Redeploy: sync repo updates (exclude RLM docs)

README.md

@@ -12,40 +12,43 @@ pinned: false
 
 # AI Incident Explorer
 
-> An autonomous agentic tool that continuously mines the [AI Incident Database (AIID)](https://incidentdatabase.ai) to surface, classify, and triage real-world AI failures and attacks — mapping each one to **MITRE ATLAS** adversarial-ML techniques via an **LLM-as-a-Judge** classifier, with **full agent observability**.
-
-### 🔗 Live demo → **[AI Incident Explorer on Hugging Face Spaces](https://huggingface.co/spaces/edangx100/aiid-explorer)**
-
-> ⏱️ **It's a slow agentic search, not an instant lookup** — a round can take **up to ~9 min** on
-> the free Basic-CPU Space ([why](#why-the-search-takes-minutes-not-seconds)). Leave the tab open.
+> An autonomous agentic tool that mines the [AI Incident Database (AIID)](https://incidentdatabase.ai) to surface, classify, and triage real-world AI failures and attacks — mapping each one to **MITRE ATLAS** adversarial-ML techniques via an **LLM-as-a-Judge** classifier, with **agent observability**.
 
 ---
 
 ## Why This Project Exists
 
-**Agents that run over a long horizon predictably hit two failure modes:** **context rot** (their context fills with stale tool output until they forget the goal and degrade) and **query narrowing** (they tunnel on a few lines of inquiry and go blind to the rest of the problem space). 
+**Agents operating over long horizons can degrade in two predictable ways**: Long‑horizon agents can experience **context rot**, and those engaged in long agentic search may additionally drift into **query narrowing** .
 
 **This project is a demonstration of how both can be addressed — context rot with a [Recursive Language Model (RLM)](https://arxiv.org/html/2512.24601v3) architecture, and query narrowing with [LDA](https://www.ibm.com/think/topics/topic-modeling)-based topic steering** — using **AI Incident Explorer** as the use case.
 
-> **What's an RLM?** A *Recursive Language Model* keeps the agent's working state in a sandboxed Python REPL instead of stuffing every tool result back into the prompt. The model writes and runs code to inspect, filter, and summarize its own data, so the context window stays small and clean no matter how many rounds it runs. See [RLM paper](https://arxiv.org/html/2512.24601v3)
+> **What's an RLM?** A *Recursive Language Model* runs an LLM in a loop where each round's output is fed back as input to the next round. The model writes and runs Python code to search, filter, and classify data; at the end of each round it prints a structured `historical_results` block that the loop re-injects into the next round's prompt — so the agent accumulates memory across rounds without stuffing every raw tool result into context. See [RLM paper](https://arxiv.org/html/2512.24601v3)
 
 > **What's LDA topic steering?** *Latent Dirichlet Allocation* is a [topic-modeling](https://www.ibm.com/think/topics/topic-modeling) technique that discovers the recurring themes hidden in a set of documents. Here it runs over the agent's *own past search queries* to reveal which themes it keeps circling — so the next round can be steered toward the topics it hasn't explored yet.
 
 | Problem | Symptom | How this project solves it |
 |---|---|---|
-| **Context rot** | Over many search rounds the agent's context fills with stale tool output and it forgets its goal, repeats work, and degrades. | The agent keeps its working notes in a separate scratchpad (a Python workspace) instead of letting them pile up in its memory. Each round it pulls back only a short summary of what it's found so far, so its attention stays focused. |
-| **Query narrowing** | Left alone, the agent re-issues near-identical searches and tunnels on one or two ATLAS techniques, leaving the rest of the threat surface blind. | The app spots when the agent keeps searching the same themes, then points it toward the threat types and industries it hasn't looked at yet — so it covers the wider landscape instead of circling a few corners. |
+| **Context rot** | Over many search rounds the agent's context fills with stale tool output and it forgets its goal, repeats work, and degrades. | RLM keeps the context lean by having the agent write Python code that searches, filters, and classifies inside a sandboxed REPL — so raw tool output never lands in the prompt. At the end of each round the agent prints only a compact `historical_results` summary, which the loop re-injects into the next round's prompt as the agent's memory. The REPL itself is stateless across rounds; state lives in that re-injected summary, not in the interpreter. |
+| **Query narrowing** | Left alone, the agent re-issues near-identical searches and tunnels on one or two recurring themes, leaving the rest of the threat surface blind. | The app spots when the agent keeps searching the same themes, then points it toward the threat types and industries it hasn't looked at yet — so it covers the wider landscape instead of circling a few corners. |
+
+  ![LDA topic steering widens coverage by nudging the agent toward unexplored themes](images/widen_coverage.png)
 
-As a use case, AI Incident Explorer answers questions like — *"What MITRE ATLAS techniques are being used against LLMs in finance/healthcare/consumer products right now?"* — by autonomously searching the public record of AI incidents over many rounds and returning a structured, technique-tagged, severity-rated result set.
+As a use case, AI Incident Explorer answers questions like — *“What MITRE ATLAS techniques are being used against LLMs in finance, healthcare, or consumer products right now?”* — by taking a user query as the starting point, searching [AI Incident Database (AIID)](https://incidentdatabase.ai), and returning a structured result set tagged by technique and severity.
 
-Under the hood it is an **RLM agent**: an outer agent writes and runs Python in a sandboxed REPL to search and triage — keeping state in the REPL rather than the prompt (the context-rot fix) — while an inner **LLM-as-a-Judge** agent classifies each incident against the MITRE ATLAS taxonomy. After seeding rounds, an **LDA** model clusters the agent's own past searches and steers it toward unexplored techniques (the query-narrowing fix).
+Under the hood of AI Incident Explorer: 
+- an outer agent writes and runs Python in a sandboxed REPL to search and triage — at the end of each round it prints a compact `historical_results` summary that the loop re-injects into the next round's prompt, keeping context lean rather than accumulating raw tool output (the context-rot fix)
+- while an inner **LLM-as-a-Judge** agent classifies each incident against the MITRE ATLAS taxonomy.  
+- After the initial seeding rounds, an **LDA** model within the search-loop orchestrator clusters the agent’s previous searches and steers it toward unexplored techniques to improve query narrowing.
 
 ---
 
 ## What AI Incident Explorer does
 
-- **Autonomous, multi-round search** — give it one natural-language query; it runs up to *N* search/triage rounds on its own. One search only scratches the surface: the incidents are scattered under many different wordings, so a single query misses most of them. Each round lets the agent learn from what it just found and follow up with sharper, broader searches — building a fuller picture than any one-shot lookup could.
-- **MITRE ATLAS classification** — every relevant incident is tagged with one or more adversarial-ML technique IDs (e.g. `AML.T0051` LLM Prompt Injection, `AML.T0043` deepfakes, `AML.T0047` model evasion).
+- **Autonomous, multi-round search** — give it one natural-language query; it runs up to *N* search/triage rounds on its own. One search scratches the surface: the incidents are scattered under many different wordings, so a single query misses most of them. Each round lets the agent learn from what it just found and avoid re-treading it; once topic steering kicks in (round 5 by default), the loop actively steers searches toward themes it hasn't explored yet — building a fuller picture than any one-shot lookup could.
+
+  > **Example.** You type *"prompt injection in healthcare"*. The agent doesn't search that whole phrase — the database looks for keywords inside incident text, so it splits your words into short searches like `prompt injection`, `healthcare`. The first few rounds stay close to your words and remember what they've already found. Then the agent notices it keeps searching the same two ideas, so it tries new ones it hasn't looked at yet — a different kind of attack (like `data leakage`) or a related area (like `medical imaging` or `pharmacy`). This way it covers far more ground than searching once.
+
+- **MITRE ATLAS classification** — every relevant incident is tagged with one or more ATLAS technique IDs (e.g. `AML.T0051` LLM Prompt Injection, `AML.T0054` LLM Jailbreak, `AML.T0015` Evade AI Model).
 - **LLM-as-a-Judge triage** — an inner agent decides *security attack vs. safety failure vs. reliability issue* and assigns a harm-severity rating.
 
 Everything it finds shows up in a sortable table. Click any incident's **title** to open its full write-up on the AI Incident Database, and use the type and severity filters to focus on just the cases you care about.
@@ -56,28 +59,26 @@ Everything it finds shows up in a sortable table. Click any incident's **title**
 
 ![System architecture](images/architecture.png)
 
-*Core context-rot mitigation — the outer agent orchestrates; the inner agent judges. State lives in the REPL, not the prompt.*
+*Core context-rot mitigation — the outer agent orchestrates; the inner agent judges. State carries across rounds via re-injected `historical_results`, not REPL persistence (the REPL resets each round).*
 
 ---
 
 ## Implementation Notes
 
-- **RLM / Code-Mode agent.** Instead of cramming hundreds of incidents into one context window, the outer agent writes Python that searches and triages in a persistent sandboxed REPL powered by [Pydantic AI Harness **CodeMode**](https://github.com/pydantic/pydantic-ai-harness/tree/main/pydantic_ai_harness/code_mode). The agent is prompted with Recursive Language Model strategies — *PEEK* (glance at a few examples before diving in), *GREP* (skim for the relevant ones instead of reading everything), *PARTITION+MAP* (break a big pile into smaller batches and work through them), and *SUMMARIZE* (boil long text down to the key point).
+- **RLM / Code-Mode agent.** Instead of cramming hundreds of incidents into one context window, the outer agent writes Python that searches and triages in a sandboxed REPL powered by [Pydantic AI Harness **CodeMode**](https://github.com/pydantic/pydantic-ai-harness/tree/main/pydantic_ai_harness/code_mode). The agent is prompted with Recursive Language Model strategies — *PEEK* (glance at a few examples before diving in), *GREP* (skim for the relevant ones instead of reading everything), *PARTITION+MAP* (break a big pile into smaller batches and work through them), and *SUMMARIZE* (boil long text down to the key point).
 
   ![Recursive Language Model strategies — PEEK, GREP, PARTITION+MAP, SUMMARIZE](images/RLM_strategy.png)
 
   *The RLM strategies the outer agent uses to inspect and shrink data inside the REPL — keeping only what matters in context. Diagram source: [Daily Dose of Data Science — Recursive Language Models](https://blog.dailydoseofds.com/p/recursive-language-models).*
 
-- **LLM-as-a-Judge classifier.** A second inner LLM agent acts as a reviewer that the app can call on for each incident. For every case it reads, it hands back the relevant ATLAS technique IDs and a triage category (how the incident should be sorted). This reviewer is set up separately from the main app, so you can drop in a cheaper or faster model for the job without changing anything else.
+- **LLM-as-a-Judge classifier.** A second inner LLM agent acts as a reviewer that the app can call on for each incident. For every case it reads, it hands back the relevant ATLAS technique IDs and a triage category (how the incident should be sorted). This reviewer is set up separately from the main app, so you can use a cheaper or faster model for the job.
 - **LDA topic steering.** Once a few rounds have run, the app looks back at the agent's own past search terms and groups them into recurring themes (using gensim's LDA topic modeling). Seeing which themes the agent keeps circling, it then nudges the next search toward the areas it hasn't explored yet — so coverage keeps widening instead of tunneling on the same few topics.
 
-  ![LDA topic steering widens coverage by nudging the agent toward unexplored themes](images/widen_coverage.png)
-
 ---
 
 ## What the User Sees
 
-With all of those pieces working together, here's what it looks like to the user in the Gradio interface — note the MITRE ATLAS classifications shown along the bottom of the table:
+With all of those pieces working together, here's what it looks like to the user in the Gradio interface — note the MITRE ATLAS classifications shown along the bottom of the table (within red-dotted box):
 
 ![ATLAS-tagged results with type + severity filters applied](images/atlas-filters.png)
 
@@ -105,12 +106,11 @@ With all of those pieces working together, here's what it looks like to the user
 
 **▶ [Open the live demo](https://huggingface.co/spaces/edangx100/aiid-explorer)**
 
-1. Type a short keyword in **Query** (one or two words works best).
-2. Click **Search** and **leave the tab open** — a round can take **up to ~9 minutes** on the free
+1. Type a short keyword in **Query**.
+2. Click **Search** and **leave the tab open** — a round can take **up to ~9 minutes** on the HuggingFace
    Basic-CPU Space. The status banner shows live progress and a time estimate.
 3. Use the **type** and **severity** filters to slice the results once they arrive.
 
-> If the backend is unavailable the app falls back to bundled demo data so the table is never blank.
 
 #### Why the search takes minutes, not seconds
 

explorer/prompts.py

@@ -5,7 +5,7 @@
 #
 # Two guidance sections in the prompt below were added to fix a real "0 results" failure
 # we observed (e.g. searching "healthcare" returned nothing). They are plain English aimed
-# at steering the model, not Python logic — a beginner can read them like instructions:
+# at steering the model, not Python logic:
 #   1. "Search query format" — aiid_search() matches the query as a REGEX against incident
 #      title/description, so a multi-word phrase like "healthcare AI incidents" matches
 #      almost nothing. The section tells the agent to search with SHORT keywords (and to
@@ -22,10 +22,26 @@ HISTORICAL_RESULTS_START: str = "HISTORICAL_RESULTS_START"
 HISTORICAL_RESULTS_END: str = "HISTORICAL_RESULTS_END"
 
 INNER_AGENT_SYSTEM_PROMPT: str = (
-    "You are a concise MITRE ATLAS adversarial-ML technique classifier. "
-    "When asked to classify an AI incident, identify the most relevant ATLAS "
-    "technique ID(s) in the format AML.TXXXX and explain briefly. "
-    "Answer in one to three sentences."
+    "You are a concise AI incident classifier. Given an AI incident, you perform two jobs:\n\n"
+    "1. **MITRE ATLAS technique** — identify the most relevant technique ID(s) in the form AML.TXXXX.\n"
+    "2. **Triage** — classify the incident type and assign a harm-severity rating.\n\n"
+    "Answer in one to three sentences. Be direct; skip preamble.\n\n"
+    "### Common MITRE ATLAS techniques (use the real ID — never a placeholder)\n"
+    "- `AML.T0051` LLM Prompt Injection\n"
+    "- `AML.T0054` LLM Jailbreak\n"
+    "- `AML.T0057` LLM Data Leakage\n"
+    "- `AML.T0043` Craft Adversarial Data\n"
+    "- `AML.T0040` AI Model Inference API Access\n"
+    "- `AML.T0024` Exfiltration via AI Inference API\n"
+    "- `AML.T0020` Poison Training Data\n"
+    "- `AML.T0031` Erode AI Model Integrity\n"
+    "- `AML.T0048` External Harms\n"
+    "- `AML.T0046` Spamming AI System with Chaff Data\n\n"
+    "### Incident type (use exactly one)\n"
+    "- `security_attack` — adversarial input, prompt injection, model theft, data poisoning, etc.\n"
+    "- `safety_failure` — unintended harmful output, alignment failure, value misalignment\n"
+    "- `reliability_issue` — system crash, availability failure, accuracy degradation\n\n"
+    "### Severity (use exactly one): `critical`, `high`, `medium`, `low`\n"
 )
 
 OUTER_AGENT_SYSTEM_PROMPT: str = f"""You are an autonomous AI security research agent that mines the AI Incident Database (AIID) for real-world AI failures and attacks.
@@ -86,26 +102,20 @@ AIID Search: <next search query>
 - **The `<technique_id>` MUST be a real MITRE ATLAS ID in the form `AML.TXXXX`** (e.g. `AML.T0051`), determined by classifying the incident with `llm_query`. **NEVER** write `TBD`, `none`, `N/A`, `unknown`, or the search keyword in place of the ID — a starred line whose technique is not a real `AML.TXXXX` is invalid. If you cannot map an incident to a real ATLAS technique, mark it `-- not relevant` rather than starring it with a placeholder.
 - To keep IDs valid even under your tight code-block budget, you may map an obvious incident directly to one of the common techniques listed below; use `llm_query` whenever you are unsure or for less-obvious cases.
 - The `⭐` prefix is the only signal the harness uses to detect forward progress. Every new incident you classify as relevant **must** have a star or it will not be counted.
+- `found_with` is implicitly the `AIID Search:` query on the line immediately preceding the result block — do not repeat it on the starred line itself.
 
 ### Common MITRE ATLAS techniques (use the real ID — never a placeholder)
 - `AML.T0051` LLM Prompt Injection
 - `AML.T0054` LLM Jailbreak
 - `AML.T0057` LLM Data Leakage
 - `AML.T0043` Craft Adversarial Data
-- `AML.T0040` ML Model Inference API Access
-- `AML.T0024` Exfiltration via ML Inference API
+- `AML.T0040` AI Model Inference API Access
+- `AML.T0024` Exfiltration via AI Inference API
 - `AML.T0020` Poison Training Data
-- `AML.T0031` Erode ML Model Integrity
+- `AML.T0031` Erode AI Model Integrity
 - `AML.T0048` External Harms
-- `AML.T0046` Spamming ML System with Chaff Data
-- `found_with` is implicitly the `AIID Search:` query on the line immediately preceding the result block — do not repeat it on the starred line itself.
-
-### Incident type values (use exactly)
-- `security_attack` — adversarial input, prompt injection, model theft, data poisoning, etc.
-- `safety_failure` — unintended harmful output, alignment failure, value misalignment
-- `reliability_issue` — system crash, availability failure, accuracy degradation
+- `AML.T0046` Spamming AI System with Chaff Data
 
-### Severity values (use exactly): `critical`, `high`, `medium`, `low`
 
 ## Emergent Strategies