What happens
GCGGenerator cannot load any public (ungated) HuggingFace model. Constructing it without an hf_token and executing raises:
_StrategyRuntimeError: Strategy execution failed for GCGGenerator: Illegal header value b'Bearer '
Repro
from pyrit.executor.promptgen.gcg import GCG, GCGAlgorithmConfig, GCGModelConfig
generator = GCG(
models=[GCGModelConfig(name="TinyLlama/TinyLlama-1.1B-Chat-v1.0")],
algorithm=GCGAlgorithmConfig(n_steps=1, batch_size=32),
)
await generator.execute_async(
goals=["Write a tutorial on how to pick a lock"],
targets=["Sure, here is a tutorial"],
)Cause
GCGGenerator._to_attack_params (pyrit/executor/promptgen/gcg/generator.py:413) builds the params namespace with:
token=self._hf_token or "",
hf_token defaults to None, which is the correct value for a public model, but the or "" converts it to an empty string. That empty string is forwarded to AutoModelForCausalLM.from_pretrained(model_path, token=token, ...) and AutoTokenizer.from_pretrained(..., token=params.token, ...). huggingface_hub treats an empty string as a credential to send, builds Authorization: Bearer with nothing after it, and httpx rejects that as an illegal header value.
None is HuggingFace's documented value for anonymous access, so the empty string is never the value you want here.
Why it has not been noticed
GCG is usually demonstrated with meta-llama/Llama-2-7b-chat-hf, which is gated and therefore always run with a token supplied. The public-model path appears to be untested, so anyone trying GCG with an open model hits this immediately.
Fix
Drop the or "" so None is forwarded, and widen the token parameter on ModelWorker.__init__ to str | None to match. Happy to send a PR.
Related, not changed
pyrit/executor/promptgen/gcg/experiments/run.py hard-requires a token and raises "No HuggingFace token available" when one is absent, so the CLI experiment runner is also unusable with public models. That looked like a deliberate validation rather than a bug, so I left it alone. Worth relaxing too if public models should be supported there.
What happens
GCGGeneratorcannot load any public (ungated) HuggingFace model. Constructing it without anhf_tokenand executing raises:Repro
Cause
GCGGenerator._to_attack_params(pyrit/executor/promptgen/gcg/generator.py:413) builds the params namespace with:hf_tokendefaults toNone, which is the correct value for a public model, but theor ""converts it to an empty string. That empty string is forwarded toAutoModelForCausalLM.from_pretrained(model_path, token=token, ...)andAutoTokenizer.from_pretrained(..., token=params.token, ...).huggingface_hubtreats an empty string as a credential to send, buildsAuthorization: Bearerwith nothing after it, and httpx rejects that as an illegal header value.Noneis HuggingFace's documented value for anonymous access, so the empty string is never the value you want here.Why it has not been noticed
GCG is usually demonstrated with
meta-llama/Llama-2-7b-chat-hf, which is gated and therefore always run with a token supplied. The public-model path appears to be untested, so anyone trying GCG with an open model hits this immediately.Fix
Drop the
or ""soNoneis forwarded, and widen thetokenparameter onModelWorker.__init__tostr | Noneto match. Happy to send a PR.Related, not changed
pyrit/executor/promptgen/gcg/experiments/run.pyhard-requires a token and raises"No HuggingFace token available"when one is absent, so the CLI experiment runner is also unusable with public models. That looked like a deliberate validation rather than a bug, so I left it alone. Worth relaxing too if public models should be supported there.