feat(red-team): structured attacker output — observation/strategy/reply JSON

[Aryansharma28]

Summary

Stacks on #340 (paper-fidelity refactor) and, transitively, #306 (GOAT strategy).

Implements the core innovation from Meta's GOAT paper (ICML 2025): the attacker emits a structured chain of thought at every turn — observation (what the target just revealed), strategy (which technique it will use and why), then the actual reply. We were previously letting the attacker emit free text, which:

• Lost the reasoning signal — the "Thought" step was optional and often skipped
• Made per-turn technique selection invisible to telemetry (biggest gap per red team: capture which GOAT technique the attacker chose per turn (telemetry) #330)
• Prevented the kind of per-target analytics the paper measures

Contract

New JSON_OUTPUT_CONTRACT module constant is appended to every attacker system prompt. Tells the attacker to emit exactly:

{"observation": "one sentence on target's last response",
 "strategy": "technique name + why (reference the catalogue)",
 "reply": "the actual message the target will see"}

Added to BOTH GoatStrategy and CrescendoStrategy — both strategies benefit from forced chain-of-thought and technique telemetry.

Parser

• RedTeamAgent._parse_attacker_output (Python) / parseAttackerOutput (TS)
• Strips ``` / ```json markdown fences (attacker sometimes wraps despite the contract)
• Returns (reply, observation, strategy, parseFailed)
• Graceful degradation: malformed JSON or missing reply → the raw response becomes the reply and a WARN-level log fires. The scenario keeps running. No attacker turn is wasted on a parse error.

Data flow

• Only reply reaches the target (goes into H_target).
• The full raw JSON stays in H_attacker so the attacker sees its own format on the next turn (consistent with the directive).
• observation and strategy are emitted as OpenTelemetry span attributes:
  • red_team.reasoning.observation
  • red_team.reasoning.strategy
  • red_team.reasoning.parse_failed

Dashboards can now answer "which technique works against which target?" — the paper's core analytical question.

Paper fidelity

Before this PR (after #306 + #340): ~85%. After this PR: ~95%. Remaining gap is benchmark alignment (default turn count, binary judge mode, JailbreakBench harness) tracked separately.

Test plan

• Python: 163 red-team tests passing (+11 new: parser well-formed, code-fence stripping, malformed fallback, missing/empty reply fallback, non-object JSON fallback, non-string field coercion, whitespace trimming, OUTPUT FORMAT section presence in both prompts)
• TypeScript: 115 red-team tests passing (+12 new — same coverage mirrored)
• Existing tests (mock callAttackerLLM with plain strings) continue to pass — verified the graceful fallback path preserves previous behaviour
• Manual: verify in a live run that real attacker LLMs emit the JSON format correctly (requires API keys)

Related

Part of EPIC: langwatch/langwatch#1713 (Scenarios Red Teaming)

Closes:

• langwatch/scenario#2142 — structured attacker output (this is the PR that implements it)
• red team: capture which GOAT technique the attacker chose per turn (telemetry) #330 — GOAT technique telemetry (span attributes now capture the attacker's declared technique per turn)

Stacks on:

• refactor(red-team): align GOAT with Meta's paper — drop pre-generated plan and stage hints #340 (paper fidelity)
• feat: add GOAT strategy with dynamic technique selection for RedTeamAgent #306 (base GOAT strategy)

🤖 Generated with Claude Code

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure.

• Scope: Adds a JSON_OUTPUT_CONTRACT to GOAT system prompts, implements parseAttackerOutput/_parse_attacker_output in JS and Python, updates GoatStrategy and RedTeamAgent to parse structured attacker output and emit red_team.reasoning.* telemetry attributes, and adds corresponding unit tests (JS + Python).
• Exclusions confirmed: no changes to auth, security settings, database schema, business-critical logic, or external integrations.
• Classification: low-risk-change under the documented policy.

The change is limited to red-team attacker prompts, parsing of attacker LLM output, and telemetry (adds a JSON output contract, parsers in TS/Python, and span attributes). It does not touch authentication/authorization, secrets, encryption, database schemas/migrations, business-critical financial logic, or external integrations, and includes graceful fallbacks and tests to preserve prior behavior on parse failures.

This classification allows merging without manual review once all required CI checks are passing and branch protection rules are satisfied.