datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
attackontitan
Bangumi Image Base of Attack On Titan
This is the image base of bangumi Attack On Titan, we detected 76 characters, 14308 images in total. The full dataset is here.
Please note that these image bases are not guaranteed to be 100% cleaned, they may be noisy actual. If you intend to manually train models using this dataset, we recommend performing necessary preprocessing on the downloaded dataset to eliminate potential noisy samples (approximately 1% probability).
Here is the… See the full description on the dataset page: https://huggingface.co/datasets/BangumiBase/attackontitan.M-Attack_AdvSamples
M-Attack Adversarial Samples Dataset
This dataset contains 100 adversarial samples generated using M-Attack to perturb the images from the NIPS 2017 Adversarial Attacks and Defenses Competition. This dataset is used in the paper A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1.
Dataset Description
The dataset consists of total 300 adversarial samples organized in three… See the full description on the dataset page: https://huggingface.co/datasets/MBZUAI-LLM/M-Attack_AdvSamples.AttackViz
AttackViz
AttackViz is a chart-image dataset for studying correct and misleading data visualizations. It was introduced in the paper ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation.
Each example contains a rendered chart image, metadata about the chart and question type, the expected gold answer, a binary label indicating whether the chart is correct or misleading, a misleading-visualization category, and serialized chart annotations.… See the full description on the dataset page: https://huggingface.co/datasets/INSAIT-Institute/AttackViz.video-framesxai-attack-detection-cifar10
XAI Attack Detection — CIFAR-10 PGD
This private research dataset contains balanced, paired clean and adversarial images for
studying whether an attack can be detected from a classifier explanation map.
Dataset construction
The source is the CIFAR-10 test split. A fine-tuned OpenCLIP ViT-B/16 classifies each
clean image. Clean-correct examples are attacked with untargeted L-infinity PGD using
epsilon 8/255, step size 2/255, 10 steps, and deterministic random… See the full description on the dataset page: https://huggingface.co/datasets/nimaeb/xai-attack-detection-cifar10.Display_replay_attacks
Face Anti Spoofing Replay Dataset
iBeta Level 1 Dataset
Liveness Detection: Replay attacks. 5,000+ videos of display replay monitor attacks 12+ sec and real photos. The attacks provide diversity of lighting, devices, and screens
Full version of dataset is availible for commercial usage - leave a request on our website Axon Labs to purchase the dataset 💰
Left: Real selfie; Right: Display attack
Left: Real selfie; Right: Display attack
Dataset… See the full description on the dataset page: https://huggingface.co/datasets/AxonData/Display_replay_attacks.M-Attack-V2-Adversarial-Samples
M-Attack-V2 Adversarial Samples
Adversarial image samples generated by M-Attack-V2, from the paper:
Pushing the Frontier of Black-Box LVLM Attacks via Fine-Grained Detail Targeting
arXiv:2602.17645 | Project Page | Code
Dataset Structure
├── epsilon_8/ # 100 adversarial images (ε = 8/255)
│ ├── 0.png
│ ├── 1.png
│ ├── ...
│ └── metadata.csv
└── epsilon_16/ # 100 adversarial images (ε = 16/255)
├── 0.png
├── 1.png
├── ...
└──… See the full description on the dataset page: https://huggingface.co/datasets/MBZUAI-LLM/M-Attack-V2-Adversarial-Samples.demon_attack_mixed_0246_ghost30_200epCLIP-adversarial-typographic-attack_text-image
CLIP-adversarial-typographic-attack_text-image
A typographic attack dataset for CLIP. For adversarial training & model research / XAI (research) use.
First 47 are random and self-made images, rest are from dataset: SPRIGHT-T2I/spright_coco. Of which:
Images are selected for pre-trained OpenAI/CLIP ViT-L/14 features; for highly salient 'text related' concepts via Sparse Autoencoder (SAE).
Labels via CLIP ViT-L/14 gradient ascent -> optimize text embeddings for cosine… See the full description on the dataset page: https://huggingface.co/datasets/zer0int/CLIP-adversarial-typographic-attack_text-image.Military-Drone-Swarm-Saturation-Attack-Dataset
🦟 Simuletic Drone Swarm & Saturation Attack Dataset
Synthetic Benchmark for High-Density Counter-UAS
Overview
This is an open-source synthetic dataset designed to solve the hardest problem in Counter-UAS (C-UAS): Saturation Attacks.
Most drone datasets feature single, large drones against clear skies. This dataset provides high-density drone swarms (5–15 units per frame) in complex, photorealistic environments. It is specifically engineered to benchmark Small… See the full description on the dataset page: https://huggingface.co/datasets/Simuletic/Military-Drone-Swarm-Saturation-Attack-Dataset.AttackViz_extensionphysical_attack_vla
Physical Visual-Prompt-Injection Attacks on Driving VLAs
16 safety-critical examples where a physically attacker-placeable artifact (a banner,
sign, held board, vehicle decal, or road paint — no real-infrastructure tampering) hijacks the driving
VLA AutoDrive-R2-7B on Waymo Open Dataset E2E (val) into a dangerous, wrong action.
Curation rule. Each cue is anomalous / fabricated (clearly not a real device or obstacle, so it is
distinguishable from a normal scene) yet drives a… See the full description on the dataset page: https://huggingface.co/datasets/gray311/physical_attack_vla.Muli-Generationtion-attacksdemon_attack_mixed_0246_raw_200epdemon_attack_fixed_latency_6_200ep_7k2steps_ghost15demon_attack_200ep_context5ABRobOcular_Attacks
ABRobOcular: Ocular Adversarial Dataset
This repository contains the official public dataset for the paper: Adversarial benchmarking and robustness analysis of datasets and tools for ocular-based user recognition funded by the NSF award no. 2345561.
Paper: Neurocomputing 2025 ABRobOcular
Code: Bharath-K3/ABRobOcular
Figure: A taxonomy of adversarial attacks and defenses in ocular biometrics categorizing attacks into white-box (e.g., BIM, CW, FGSM, MIM, PGD) and black-box (e.g.… See the full description on the dataset page: https://huggingface.co/datasets/BharathK333/ABRobOcular_Attacks.demon_attack_ghost60_200epdemon_attack_parquet2mllm_attack_datademon_attack_fixed_l2_fs2demon_attack_fixed_l2_fs1demon_attack_ghost15_200epdemon_attack_200epadaptive-segmentation-mask-attackdemon_attack_ghost30_200epi2v-attackxai-attack-detection-imagenette
XAI Attack Detection: Imagenette targeted BIM/PGD on ViT-B/16
Private research dataset of paired clean and targeted adversarial Imagenette images. It is
built to study how adversarial attacks change a Vision Transformer's explanation maps and to
support later work on attack detection. Each row is one source image with its clean and its
attacked version.
Summary
Pairs
12,420 (train 8,690 · validation 1,860 · test 1,870)
Source images
Imagenette v2… See the full description on the dataset page: https://huggingface.co/datasets/nimaeb/xai-attack-detection-imagenette.wan_attack_resultsage-adversarial-attack
Age Adversarial Attack Dataset
Paper: Can a Teenager Fool an AI? Evaluating Low-Cost Cosmetic Attacks on Age Estimation SystemsAuthors: Simiao Ren (Reality Inc. / Duke University)
Overview
This dataset contains 5,809 AI-generated adversarial images derived from a curated set of 329 face images (ages 10–21) drawn from six standard age estimation benchmarks. Each image is a VLM-simulated cosmetic attack designed to make age estimation models misclassify a subject… See the full description on the dataset page: https://huggingface.co/datasets/Scam-AI/age-adversarial-attack.