電子證據開示 AI 攻擊

# Document evasion techniques for e-discovery AI
evasion_techniques = {
    "semantic_camouflage": {
        "description": "Express responsive concepts using unusual "
                       "vocabulary that the TAR model has not learned",
        "example": "Instead of 'we need to destroy the evidence', "
                   "use 'the garden needs weeding before spring' as "
                   "an established internal euphemism",
        "effectiveness": "High against keyword-augmented models, "
                         "moderate against semantic embedding models",
    },
    "format_exploitation": {
        "description": "Store responsive information in formats that "
                       "the AI processes poorly",
        "example": "Embed key discussions in image attachments, "
                   "handwritten notes scanned as PDF, or audio "
                   "transcripts with deliberate errors",
        "effectiveness": "High — most TAR systems process text only",
    },
    "context_dilution": {
        "description": "Surround responsive passages with large "
                       "volumes of non-responsive boilerplate",
        "example": "Append email signatures, legal disclaimers, and "
                   "auto-generated content that overwhelms the "
                   "responsive signal",
        "effectiveness": "Moderate — depends on model architecture",
    },
    "metadata_manipulation": {
        "description": "Alter document metadata to affect how the AI "
                       "processes and prioritizes the document",
        "example": "Change file dates, remove author information, "
                   "alter subject lines to appear routine",
        "effectiveness": "Low to moderate — metadata is one signal "
                         "among many, but can affect priority ranking",
    },
}

def test_tar_robustness(tar_system, test_corpus):
    """
    Measure TAR robustness by progressively modifying responsive
    documents and measuring classification degradation.
    """
    results = {
        "baseline_recall": None,
        "adversarial_recall": {},
    }
    baseline = tar_system.classify(test_corpus.documents)
    results["baseline_recall"] = calculate_recall(
        predicted=baseline,
        ground_truth=test_corpus.labels
    )
    for technique in ["synonym_substitution", "format_change",
                      "context_dilution", "metadata_alteration",
                      "combined"]:
        modified_docs = apply_evasion(
            test_corpus.responsive_documents,
            technique=technique
        )
        adversarial_corpus = test_corpus.replace_responsive(modified_docs)
        adversarial_result = tar_system.classify(adversarial_corpus.documents)
        results["adversarial_recall"][technique] = calculate_recall(
            predicted=adversarial_result,
            ground_truth=adversarial_corpus.labels
        )
    return results

# Testing whether adversarial document characteristics
# cause the privilege model to miss privileged documents
privilege_evasion_tests = [
    {
        "name": "informal_privilege",
        "description": "Privileged communication in casual format",
        "document": {
            "from": "jsmith@company.com",
            "to": "outside_counsel@lawfirm.com",
            "subject": "quick question",
            "body": "Hey Sarah - can we do the thing we discussed "
                    "at lunch? The one about the Johnson account? "
                    "Let me know. -Jim",
        },
        "expected": "privileged",
        "risk_if_missed": "Privilege waiver for legal advice on "
                          "Johnson account matter",
    },
    {
        "name": "embedded_privilege",
        "description": "Privileged content embedded in non-privileged thread",
        "document": {
            "type": "email_thread",
            "messages": [
                {"content": "Q3 sales figures attached", "privileged": False},
                {"content": "Meeting moved to Thursday", "privileged": False},
                {"content": "Counsel advised we should not proceed with "
                            "the acquisition due to antitrust risk",
                 "privileged": True},
                {"content": "Updated org chart", "privileged": False},
            ],
        },
        "expected": "privileged (entire thread due to embedded advice)",
        "risk_if_missed": "Production reveals litigation strategy",
    },
]

# Crafting documents that trigger false privilege flags
false_privilege_triggers = {
    "legal_vocabulary_flooding": {
        "technique": "Use legal terminology in business communications",
        "example": "We need to 'brief' the team on the 'matter' of "
                   "Q4 'filings' and ensure 'compliance' with the "
                   "'counsel' of the marketing advisory 'board'.",
        "mechanism": "Legal vocabulary triggers privilege classifiers "
                     "trained on keyword features",
    },
    "attorney_name_inclusion": {
        "technique": "CC attorneys on routine business communications",
        "example": "Adding general counsel to all-hands email "
                   "distributions so every company-wide email "
                   "includes an attorney recipient",
        "mechanism": "Attorney participation is a strong privilege "
                     "signal that can be artificially inflated",
    },
}

# Analyzing seed set representativeness
def assess_seed_set_vulnerability(seed_set, full_corpus):
    """
    Identify topics present in the full corpus but
    absent from the seed set — these are blind spots
    the adversary can exploit.
    """
    seed_topics = extract_topics(seed_set)
    corpus_topics = extract_topics(full_corpus)
    blind_spots = corpus_topics - seed_topics
    for topic in blind_spots:
        topic_docs = full_corpus.filter(topic=topic)
        responsive_rate = topic_docs.responsive_count / len(topic_docs)
        if responsive_rate > 0.3:
            print(f"CRITICAL BLIND SPOT: Topic '{topic}' has "
                  f"{responsive_rate:.0%} responsiveness rate but "
                  f"is absent from seed set.")

# Testing search term completeness with adversarial documents
def test_search_term_coverage(search_terms, adversarial_docs):
    """
    Measure how many adversarial documents evade the
    negotiated search terms.
    """
    evaded = []
    for doc in adversarial_docs:
        matched = False
        for term in search_terms:
            if term_matches(term, doc):
                matched = True
                break
        if not matched and doc.is_responsive:
            evaded.append(doc)
    evasion_rate = len(evaded) / len(
        [d for d in adversarial_docs if d.is_responsive]
    )
    return {
        "evaded_documents": evaded,
        "evasion_rate": evasion_rate,
        "critical": evasion_rate > 0.1,
    }