TheRock/rocm-systems/experimental/python/perfxpert/tests/fixtures/adversarial/README.md

Adversarial fixtures for the red-team suite

Each fixture is a deliberately malicious input used by exactly one test in tests/test_red_team/. These fixtures are NOT safe to execute directly — they exist to prove the sanitization + gate + allowlist stack rejects them.

Inventory

File	Attack class	Attack #	Test file
shell_metachar_kernel.db	prompt-injection	9	test_inject_shell_metachars.py
path_traversal_metadata.db	prompt-injection	10	test_inject_path_traversal.py
symlink_escape.tar	prompt-injection	11	test_inject_symlink_escape.py
prompt_injection_kernel_name.db	prompt-injection	covered by #9 sanitizer	(shared)
malformed_patch.diff	gate-evasion (compile)	2	test_gate_evasion_malformed_patch.py
destructive_llm_output.txt	prompt-injection	12	test_inject_destructive_llm_output.py
disallowed_compiler_flag.txt	prompt-injection	13	test_inject_disallowed_compiler_flag.py
disallowed_rocprofv3_flag.txt	prompt-injection	14	test_inject_disallowed_rocprofv3_flag.py
fake_1000x_speedup.json	gate-evasion (SOL)	1	test_gate_evasion_sol_sanity.py
numerical_divergence_patch.diff	gate-evasion (Bitwise)	3	test_gate_evasion_numerical_divergence.py
silent_10pct_regression/*.db	gate-evasion (regression)	4	test_gate_evasion_silent_10pct_regression.py
tail_kernel_regression/*.db	gate-evasion (weighted geomean)	5	test_gate_evasion_silent_tail_regression.py
test_removal_patch.diff	gate-evasion (test anchor)	6	test_gate_evasion_test_anchor_removal.py
prompt_injection_via_private_provider.txt	private-provider	R20/14	test_inject_disallowed_rocprofv3_flag.py

Generation

Fixtures that are .db files are generated by Python helpers in tests/test_red_team/conftest.py using the same UUID-based rocpd schema used for synthetic tests elsewhere in the suite. This keeps the repo diffable (fixtures are regenerated deterministically, not checked in as binary blobs when we can avoid it). Where a binary is required (e.g. symlink_escape.tar), the generator script is committed alongside.

Safety

NEVER run perfxpert analyze or any production tool against these fixtures outside the isolated test harness. The harness uses tmp_path sandboxes and subprocess fencing (env-var whitelist, no shell, bounded timeout) to ensure that even if a sanitizer bug exists, the blast radius is confined.