Summary

Adds a split-payload multi-turn attack strategy to PyRIT. Split-payload attacks distribute a harmful request across multiple conversation turns where each individual turn passes all safety classifiers independently, but the assembled sequence constitutes a harmful instruction.

This is different from Crescendo (which escalates) - split-payload fragments a single harmful request across innocuous turns. The test: could you write a single harmful prompt that contains the same information as the full conversation? If yes, it's a split payload.

Changes

New attack strategy

• \SplitPayloadAttack\ extending \MultiTurnAttackStrategy\ with three-phase execution:
  1. Decomposition: adversarial LLM decomposes objective into innocuous turns
  2. Execution: sends turns sequentially, verifying each passes per-turn safety
  3. Assembly audit: scores assembled conversation against original objective

Seed datasets

• 60 split-payload attack conversations across 10 categories
• 60 topic-matched benign hard negatives using vocabulary overlap

Design patterns

Four fragmentation patterns: component assembly, parameter specification, referential chains, context+technique split

Demo notebook

Shows configuring and running the attack against a target

Closes #1734

Testing

• Unit tests needed
• Integration test with mock target needed