FEAT add CodeAttackConverter and CodeAttackAttack (closes #1945)

[u7k4rs6]

Closes #1945.

Summary

Implements CodeAttack (Ren et al., ACL 2024, arXiv:2403.07865), which reformulates a harmful query as a code-completion task. The query is encoded into a data-structure initialization sequence inside a partial code template with a decode() stub, and the target is asked to complete the code. Because the intent is expressed as a programming task rather than a natural-language request, safety training keyed to natural language triggers less reliably. Black-box, no compute requirements.

Two notes for review (deltas from the issue)

1. Encoding is word-by-word, not character-by-character. The issue described it as char-by-char (from the paper abstract), but the reference implementation (renqibing/CodeAttack) splits on whitespace and hyphens via regex, with character-level only as a fallback for single-token inputs. I matched the reference code. One consequence: separators are normalized on encode (hyphens and runs of whitespace are consumed as delimiters), which is documented in the converter docstring.

2. Eight templates, not five. The issue scoped five (one per language), but the reference ships eight: the three Python types each have a base and a _plus verbose variant, and cpp and go have no verbose variant upstream. I included all eight to match the reference. Happy to drop the four _plus files if you would rather keep it to five.

Design

Follows the FlipConverter + FlipAttack two-class template.

• CodeAttackConverter (pyrit/prompt_converter/code_attack_converter.py): encodes the prompt into the chosen data-structure operations and renders the code template. Parameters: language (python_stack, python_list, python_string, cpp, go) and verbose (bool, default True, selects the _plus variant where one exists; intentionally a no-op for cpp and go). Standalone PromptConverter, composes through the normal pipeline.
• CodeAttackAttack (pyrit/executor/attack/single_turn/code_attack.py): subclasses PromptSendingAttack, instantiates the converter and prepends it to the request converters, injects a code-completion system prompt via prepended_conversation. Reuses existing scorers, no attack-specific scoring.
• Converter seed prompts live under pyrit/datasets/prompt_converters/ (matching the CodeChameleon convention) and the system prompt under pyrit/datasets/executors/ (matching flip_attack.yaml).

Tests

39 unit tests (23 converter, 16 attack), all passing, following the test_flip_converter.py / test_flip_attack.py patterns. Coverage includes per-language template rendering, verbose vs base variants, word-recovery round-trips, empty / special-character / long prompts, converter prepend ordering, system-prompt injection, and scorer invocation through the normal path. Pre-commit (ruff, ty, validate-docs) green.

Files

New:

• pyrit/prompt_converter/code_attack_converter.py
• pyrit/executor/attack/single_turn/code_attack.py
• pyrit/datasets/executors/code_attack.yaml
• 8 seed-prompt templates under pyrit/datasets/prompt_converters/ (code_attack_python_{stack,list,string}{,_plus}.yaml, code_attack_cpp.yaml, code_attack_go.yaml)
• tests/unit/prompt_converter/test_code_attack_converter.py
• tests/unit/executor/attack/single_turn/test_code_attack.py
• doc/code/executor/attack/code_attack.py (jupytext source, with generated .ipynb)

Modified (exports and docs registration):

• pyrit/prompt_converter/__init__.py
• pyrit/executor/attack/single_turn/__init__.py
• pyrit/executor/attack/__init__.py
• doc/myst.yml

Checklist

• pre-commit hooks pass
• Unit tests added and passing locally
• No regressions
• Docstrings on the converter and attack
• Notebook demonstrating usage