A PyRIT run bills an adversarial model, the prompt target and a scorer. If you must cut spend, which of those three can you move to a cheaper or locally-hosted model, and what does each substitution cost you?

This is a question about which errors are recoverable, and the three legs sit in a strict order. ### The objective target is not a cost knob PyRIT's `objective_target` is the system under test: a specific deployed configuration — the model version, the system prompt, the tool bindings, the retrieval sources, the input and output guardrails in front of it. The run's claim is about that configuration and nothing else. Swapping in a cheaper sibling model, or the raw model without its guardrail stack, is not a saving; it is a change of subject. The number produced answers a question about a system nobody ships and cannot be carried into a ship decision. When budget genuinely forces the issue, the honest move is **fewer objectives against the real target**, never all objectives against a proxy, because a reduced objective set is a stated coverage gap while a substituted target is a silently invalid result. ### The adversarial chat is the safest cut, with a known direction of error PyRIT's adversarial chat composes each next prompt from the objective and the transcript. A weaker generator plateaus earlier: it repeats phrasings, fails to adapt to a refusal, and burns its turn budget without escalating. The consequence is a **false-negative-biased** run — it under-finds, and it does not mislabel what it does find. That bias is legible, which is what makes the substitution defensible in the right context. It is fine for a regression sweep, where the objectives were already proved reachable by a previous engagement and the question is "is this still broken". It is not fine for discovery over a new surface, because a clean run is then ambiguous between "the target held" and "the attacker was weak" — and every stakeholder will read it as the first. ### The objective scorer is the most dangerous cut PyRIT's `objective_scorer` is what converts transcripts into the run's headline number: it decides whether each response counted as a hit, and therefore fixes the per-objective success rate, the ranking of which surfaces are worst, and the contents of the triage queue. Scoring error propagates into all of it, and unlike the adversarial leg it errs in **both** directions: false hits inflate the report and consume triage hours on nothing, missed hits erase real findings and are never noticed. Worse, a cheaper judge degrades hardest exactly where judgement is hard — partial compliance, hedged or in-character refusals, responses that supply the shape of an answer without the substance — which is precisely where the interesting findings live. On obvious hits and obvious refusals every judge agrees, which is why a naive agreement check looks reassuring and proves nothing. ### What it costs, and what it costs you The saving is real: on a long objective the adversarial leg's input grows with the transcript, so it is often the largest single line on the bill, and moving it down a model tier can halve an engagement's spend. The scorer is cheap per call but numerous — one call per response per scorer, on a response count already multiplied by converter fan-out — so downgrading it saves meaningfully too. What it costs you is comparability. A number produced by a downgraded pipeline is not comparable to last quarter's, and a trend line drawn across a silent substitution is worse than no trend line. ### The prerequisite before downgrading the judge A held-out set of labelled transcripts from a prior run. Score them with both the incumbent and the candidate judge and compare agreement **on the disputed middle** — the partial and hedged cases — reporting that separately from overall agreement, which the easy cases will dominate. Without that evidence you have not saved money; you have made the output unfalsifiable, which is the one outcome a red-team run must never produce. ### The cheaper structural option, and what to record Before downgrading any leg, reduce **work**: fewer converter variants, one scorer instead of two, a shorter turn budget, fewer objectives per pass. These cut spend without changing the fidelity of any leg. They change coverage instead — and a coverage reduction is a sentence you can write honestly in a report, whereas a quietly weakened judge is a defect in the number itself. Whatever you choose, record per-leg model class alongside the results: which model generated, which answered, which judged, and at what version. That line is what lets the next reader tell a resilient system from an under-funded run, and it is the line most often missing.