All Work

Implements the CodeAttack technique from Ren et al. for Microsoft’s AI red-teaming framework, across Python stack, list and string variants plus C++ and Go. Two and a half months of review across 43 review comments, 19 commits and 19 files. Review caught real bugs: json.dumps emitting lone surrogate escapes that Go and C++ reject, synchronous YAML loading inside an async method, machine-dependent absolute-path identifiers, and custom templates locked to one encoding. A language-aware escaper replaced json.dumps, template loading moved into the constructor, and the tests grew from 31 to 88. The architecture changed mid-review: I argued it needed its own attack class mirroring FlipAttack, and the senior maintainer decided otherwise, so it landed as a converter.

The reported bug was that BedrockGenerator sent both temperature and topP, which Claude 4.x on Bedrock rejects, breaking scans for everyone on those models. The maintainer had marked it a duplicate but invited a generic mechanism mirroring the OpenAICompatible pattern, so I built that rather than the narrow fix: a parameter map translating garak’s attribute names to Bedrock’s camelCase fields, the call path refactored to a loop with suppression checks, and validation moved into the constructor. On review I was asked to flip the key convention to garak’s names, did, and a competing narrower pull request was closed in favour of this one.

The original check decided whether a target was local by matching substrings in the URL, which is not a decision string matching can make correctly. It now parses the URL properly and uses Python’s ipaddress module for loopback handling, with 15 unit tests covering the cases the old check got wrong.

Worth telling honestly: this started as a roughly thousand-line GenAI Observability Mode submitted for CNCF LFX. The maintainer rejected it as too large to review and it stalled. I rewrote it as a three-file, plus-76 minus-4 change, and that is what merged. Twenty-three comments across the review.

A bug in my own merged code, found after the fact. The trace page scanned raw attributes itself rather than calling the canonical detector, so every improvement to that detector was quietly skipped on the auto-activation path. Four-line fix plus a regression test for each direction of divergence. I filed it as an issue and the fix auto-closed it; merged about two and a half hours after I reported the finding.

The dead-code pass never marked a type live when it appeared only as a generic argument. Three existing tests were asserting that wrong behaviour, so I corrected the tests rather than coding around them. This is the one that reached upstream GCC: it was sent to gcc-patches as part of a 77-patch gccrs sync, committed to GCC master with authorship preserved.

The most review process of any of these. My first design stored extern-crate status on the resolver rib; the reviewer rejected it and asked for a mapping keyed on node id instead. Rebuilding it around the existing module-id precedent surfaced a critical ordering difference: the precedent records after its insert, but this has to record before, because the duplicate check runs inside the insert and needs the new node’s status. Then three history rewrites on request, rebase, partial squash, full squash, with the suite verified bit-identical at 11,362 pass across all three.

My first fix for a crash I found and filed myself: `let x = ::;` segfaulted. The crash surfaced in type checking, but it came from three layers down in the parser, which returned an error sentinel with no diagnostic. Because the sentinel is built as a zero-segment path and the error check is literally "has no segments", it was indistinguishable from a legitimate empty path the whole way down. Another contributor suggested fixing it in the pattern parser; gdb showed the reported case routes elsewhere, so that would have left the crash live. My first attempt then regressed three tests by also firing on a bare metavariable, and narrowing the guard fixed it. A probe confirmed the narrow guard is complete rather than partial.

Part of the tracking issue migrating legacy typing constructs to built-in generics across the model-compression toolkit. A small diff, and a net-negative line count, which is the shape maintainers like.

The companion to the utils change, under the same tracking issue. Also net-negative.

Purely additive: a regex type that actually conforms to RFC 4291, validated before submission against a 22-case matrix and through the library’s own regex machinery. outlines is downloaded around 1.9 million times a month, which makes this the widest-distribution change here.

Content and structure work on the AI Village site, the DEF CON AI security community. Web content rather than tooling, and worth listing as such.

Companion to the community page change, on the same site.