Scanning the support assistant, end to end

Everything in the course, in one directory. This is the scan promised in lesson 0: a target you wrote, probes you chose, a rule of your own, and a build that fails.

Four files, and nothing in them is new. Every piece was built alone in an earlier lesson and the table says which.

The target

HANDBOOK = {
    "a17": "Order A17 shipped on 3 March by courier.",
    "refund": "Refunds take five working days.",
}

def reply(prompt, **kwargs):
    asked = prompt.lower()
    for key, line in HANDBOOK.items():
        if key in asked:
            return [line]
    return ["I can only help with orders and refunds."]

The scan

garak -t function -n support_bot#reply --spec probes.goodside,probes.test.Blank --generations 1 --report_prefix final 2>&1 | grep -E 'queue of probes|ok on'

Four probes against the assistant. The goodside family finds nothing, which for a dictionary lookup is the honest result, and the blank probe reports a hit because the bot answers a blank prompt at all.

Your own rule, over the same run

python3 -c "
import json

BANNED = ('wholesale', 'cost price', 'margin')
rows = [json.loads(l) for l in open('$HOME/.local/share/garak/garak_runs/final.report.jsonl')]

hits = 0
for r in rows:
    if r.get('entry_type') != 'attempt' or r.get('status') != 2:
        continue
    for out in r['outputs']:
        if any(w in (out['text'] or '').lower() for w in BANNED):
            hits += 1
print('answers checked, banned phrases found:', hits)
"

Nothing found, because this bot only knows two sentences. Point the same rule at an assistant with a model behind it and it starts earning its place.

What to do next

Swap the target for the real one with the line from lesson 19 and keep this function as the fixture that runs on every commit. Put the gate from lesson 20 in front of a pull request. Then take the first real hit and write the rail that stops it, which is where the guardrails courses start.