Bug Description
All four routes mounted under /api/poisoning (POST /validate, POST /detect, POST /train, GET /status) spawn a Python script at backend/llm_poisoning_defense.py via child_process.spawn. That file does not exist anywhere in the repository, so every call fails with ENOENT and each endpoint returns a 500 error. The LLM poisoning defense feature (originally implemented for #910, which is closed) is currently non-functional.
Affected file: backend/routes/poisoningRoutes.js (script path defined L9, used in every handler: L32, L67, L100, L126)
Confirmed mounted/reachable at: backend/server.js L33, L289 (app.use('/api/poisoning', poisoningRoutes))
Missing file: backend/llm_poisoning_defense.py
For comparison, the sibling routers point at scripts that do exist and work:
// backend/routes/adversarialRoutes.js
const DEFENSE_SCRIPT = path.join(__dirname, '../multi_level_defense.py'); // exists ✅
// backend/routes/evoMailRoutes.js
const EVOMAIL_SCRIPT = path.join(__dirname, '../evo_mail.py'); // exists ✅
llm_poisoning_defense.py has no such file in backend/.
Steps to Reproduce
- Start the Node/Express backend:
- Confirm the script is missing:
ls backend/llm_poisoning_defense.py
# ls: cannot access 'backend/llm_poisoning_defense.py': No such file or directory
- Call any poisoning endpoint with a valid auth token (
system_config permission required for /validate and /train):
curl -X POST http://localhost:5000/api/poisoning/detect \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"text": "some text"}'
- Observe the failure response.
Expected Behavior
The endpoint should run the poisoning detector and return a JSON analysis (isSuspicious, score, patterns, etc.) combining the Python-side and Node-side (req.poisoningAnalysis) results, as documented in the route comments.
Actual Behavior
The request fails with a 500 response, e.g.:
{ "success": false, "error": "spawn python ENOENT" }This happens identically for /api/poisoning/validate, /api/poisoning/train, and /api/poisoning/status — every route that calls runPoisoningDefense().
Screenshots
No response
Additional Information
No response
Bug Description
All four routes mounted under
/api/poisoning(POST /validate,POST /detect,POST /train,GET /status) spawn a Python script atbackend/llm_poisoning_defense.pyviachild_process.spawn. That file does not exist anywhere in the repository, so every call fails withENOENTand each endpoint returns a500error. The LLM poisoning defense feature (originally implemented for #910, which is closed) is currently non-functional.Affected file:
backend/routes/poisoningRoutes.js(script path defined L9, used in every handler: L32, L67, L100, L126)Confirmed mounted/reachable at:
backend/server.jsL33, L289 (app.use('/api/poisoning', poisoningRoutes))Missing file:
backend/llm_poisoning_defense.pyFor comparison, the sibling routers point at scripts that do exist and work:
llm_poisoning_defense.pyhas no such file inbackend/.Steps to Reproduce
cd backend npm startls backend/llm_poisoning_defense.py # ls: cannot access 'backend/llm_poisoning_defense.py': No such file or directorysystem_configpermission required for/validateand/train):curl -X POST http://localhost:5000/api/poisoning/detect \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{"text": "some text"}'Expected Behavior
The endpoint should run the poisoning detector and return a JSON analysis (
isSuspicious,score,patterns, etc.) combining the Python-side and Node-side (req.poisoningAnalysis) results, as documented in the route comments.Actual Behavior
The request fails with a
500response, e.g.:{ "success": false, "error": "spawn python ENOENT" }This happens identically for
/api/poisoning/validate,/api/poisoning/train, and/api/poisoning/status— every route that callsrunPoisoningDefense().Screenshots
No response
Additional Information
No response