RUBYGLASK/llm-redteam-corpus-taxonomy-full

LLM Red-Team Corpus + Taxonomy — Full (everything, non-commercial)

Every source in one download. We collected 12 public LLM red-team / safety datasets, unified them into one schema, removed duplicates, masked personal data, and kept where each prompt came from. 64,458 prompts. Load in one line.

This is the complete corpus — all 12 sources merged and de-duplicated across tiers. Because it includes non-commercial sources (BeaverTails, ALERT, ToxicChat) and ALERT is ShareAlike, the whole set is CC-BY-NC-SA-4.0 (non-commercial).

Need commercial use? Use the `-core` version (44,681 prompts, CC-BY-4.0) — the permissively-licensed subset.

Which version should I download?

Quick start

from datasets import load_dataset

ds = load_dataset("rubyglask/llm-redteam-corpus-taxonomy-full")
print(ds["train"][0]["prompt"])

# filter by source or license
commercial_ok = ds["train"].filter(lambda r: r["license_tier"] == "core")
one_source    = ds["train"].filter(lambda r: r["source_id"] == "harmbench")

Ask an LLM / agent to use it

"Load the Hugging Face dataset `rubyglask/llm-redteam-corpus-taxonomy-full` and test my chatbot against every prompt where `source_id == 'harmbench'`. The prompt text is in the `prompt` column."

Sources — 12 public datasets, one format

Every row, regardless of source, uses the same 11-field schema (see below). Licenses were verified live against each upstream on 2026-07-03.

Per-source attribution: `sources.json`. Note: 83% of rows are anthropic_hh (first human turn of each red-team transcript); some are ordinary conversation openers, not all direct attacks.

Fields (same schema across all versions)

Formats: Parquet (default) · JSONL.gz · DuckDB.

Ethics, dual-use & privacy

Defensive-research dataset of already-public adversarial prompts. Do not attack systems without permission; follow responsible disclosure. Phone numbers and street addresses are masked ([PHONE] / [ADDRESS]); open an issue to report remaining personal data. Excluded on purpose: WMDP (dual-use), StrongREJECT (no-license questions), Persuasion (not attack prompts).

License

CC-BY-NC-SA-4.0 — non-commercial, ShareAlike (because ALERT is NC-SA and it propagates to the combined set). Each source also keeps its own license (sources.json). For commercial use, take the -core subset (CC-BY-4.0).

Code & citation

github.com/rubyglask/llm-redteam-corpus-taxonomy · see CITATION.cff.

<!-- ===== For programmatic / agent access =================================== DATASET: rubyglask/llm-redteam-corpus-taxonomy-full PURPOSE: complete LLM red-team / jailbreak / safety corpus, 12 sources unified ROWS: 64458 | LICENSE: CC-BY-NC-SA-4.0 (non-commercial) | LANG: en COMMERCIALSUBSET: rubyglask/llm-redteam-corpus-taxonomy-core (CC-BY-4.0, 44681) LOAD: loaddataset("rubyglask/llm-redteam-corpus-taxonomy-full") KEYFIELDS: prompt (str), sourceid (str), sourcelicense (str), licensetier (str) FILTERBY: sourceid, language, licensetier SOURCES(12): anthropichh, alert, lmsystoxic, aart, harmfulqa, donotanswer, beavertails, advbench, harmbench, forbiddenquestionset, jailbreakbench, tdc23 NOTE: 83% is anthropichh (HH-RLHF first human turn). PII masked. USEFOR: guardrail testing, safety benchmarking, red-team research (defensive, non-commercial) NOTFOR: commercial use (use -core), unauthorized attacks ========================================================================= -->