BUG: AcrosticConverter silently drops digits and punctuation

[romanlutz]

Describe the bug

AcrosticConverter silently removes every character that is neither alphabetic nor a literal space. This changes prompt semantics without warning users that the conversion is lossy.

For example, hide this 123! produces an acrostic that decodes to HIDE THIS : all digits and punctuation are gone. In the frontend converter workflow, the preview shows the truncated result, but there is no warning or explanation and Use converted remains enabled.

The implementation filters the prompt before encoding:

lines = [self._line_for_char(ch) for ch in prompt if ch.isalpha() or ch == " "]

The existing test_acrostic_ignores_non_alpha_except_space unit test codifies the current behavior, so fixing this requires updating the converter contract and regression coverage rather than only changing the UI.

Duplicate check performed on 2026-08-12: searched all 51 open issues and 54 open pull requests by title/body for Acrostic, punctuation, non-alphabetic input, lossy conversion, dropped characters, and related terms. No duplicate was found. Issue #2023 and PR #2301 concern Bijection converters and are unrelated.

Steps/Code to Reproduce

import asyncio

from pyrit.converter import AcrosticConverter


async def main() -> None:
    original = "hide this 123!"
    converter = AcrosticConverter()
    result = await converter.convert_async(prompt=original, input_type="text")
    decoded = AcrosticConverter.decode(result.output_text)

    print(repr(decoded))  # 'HIDE THIS '
    assert decoded.lower() == original


asyncio.run(main())

Frontend reproduction:

1. Open Chat and enter hide this 123!.
2. Add AcrosticConverter and preview the conversion.
3. Read the first character of each generated line.
4. Observe that the result is HIDE THIS , with no digits or punctuation.
5. Observe that no warning explains the data loss and Use converted remains enabled.

Expected Results

Conversion must not silently alter the prompt. Either:

• preserve digits and punctuation so decoding round-trips the complete input, or
• explicitly identify unsupported characters and block or clearly warn before the lossy conversion can be applied.

Regression tests should cover mixed letters, whitespace, digits, punctuation, and representative Unicode characters. The frontend should surface any intentionally lossy behavior before users apply the converter.

Actual Results

AcrosticConverter encodes only alphabetic characters and spaces. For hide this 123!, decoding returns HIDE THIS .

Observed frontend state:

• digits present in preview: false
• punctuation present in preview: false
• warning count: 0
• explanation mentions loss: false
• Use converted enabled: true

No console errors, page errors, or network failures occurred; this is deterministic converter behavior rather than an infrastructure failure.

Screenshots

Screenshots were captured during the 2026-08-12 frontend exploratory audit. The deterministic code reproduction and exact decoded output above do not depend on those artifacts.

Versions

• OS: Windows 11 (10.0.26200)
• Browser: Playwright Chromium
• Python: 3.14.4
• PyRIT: 1.1.0.dev0
• Tested commit: e77d8a7c1286f738fa7405b5bcb4bfadf0afe5f0 (origin/main on 2026-08-12)

[Boulea7]

I'd like to take this. I'll preserve digits and punctuation through the existing acrostic format, handle the space-sentinel collision, and update focused round-trip coverage for mixed and Unicode text.