AI security · Code anatomy
When a security verdict needs a third value.
A five-line Microsoft PyRIT helper preserves “undetermined.” The hard part is keeping that meaning intact all the way to a release decision.
Kinwilder research desk · · AI-assisted analysis
Code specimen
true_false_score_aggregator.py
if left is False or right is False:
return False
if left is None or right is None:
return None
return True- Line 1: A decisive negative — A definitive False settles conjunction even when the other observation is unknown. That does not mean the missing observation succeeded.
- Line 3: Preserve missing evidence — If no False settled the expression, an undetermined operand must survive. Collapsing it into a binary dashboard changes the evidence claim.
- Line 5: True needs both observations — Within this Boolean-or-None contract, reaching this line means both propositions were true. The caller still has to define what those propositions mean.
What is established
The pinned PyRIT file revision is dated 9 October 2026. This is an examination of an evaluation helper, not a vulnerability announcement. Its Boolean aggregation preserves an undetermined verdict as a third state. A definitive negative settles an AND; otherwise an unknown input can leave the result unknown. Inspect Microsoft's exact source.
The five lines in the specimen are verbatim, with their MIT attribution in the source record. The surrounding file also defines the dual OR operation and obtains an undetermined value when a score cannot provide a verdict. We have not tested a deployed evaluation service or shown that any PyRIT user makes the mistake discussed below.
Our analysis
The question is not whether a Python value is truthy. It is what evidence an automated security decision is claiming to possess.
Imagine two checks on an AI assistant: one determines whether an observed response breached a content policy; another determines whether an action crossed an authorization boundary. A timeout, missing trace, or evaluator failure is an observation about the measurement process. Treating it as an observation about the assistant's safety silently changes the experiment.
The third value carries information
Consider an AND over propositions A and B. If A is definitively false, the conjunction is false regardless of B. If A is true and B is unknown, there is no basis to assert the conjunction. The unknown must survive. This is why the order of the branches matters: a decisive negative is checked before uncertainty.
Now change the proposition's meaning. “Both prohibited behaviors occurred” and “both mandatory controls passed” can use the same mathematical connective. Their consequences are completely different. A false result in the first statement can coexist with one prohibited behavior. A false result in the second prevents a positive assurance claim. No aggregation helper can select the right policy if the calling team has not named the proposition.
The most valuable review comment may therefore be a sentence in plain English: What exactly would a positive result authorize? Write that before debating whether AND or OR looks more cautious.
A useful decision table
This table is our explanatory model of conjunction over three verdict states. It is not a claim about a completed security assessment.
| First verdict | Second verdict | Conjunction | What you can assert |
|---|---|---|---|
| True | True | True | Both propositions were established |
| True | Unknown | Unknown | One required observation is missing |
| False | Unknown | False | The conjunction is disproved; coverage remains incomplete |
| Unknown | Unknown | Unknown | No combined verdict has been established |
The third row is the subtle one. A definite result for the logical expression does not mean that every underlying observation succeeded. You may have enough evidence to reject a release and still need to repair a broken evaluator. Keep those facts separately.
Coverage is a second axis
A single verdict should not carry the entire evaluation report. Our suggested report keeps at least a verdict, an attempted-test count, a completed-test count, and the identities of undetermined cases. For repeated experiments, it should also preserve the evaluated configuration and the policy version that interpreted the results.
This is a design recommendation, not a description of a particular PyRIT deployment. Its purpose is to make two superficially similar reports distinguishable: “all required tests completed and none found the prohibited event” versus “some measurements failed and the remaining ones did not find it.” Those statements support different confidence levels even when a dashboard paints both green.
There is another boundary after the aggregator. Serialization, a database column, a template, or an alert rule can collapse a third state back into a binary one. Preserving uncertainty inside a helper is useful only if the next consumer preserves its meaning. Review the report path all the way to the decision that grants permission or declares a release ready.
Defensive actions
Name every evaluated proposition and document the policy that consumes its result. Define what happens for unavailable evidence, empty input, partial coverage, and contradictory evaluators. A release gate can withhold positive assurance when required checks do not complete without treating every missing observation as proof of compromise.
Add contract tests at the boundaries between the scorer, aggregator, storage, and user interface. A meaningful test should assert both the decision and the retained evidence status. Include a case where one result is decisive while another remains unknown. Also include a case where no measurements arrive; its meaning should be explicit rather than inherited accidentally from a default value.
For a safe exercise, build the nine combinations of True, False, and Unknown on paper. Interpret each twice: first as “both harmful behaviors occurred,” then as “both mandatory controls passed.” Decide which outcomes authorize release and which require investigation. Do not execute fetched source, contact a model endpoint, or run attack prompts to understand this invariant.
Monitor the observation process as a system of its own. A rising unknown rate can indicate an instrumentation or service problem even when the completed-test verdict distribution stays stable. The report should make that visible to a human reviewer.
Limits
Three-valued logic preserves uncertainty; it does not make an evaluator accurate. Completed judgments can still be wrong, test cases can miss important behavior, and configuration changes can invalidate comparisons. We have inspected public code, not established the safety of a model or a product. The professional habit is to preserve what the evidence says—and what it does not say—until the final decision.
AI-assisted source analysis. The excerpt, license, and fingerprints were checked mechanically. No independent exploit reproduction or human expert review is implied.