Simplify TAP node expectation handling

Require nodes to use the resolved execution expectation and remove the per-turn fallback. Update direct node fixtures and cover default and explicit expectations through branching.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: richlundeen

pyrit/executor/attack/multi_turn/tree_of_attacks.py

@@ -380,8 +380,8 @@ def __init__(
         attack_strategy_name: str,
         modality_router: _ModalityFeedbackRouter,
         record_objective_conversation: Callable[..., None],
+        expectation: ScoringExpectation,
         use_score_as_feedback: bool = True,
-        expectation: ScoringExpectation | None = None,
         memory_labels: dict[str, str] | None = None,
         parent_id: str | None = None,
         prompt_normalizer: PromptNormalizer | None = None,
@@ -411,9 +411,9 @@ def __init__(
                 messages. Typically shared across all nodes of the same attack.
             record_objective_conversation (Callable[..., None]): Records an objective-target
                 conversation ID for cleanup before each objective send.
+            expectation (ScoringExpectation): The execution's resolved scoring question.
             use_score_as_feedback (bool): Whether subsequent adversarial prompts include
                 the objective score. Defaults to True.
-            expectation (ScoringExpectation | None): The execution's scoring question.
             memory_labels (dict[str, str] | None): Labels for memory storage.
             parent_id (str | None): ID of the parent node, if this is a child node
             prompt_normalizer (PromptNormalizer | None): Normalizer for handling prompts and responses.
@@ -818,7 +818,7 @@ async def _score_response_async(self, *, response: Message, objective: str) -> N
             response (Message): The response from the objective target to evaluate.
                 This contains the target's reply to the adversarial prompt.
             objective (str): The attack objective describing what the attacker wants to achieve.
-                This is passed to scorers as context for evaluation.
+                Used for execution diagnostics; the resolved expectation supplies scoring criteria.
 
         Raises:
             RuntimeError: If the scoring process returns no objective score.
@@ -843,9 +843,7 @@ async def _score_response_async(self, *, response: Message, objective: str) -> N
                 response=response,
                 objective_scorer=self._objective_scorer,
                 auxiliary_scorers=self._auxiliary_scorers,
-                expectation=self._expectation
-                if self._expectation is not None
-                else ScoringExpectation(objective=objective),
+                expectation=self._expectation,
             )
 
         # Extract objective score

tests/unit/executor/attack/multi_turn/test_adversarial_chat_schema_forwarding.py

@@ -26,7 +26,7 @@
     TreeOfAttacksWithPruningAttack,
     _TreeOfAttacksNode,
 )
-from pyrit.models import Message, MessagePiece
+from pyrit.models import Message, MessagePiece, ScoringExpectation
 from pyrit.prompt_normalizer import PromptNormalizer
 
 # Text the JsonSchemaNormalizer appends when the target cannot enforce a schema
@@ -116,6 +116,7 @@ async def test_tap_forwards_schema_to_adversarial_target(patch_central_database)
         attack_strategy_name="TreeOfAttacksWithPruningAttack",
         modality_router=_ModalityFeedbackRouter(adversarial_chat=adversarial, objective_target=objective),
         record_objective_conversation=lambda *, conversation_id: None,
+        expectation=ScoringExpectation(objective="Test objective"),
     )
 
     await node._send_to_adversarial_chat_async(prompt_text="hello")

tests/unit/executor/attack/multi_turn/test_prepended_history_normalization.py

@@ -31,6 +31,7 @@
     Message,
     MessagePiece,
     PromptDataType,
+    ScoringExpectation,
 )
 from pyrit.prompt_normalizer import ConverterConfiguration, PromptNormalizer
 from pyrit.prompt_target import (
@@ -297,6 +298,7 @@ def _make_tap_node(*, target: PromptTarget) -> _TreeOfAttacksNode:
             objective_target=target,
         ),
         record_objective_conversation=lambda *, conversation_id: None,
+        expectation=ScoringExpectation(objective="Test objective"),
     )
 
 

tests/unit/executor/attack/multi_turn/test_supports_multi_turn_attacks.py

@@ -16,7 +16,7 @@
     MultiTurnAttackContext,
 )
 from pyrit.memory import CentralMemory
-from pyrit.models import ConversationType, Message, MessagePiece
+from pyrit.models import ConversationType, Message, MessagePiece, ScoringExpectation
 from pyrit.prompt_target import PromptTarget
 from pyrit.prompt_target.common.target_capabilities import TargetCapabilities
 from pyrit.prompt_target.common.target_configuration import TargetConfiguration
@@ -492,6 +492,7 @@ def _make_tap_node(self, *, supports_multi_turn: bool):
                 objective_target=target,
             ),
             record_objective_conversation=lambda *, conversation_id: None,
+            expectation=ScoringExpectation(objective="Test objective"),
         )
 
     def test_single_turn_target_duplicates_logical_history_without_seed_boundary(self):
@@ -879,6 +880,7 @@ def _make_tap_node(self, *, supports_multi_turn: bool):
                 objective_target=target,
             ),
             record_objective_conversation=lambda *, conversation_id: None,
+            expectation=ScoringExpectation(objective="Test objective"),
         )
 
     def test_branching_single_turn_target_preserves_system_across_depths(self):

tests/unit/executor/attack/multi_turn/test_tree_of_attacks.py

@@ -41,6 +41,7 @@
     MessagePiece,
     Score,
     ScoreStatus,
+    ScoringExpectation,
     SeedPrompt,
 )
 from pyrit.prompt_normalizer import PromptNormalizer
@@ -1197,6 +1198,7 @@ async def test_score_response_delegates_to_scorer_for_blocked(self, attack_build
                 objective_target=builder.objective_target,
             ),
             record_objective_conversation=lambda *, conversation_id: None,
+            expectation=ScoringExpectation(objective="test objective"),
             desired_response_prefix="Sure, here is",
             prompt_normalizer=normalizer,
         )
@@ -1264,6 +1266,7 @@ async def test_score_response_delegates_to_scorer_for_unknown_error(self, attack
                 objective_target=builder.objective_target,
             ),
             record_objective_conversation=lambda *, conversation_id: None,
+            expectation=ScoringExpectation(objective="test objective"),
             desired_response_prefix="Sure, here is",
             prompt_normalizer=normalizer,
         )
@@ -1692,6 +1695,7 @@ def node_components(self, attack_builder):
             "attack_strategy_name": "TreeOfAttacksWithPruningAttack",
             "modality_router": modality_router,
             "record_objective_conversation": lambda *, conversation_id: None,
+            "expectation": ScoringExpectation(objective="test objective"),
             "memory_labels": {"test": "label"},
             "parent_id": None,
             "prompt_normalizer": prompt_normalizer,
@@ -3198,6 +3202,7 @@ def node_components(self, attack_builder):
             "attack_strategy_name": "TreeOfAttacksWithPruningAttack",
             "modality_router": modality_router,
             "record_objective_conversation": lambda *, conversation_id: None,
+            "expectation": ScoringExpectation(objective="test objective"),
             "memory_labels": {},
             "parent_id": None,
             "prompt_normalizer": prompt_normalizer,

tests/unit/executor/attack/test_scoring_expectation_transport.py

@@ -571,11 +571,14 @@ async def test_attack_error_names_failing_scorer_async(
         assert get_execution_context() is None
 
     @pytest.mark.parametrize("duplicate", [False, True], ids=["initial_node", "duplicated_node"])
-    async def test_tap_node_preserves_execution_expectation_async(self, duplicate: bool) -> None:
+    @pytest.mark.parametrize("explicit_expectation", [False, True], ids=["default_objective", "scoring_objective"])
+    async def test_tap_node_preserves_execution_expectation_async(
+        self, *, duplicate: bool, explicit_expectation: bool
+    ) -> None:
         target = MockPromptTarget()
         leaf = _RecordingFloatScorer()
         auxiliary = _RecordingScorer()
-        supplied = _expectation()
+        supplied = _expectation() if explicit_expectation else None
         attack = TreeOfAttacksWithPruningAttack(
             objective_target=target,
             attack_adversarial_config=AttackAdversarialConfig(target=MockPromptTarget()),
@@ -586,6 +589,7 @@ async def test_tap_node_preserves_execution_expectation_async(self, duplicate: b
             on_topic_checking_enabled=False,
         )
         context = TAPAttackContext(params=AttackParameters(objective="attack objective", expectation=supplied))
+        expected = context.expectation
         with patch.object(attack, "_create_on_topic_scorer", wraps=attack._create_on_topic_scorer) as on_topic:
             node = attack._create_attack_node(
                 context=context, initial_prompt=Message.from_prompt(prompt="seed prompt", role="user")
@@ -600,8 +604,8 @@ async def test_tap_node_preserves_execution_expectation_async(self, duplicate: b
             node = child
 
         assert node.objective_score is not None
-        assert node.objective_score.scored_expectation == supplied
+        assert node.objective_score.scored_expectation == expected
         assert len(leaf.calls) == (2 if duplicate else 1)
-        assert all(expectation is supplied for _, expectation in leaf.calls)
-        assert all(expectation is supplied for _, expectation in auxiliary.calls)
+        assert all(expectation is expected for _, expectation in leaf.calls)
+        assert all(expectation is expected for _, expectation in auxiliary.calls)
         assert target.prompt_sent == ["seed prompt"]