Description

Adds LiteLLMChatTarget, a new prompt target that uses the LiteLLM SDK (litellm.acompletion()) to reach 100+ providers (Anthropic, AWS Bedrock, Google Vertex, Cohere, etc.) directly — no separate proxy server required. LiteLLM speaks the OpenAI Chat Completions wire format, so the target shares its request-building and response-parsing logic with OpenAIChatTarget instead of reinventing it.

from pyrit.prompt_target import LiteLLMChatTarget

# Anthropic (LiteLLM reads ANTHROPIC_API_KEY from env)
target = LiteLLMChatTarget(model_name="anthropic/claude-sonnet-4-6")

# AWS Bedrock (reads AWS credentials from env)
target = LiteLLMChatTarget(model_name="bedrock/anthropic.claude-v2")

# Self-hosted LiteLLM gateway / proxy
target = LiteLLMChatTarget(
    model_name="anthropic/claude-sonnet-4-6",
    endpoint="http://localhost:4000",
    api_key="sk-proxy-key",
)

Key features

• Multi-provider via LiteLLM — one target routes to any LiteLLM-supported provider through litellm.acompletion().
• Capabilities derived from the model — input/output modalities and JSON support are read from LiteLLM's own model metadata (supports_vision, supports_audio_input/supports_audio_output, supports_response_schema, get_supported_openai_params) at construction, so multimodal (image/audio) input and audio output are enabled only when the resolved model actually supports them. Falls back to a text-only default when metadata is unavailable.
• Auth flexibility — explicit api_key, a sync/async token provider callable (Entra-style), the LITELLM_API_KEY env var, or LiteLLM's own provider-specific env var lookup.
• Curated OpenAI params + passthrough — temperature, top_p, max_tokens, frequency_penalty, presence_penalty, seed, n, stop, plus arbitrary provider params via extra_body_parameters.
• Single max_tokens knob — LiteLLM normalizes max_tokens to whatever each model/provider expects (e.g. max_completion_tokens for OpenAI reasoning/gpt-5 models), so callers set one value and it works cross-provider. Provider-specific token params remain reachable via extra_body_parameters.
• drop_unsupported_params init arg (default True) — first-class control over LiteLLM's drop_params, letting a single target send the full OpenAI parameter set across providers with differing support; set False for strict validation. Overridable per request via extra_body_parameters.
• Token usage capture — provider usage payloads are parsed into a new provider-neutral TokenUsage value object and persisted to message metadata.
• Retry + exception translation — honors PyRIT's retry configuration via LiteLLM's num_retries; litellm.exceptions.* are mapped to PyRIT's RateLimitException / PyritException hierarchy (rate-limit and transient errors become retryable, no bare Exception catches).
• Consistent identifier — behavioral params are recorded on the target identifier; the API key is intentionally excluded.

Shared Chat Completions helpers (refactor)

To avoid duplicating logic between the OpenAI and LiteLLM targets, the Chat Completions request-building and response-parsing code is extracted into shared modules, and OpenAIChatTarget is refactored to use them (net removal of ~250 lines there):

• pyrit/prompt_target/common/chat_completions_message_builder.py — builds Chat Completions request messages from PyRIT messages.
• pyrit/prompt_target/common/chat_completions_response_parser.py — parses Chat Completions responses (text/tool calls/audio, finish-reason validation, token usage).
• pyrit/models/token_usage.py — new provider-neutral TokenUsage value object (input/output vocabulary aligned with the Responses API/Anthropic/Gemini), with metadata (de)serialization. Provider→TokenUsage conversion lives in the parser/target that knows the wire format, not in the value object.

Dependency

• litellm>=1.83.0,<2.0.0 added as an optional dependency: a named litellm extra and included in the all group (pip install pyrit[litellm] or pip install pyrit[all]). It is intentionally not a core dependency because current LiteLLM releases ship Linux-only wheels plus a Rust-based sdist, which would break pip install pyrit on Windows/macOS. import litellm is lazy, so users without the package are unaffected.

Tests and Documentation

Unit tests (all passing):

• tests/unit/prompt_target/target/test_litellm_chat_target.py — 54 tests (construction/env fallback, auth resolution, capability derivation, param/body construction, drop_unsupported_params, max_tokens normalization + passthrough, audio, token usage, finish-reason and empty/malformed handling, exception translation, retries).
• tests/unit/prompt_target/target/test_chat_completions_helpers.py — 39 tests for the shared message builder / response parser.
• tests/unit/models/test_token_usage.py — 7 tests for the TokenUsage value object.
• tests/unit/prompt_target/target/test_openai_chat_target.py — updated for the shared-helper refactor.

Integration tests:

• tests/integration/targets/test_litellm_chat_target_integration.py — new, reusing existing Azure OpenAI deployments (routed through LiteLLM) so LiteLLM is exercised against real endpoints.
• tests/integration/targets/test_openai_chat_target_integration.py — updated (default integration model wired to an Azure GPT-5 deployment with Entra auth).

Pre-commit (ruff format/check, ty type check, async-suffix and Sphinx-role hooks) passes clean.