Phase 6: AI Red Teaming Methodology & Tools · 75 min · PyRIT · Python

PyRIT — Multi-Turn Attack Orchestration

The attack that fails in one turn is often the attack that succeeds in five.

Hiring signal: Garak proficiency gets you through the door; PyRIT proficiency gets you the offer. Multi-turn attacks like Crescendo are how real adversaries actually operate against production models, and Microsoft's own red team built PyRIT because single-turn scanning wasn't catching what mattered. Candidates who can implement and reason about an escalating attack loop with a scorer demonstrate the deeper skill AI Red Team Engineer roles are actually testing for.

What you will learn

Explain PyRIT's architecture: datasets, targets, scorers, and orchestrators, and how they compose into an attack campaign
Distinguish Crescendo (gradual escalation with backtracking) from TAP (parallel branch exploration with pruning) as multi-turn attack strategies
Implement a simplified Crescendo orchestrator with a scorer that decides whether to escalate, backtrack, or stop
Explain when XPIAOrchestrator-style cross-domain injection testing is the right technique versus a direct conversational attack

The Problem

Garak (lesson 2) told you something important: your target's baseline defenses hold up against single, isolated adversarial prompts. But that's not how a patient attacker — or a real user drifting into misuse — actually behaves. They don't open with the harmful ask. They warm the model up: a history question, a mechanics question, a "just curious" follow-up, and only then the request that would have been refused cold. Each individual turn looks benign to a filter that only sees the current message.

This is why Microsoft's own AI red team, after early engagements kept missing exactly this class of vulnerability, built PyRIT — the Python Risk Identification Toolkit. PyRIT is an open-source framework for orchestrating exactly the kind of sophisticated, stateful, multi-turn attacks that a single-shot scanner like Garak structurally cannot represent. If Garak is the baseline scan every engagement runs first, PyRIT is where the real work of a red team engagement happens — deep testing against a specific target's specific weaknesses, informed by what the baseline scan already found.

PyRIT's Architecture: Datasets, Targets, Scorers, Orchestrators

PyRIT composes four building blocks into an attack campaign:

Datasets — the raw material for attack prompts. PyRIT ships 53+ attack datasets, including well-known benchmarks like HarmBench, AdvBench, and XSTest, plus Microsoft's own AIRT (AI Red Team) datasets built from real engagement findings. You rarely hand-write every prompt; you select and adapt from a dataset that already targets the harm category you're testing.
Targets — the abstraction over whatever you're attacking: a hosted chat API, a local model, an agent endpoint, even a non-model system in a chain. The same orchestrator logic runs against any target that implements the interface, so a Crescendo campaign built against one model can be repointed at another without rewriting the attack.
Scorers — PyRIT ships 20+ response scorers that judge whether a given response constitutes a "hit," including:
LLM-as-judge scorers (e.g. SelfAskLikertScorer) — an auxiliary LLM rates a response against a defined harm scale
Azure AI Content Safety — a hosted content-classification API as the scoring backend
True/false classifiers — deterministic checks for a specific condition (did it leak the target string, did it refuse)
Scorers are what turn a transcript into a verdict, and — critically for this lesson — what an orchestrator uses mid-campaign to decide what to do next.
Orchestrators — the attack strategies themselves, composing a dataset, a target, and a scorer into a run. This is where PyRIT earns its reputation: PromptSendingOrchestrator for straightforward batch sending, and the more sophisticated multi-turn orchestrators this lesson focuses on.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Crescendo and TAP: Two Multi-Turn Strategies, XPIAOrchestrator: Cross-Domain Prompt Injection, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.