FEAT: Add BidiConverter for Arabic adversarial Unicode manipulation

[Raulster24]

Description

Adds BidiConverter, a deterministic PromptConverter that wraps text in a matched pair of Unicode bidirectional control characters so the logical (stored) code point order can differ from the order a reader sees rendered. This is the manipulation family behind the "Trojan Source" findings (CVE-2021-42574).

Three schemes are supported, per the Unicode Bidirectional Algorithm (UAX #9):

• override (default): RLO U+202E ... PDF U+202C
• embedding: RLE U+202B ... PDF U+202C
• isolate: RLI U+2067 ... PDI U+2069

The transformation is pure deterministic code point insertion (no LLM, no randomness), which makes it reproducible and distinct from the LLM-based converters. It is useful for probing bidirectional-rendering and tokenizer handling, and is particularly relevant when red-teaming right-to-left script (e.g. Arabic) models.

cc @romanlutz

Tests and Documentation

• Added tests/unit/prompt_converter/test_bidi_converter.py: covers all three schemes (exact output), empty input, determinism, invalid-scheme rejection, and unsupported-input-type rejection. All pass: uv run pytest tests/unit/prompt_converter/test_bidi_converter.py
• Registered the converter in pyrit/prompt_converter/__init__.py (import + __all__).
• Added a usage example to doc/code/converters/1_text_to_text_converters.py (Obfuscation Converters section) and regenerated the paired .ipynb plus the converter modality table in 0_converters.ipynb using JupyText (uv run jupytext --sync).
• Added a references.bib entry for the Trojan Source citation.
• The converter-documentation conformance test passes, and ruff and ty are clean.

[Raulster24]

@microsoft-github-policy-service agree