden

encode_visible_hidden(visible: str, hidden: str) → tuple[str, str]

Combine visible text with hidden text by encoding the hidden text using variation_selector_smuggler mode.

The hidden payload is generated as a composite using the current embedding setting and then appended to the visible text.

ParameterTypeDescription
visiblestrThe visible text.
hiddenstrThe secret/hidden text to encode.

Returns:

WordDocConverter

Bases: PromptConverter

Convert a text prompt into a Word (.docx) document.

This converter supports two main modes:

  1. New document generation If no existing document is provided, the converter creates a simple .docx containing the rendered prompt content in a single paragraph.

  2. Placeholder-based injection into an existing document If an existing_docx is provided, the converter searches for a literal placeholder string (for example {{INJECTION_PLACEHOLDER}}) in the document’s paragraphs. When the placeholder is found fully inside a single run, it is replaced with the rendered prompt content while preserving the rest of the paragraph and its formatting.

    .. important:: Placeholders must be fully contained within a single run. If a placeholder spans multiple runs (for example due to mixed formatting), this converter will not replace it. This limitation is intentional to avoid collapsing mixed formatting or rewriting complex run structures.

Constructor Parameters:

ParameterTypeDescription
prompt_templateOptional[SeedPrompt]Optional SeedPrompt template used to render the final content before injection. If provided, prompt passed to convert_async must be a string whose contents can be interpreted as the template parameters (for example, a JSON-encoded or other parseable mapping of keys to values). Defaults to None.
existing_docxOptional[Path]Optional path to an existing .docx file. When provided, the converter will search for placeholder inside the document paragraphs and replace it with the rendered content. If not provided, a new document is generated instead. Defaults to None.
placeholderstrLiteral placeholder text to search for in the existing document. This value must be fully contained within a single run for the replacement to succeed. Defaults to '{{INJECTION_PLACEHOLDER}}'.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt into a Word document (.docx).

If prompt_template is provided, the prompt is first used to render the template via SeedPrompt.render_template_value. Otherwise, the raw prompt string is used as the content.

ParameterTypeDescription
promptstrThe prompt or dynamic data used to generate the content.
input_typePromptDataTypeThe type of input data. Must be "text". Defaults to 'text'.

Returns:

Raises:

WordIndexSelectionStrategy

Bases: WordSelectionStrategy

Selects words based on their indices in the word list.

Constructor Parameters:

ParameterTypeDescription
indicesList[int]The list of word indices to select.

Methods:

select_words

select_words(words: list[str]) → list[int]

Select words at the specified indices.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

Raises:

WordKeywordSelectionStrategy

Bases: WordSelectionStrategy

Selects words that match specific keywords.

Constructor Parameters:

ParameterTypeDescription
keywordsList[str]The list of keywords to match.
case_sensitiveboolWhether matching is case-sensitive. Defaults to True. Defaults to True.

Methods:

select_words

select_words(words: list[str]) → list[int]

Select words that match the keywords.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

WordPositionSelectionStrategy

Bases: WordSelectionStrategy

Selects words based on proportional start and end positions.

Constructor Parameters:

ParameterTypeDescription
start_proportionfloatThe starting position as a proportion (0.0 to 1.0).
end_proportionfloatThe ending position as a proportion (0.0 to 1.0).

Methods:

select_words

select_words(words: list[str]) → list[int]

Select words based on the relative position.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

WordProportionSelectionStrategy

Bases: WordSelectionStrategy

Selects a random proportion of words.

Constructor Parameters:

ParameterTypeDescription
proportionfloatThe proportion of words to select (0.0 to 1.0).
seedOptional[int]Random seed for reproducible selections. Defaults to None. Defaults to None.

Methods:

select_words

select_words(words: list[str]) → list[int]

Select a random proportion of words.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

WordRegexSelectionStrategy

Bases: WordSelectionStrategy

Selects words that match a regex pattern.

Constructor Parameters:

ParameterTypeDescription
patternUnion[str, Pattern[str]]The regex pattern to match against words.

Methods:

select_words

select_words(words: list[str]) → list[int]

Select words that match the regex pattern.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

WordSelectionStrategy

Bases: TextSelectionStrategy

Base class for word-level selection strategies.

Word selection strategies work by splitting text into words and selecting specific word indices. They provide a select_words() method and implement select_range() by converting word selections to character ranges.

Methods:

select_range

select_range(text: str, word_separator: str = ' ') → tuple[int, int]

Select a character range by first selecting words, then converting to character positions.

This implementation splits the text by word_separator, gets selected word indices, then calculates the character range that spans those words.

ParameterTypeDescription
textstrThe input text to select from.
word_separatorstrThe separator used to split words. Defaults to " ". Defaults to ' '.

Returns:

select_words

select_words(words: list[str]) → list[int]

Select word indices to be converted.

ParameterTypeDescription
wordsList[str]The list of words to select from.

Returns:

ZalgoConverter

Bases: WordLevelConverter

Converts text into cursed Zalgo text using combining Unicode marks.

Constructor Parameters:

ParameterTypeDescription
intensityintNumber of combining marks per character (higher = more cursed). Default is 10. Defaults to 10.
seedOptional[int]Optional seed for reproducible output. Defaults to None.
word_selection_strategyOptional[WordSelectionStrategy]Strategy for selecting which words to convert. If None, all words will be converted. Defaults to None.

Methods:

convert_word_async

convert_word_async(word: str) → str

Convert a single word into the target format supported by the converter.

ParameterTypeDescription
wordstrThe word to be converted.

Returns:

validate_input

validate_input(prompt: str) → None

Validate the input prompt before conversion.

ZeroWidthConverter

Bases: PromptConverter

Injects zero-width spaces between characters in the provided text to bypass content safety mechanisms.

Methods:

convert_async

convert_async(prompt: str, input_type: PromptDataType = 'text') → ConverterResult

Convert the given prompt by injecting zero-width spaces between each character.

ParameterTypeDescription
promptstrThe prompt to be converted.
input_typePromptDataTypeThe type of input data. Defaults to 'text'.

Returns:

Raises:

References
  1. Rehberger, J. (2024). Hiding and Finding Text with Unicode Tags. https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/
  2. Robust Intelligence. (2024). Bypassing Meta’s LLaMA Classifier: A Simple Jailbreak. https://www.robustintelligence.com/blog-posts/bypassing-metas-llama-classifier-a-simple-jailbreak
  3. Lv, H., Wang, X., Zhang, Y., Huang, C., Dou, S., Ye, J., Gui, T., Zhang, Q., & Huang, X. (2024). CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models. arXiv Preprint arXiv:2402.16717. https://arxiv.org/abs/2402.16717
  4. Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., & Shi, W. (2024). How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs. arXiv Preprint arXiv:2401.06373. https://arxiv.org/abs/2401.06373
  5. McKee, F., & Noever, D. (2024). Transparency Attacks: How Imperceptible Image Layers Can Fool AI Perception. arXiv Preprint arXiv:2401.15817. https://arxiv.org/abs/2401.15817