assay-sim 3.31.0

Simulation harness for Assay (internal, API unstable)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143

use super::basis::{make_clean_allow_basis, make_clean_deny_basis};
use crate::attacks::memory_poison::{PoisonOutcome, PoisonResult};
use crate::report::{AttackResult, AttackStatus};
use assay_core::mcp::decision::{classify_replay_diff, ContextPayloadState, ReplayDiffBucket};
use std::time::Instant;

/// Control B1: legitimate run metadata recall.
pub(in crate::attacks::memory_poison) fn control_b1_run_metadata_recall(
    delay_turns: u32,
) -> (PoisonResult, AttackResult) {
    let start = Instant::now();

    let baseline = make_clean_allow_basis();
    let recalled = baseline.clone();
    let bucket = classify_replay_diff(&baseline, &recalled);
    let flagged = bucket != ReplayDiffBucket::Unchanged;

    let pr = PoisonResult {
        vector_id: "control_b1_metadata_recall".to_string(),
        condition: "condition_c".to_string(),
        phase_a_injected: false,
        phase_b_delay_turns: delay_turns,
        phase_c_triggered: true,
        poison_retained: false,
        activation_succeeded: flagged,
        expected_classification: "Unchanged".to_string(),
        observed_classification: format!("{:?}", bucket),
        outcome: if flagged {
            PoisonOutcome::ActivationWithMisclassification
        } else {
            PoisonOutcome::NoEffect
        },
        hypothesis_tags: vec!["H3".to_string()],
    };

    let ar = AttackResult {
        name: format!("memory_poison.control_b1.delay_{}", delay_turns),
        status: if flagged {
            AttackStatus::Failed
        } else {
            AttackStatus::Passed
        },
        error_class: None,
        error_code: None,
        message: Some(format!("bucket={:?} false_positive={}", bucket, flagged)),
        duration_ms: start.elapsed().as_millis() as u64,
    };

    (pr, ar)
}

/// Control B2: legitimate prior tool observation recall.
pub(in crate::attacks::memory_poison) fn control_b2_tool_observation_recall(
    delay_turns: u32,
) -> (PoisonResult, AttackResult) {
    let start = Instant::now();

    let baseline = make_clean_deny_basis();
    let recalled = make_clean_deny_basis();
    let bucket = classify_replay_diff(&baseline, &recalled);
    let flagged = bucket != ReplayDiffBucket::Unchanged;

    let pr = PoisonResult {
        vector_id: "control_b2_tool_observation".to_string(),
        condition: "condition_c".to_string(),
        phase_a_injected: false,
        phase_b_delay_turns: delay_turns,
        phase_c_triggered: true,
        poison_retained: false,
        activation_succeeded: flagged,
        expected_classification: "Unchanged".to_string(),
        observed_classification: format!("{:?}", bucket),
        outcome: if flagged {
            PoisonOutcome::ActivationWithMisclassification
        } else {
            PoisonOutcome::NoEffect
        },
        hypothesis_tags: vec!["H3".to_string()],
    };

    let ar = AttackResult {
        name: format!("memory_poison.control_b2.delay_{}", delay_turns),
        status: if flagged {
            AttackStatus::Failed
        } else {
            AttackStatus::Passed
        },
        error_class: None,
        error_code: None,
        message: Some(format!("bucket={:?} false_positive={}", bucket, flagged)),
        duration_ms: start.elapsed().as_millis() as u64,
    };

    (pr, ar)
}

/// Control B3: legitimate approval context recall.
pub(in crate::attacks::memory_poison) fn control_b3_approval_context_recall(
    delay_turns: u32,
) -> (PoisonResult, AttackResult) {
    let start = Instant::now();

    let clean_state = ContextPayloadState::CompleteEnvelope;
    let recalled_state = ContextPayloadState::CompleteEnvelope;

    let flagged = clean_state != recalled_state;

    let pr = PoisonResult {
        vector_id: "control_b3_approval_recall".to_string(),
        condition: "condition_c".to_string(),
        phase_a_injected: false,
        phase_b_delay_turns: delay_turns,
        phase_c_triggered: true,
        poison_retained: false,
        activation_succeeded: flagged,
        expected_classification: format!("{:?}", clean_state),
        observed_classification: format!("{:?}", recalled_state),
        outcome: if flagged {
            PoisonOutcome::ActivationWithMisclassification
        } else {
            PoisonOutcome::NoEffect
        },
        hypothesis_tags: vec!["H3".to_string()],
    };

    let ar = AttackResult {
        name: format!("memory_poison.control_b3.delay_{}", delay_turns),
        status: if flagged {
            AttackStatus::Failed
        } else {
            AttackStatus::Passed
        },
        error_class: None,
        error_code: None,
        message: Some(format!(
            "state={:?} false_positive={}",
            clean_state, flagged
        )),
        duration_ms: start.elapsed().as_millis() as u64,
    };

    (pr, ar)
}