Recreating "private" class variables in Python

Change the rules. Don't store the correct answer in the program. Store the correct answer on a secured server:

def checkAnswer(studentAnswer):
    response = requests.get('http://teacher-server.example.edu/checkAnswer?%s'%studentAnswer)
    return response.text == 'Yes'

Look into overwriting the class's

__getattr__

method. This is what is called when the class attributes are referenced. You can control what the class does and does not return when statements like:

x = myClass.myAttribute

are used.

Nothing you do will ever guarantee that student's Python code can't access or modify any object created by your Python code running in the same interpreter. Things like overriding __getattr__ can be bypassed by using object.__getattribute__. Your students can "monkey patch" the tester code to do what they want without having to modifying the source code. Unlike Java, Python makes no pretense at being a secure language. You'll either need to inspect the code or move the testers code to an other process.

The multiprocessing module may help you do this. Something like:

import multiprocessing as mp
import multiprocessing.managers

class Problem(object):
    def __init__(self, correctAnswer):
        self.answer = None
        self.correctAnswer = correctAnswer

    def checkAnswer(self, answer):
        if self.answer == None:
            self.answer = answer
        return self.answer == self.correctAnswer

    def __getstate__(self):
        raise ValueError("don't pickle me");

class Problem_proxy(mp.managers.BaseProxy):
    def checkAnswer(self, answer):
        return self._callmethod("checkAnswer", (answer,))

class mymanager(mp.managers.BaseManager):
    pass

mymanager.register("Problem", Problem, Problem_proxy)

def other_process(problems):
    # uncommenting either of these should cause an exception
    # print problems[0].correctAnswer
    # print problems[0]._getvalue().correctAnswer

    import agent       # module provide by the student
    agent.answer_problems(problems)

def main():
    manager = mymanager()
    manager.start()

    meaningoflife = manager.Problem(42)
    problems = [meaningoflife]

    proc = mp.Process(target = other_process,
              args = ([meaningoflife],))
    proc.start()
    proc.join()


if __name__ == "__main__":
    main()

Even with this there's still a bunch of holes. The student's code could just read in your tester code module an inspect it for the answers, for example. To be really secure you'd have to set up some sort of client/server model with the tester code running on different user's account.

On the tester, you can define correctAnswer as a property, and raise an exception if anything other than your known code calls it.

This can be achieved via introspection, but isn't pretty:

import inspect

class Problem(object):
    @property
    def correctAnswer(self):
        frm = inspect.currentframe()
        caller = inspect.getouterframes(frm)[0]

        _,_,_,name,_,_ = caller

        if name != YOUR_TESTING_FUNCTION:
            raise BadStudentError()

        return self._correctAnswer

Note that this does mean that you need to define _correctAnswer, but that can only be in your version of the code (you can use .correctAnswer in their version; the beauty of using a @property is that this replacement is transparent to the callee).

Of course, while the above solution works in that it allows you to tell when students have tried to access the correct answer, it's a bit hacky.

However, I personally feel that it would be much more elegant to check the student's answers on a server. By doing this, you control the entire process, and can easily ensure that the agent's answer is not changed after submission.

If writing a simple http query is beyond the students, you could include a helper method (checkAnswer or similar) which performed this process for them.