datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
SPML_Chatbot_Prompt_Injection
SPML Chatbot Prompt Injection Dataset
Arxiv Paper
Introducing the SPML Chatbot Prompt Injection Dataset: a robust collection of system prompts designed to create realistic chatbot interactions, coupled with a diverse array of annotated user prompts that attempt to carry out prompt injection attacks. While other datasets in this domain have centered on less practical chatbot scenarios or have limited themselves to "jailbreaking" – just one aspect of prompt injection – our dataset… See the full description on the dataset page: https://huggingface.co/datasets/reshabhs/SPML_Chatbot_Prompt_Injection.llm-jailbreak-prompt-injection-dataset
LLM Jailbreak & Prompt-Injection Dataset
A unified safety dataset combining 30+ public sources for training LLM
guardrails, content moderation classifiers, and response-safety filters.
Schema (orthogonal multi-label, WildGuard-style)
Instead of a single binary is_dangerous, every example carries four
orthogonal labels matching the structure used by AI2 WildGuard, IBM Granite
Guardian, and Azure Prompt Shields:
Column
Type
Description
prompt
str
The user/attack… See the full description on the dataset page: https://huggingface.co/datasets/Necent/llm-jailbreak-prompt-injection-dataset.prompt-injection-Threat-Matrix
CATEGORIZED DATASET - easy to use
https://huggingface.co/datasets/neuralchemy/prompt-injection-dataset-categorized
Neuralchemy Prompt Injection Threat Matrix
A professional-grade prompt injection and
jailbreak detection dataset featuring 32,320
curated samples across 5 dimensions
with full threat intelligence schema including
technique classification, severity scoring,
attack surface detection, and ambiguity flagging.
Built for training production-grade LLM… See the full description on the dataset page: https://huggingface.co/datasets/neuralchemy/prompt-injection-Threat-Matrix.prompt-injection-dataset-categorized
Prompt Injection Dataset — Categorized (Threat Matrix V2)
Welcome to Prompt Injection Dataset – Categorized (formerly Threat Matrix), by Neuralchemy.
This is the successor to our original Prompt Injection Threat Matrix dataset. Instead of one multi-label table, this version splits the taxonomy into 7 clean, single-purpose subsets — 6 taxonomy dimensions plus a bonus ambiguity flag — so you can train a focused specialist model on each one instead of fighting multi-task learning.… See the full description on the dataset page: https://huggingface.co/datasets/neuralchemy/prompt-injection-dataset-categorized.agentic-prompt-injection-5k
Agentic Prompt-Injection 5K
5,000 examples of agentic and indirect prompt injection. A curated, paired benign/attack dataset for evaluating and training prompt-injection detectors and LLM guardrails. It focuses on the harder, agentic surface: tool/function abuse, RAG-document-embedded (indirect) injection, memory and trust-boundary poisoning, and approval/authority escalation.
Curated by Enes Deniz (ORCID 0009-0006-9491-3565), Co-Founder at AltaySec and OWASP AI Exchange / GenAI… See the full description on the dataset page: https://huggingface.co/datasets/3nesdeniz/agentic-prompt-injection-5k.prompt_injection_cleaned_dataset
Dataset Card for "prompt_injection_cleaned_dataset"
More Information needed
moltbook-agent-social-ai-prompt-injection-dataset
Moltbook Agent-Social AI Prompt Injection Dataset
207,391 items — 77,469 posts and 129,922 comments — from Moltbook, a social network whose users are AI agents.
Scanned for indirect prompt-injection patterns using the taxonomy of Greshake et al. (2023). The full raw corpus is included, so you can ignore my analysis entirely and do your own.
These are keyword-matched candidates, not verified attacks. An agent discussing prompt injection matches the same words as one performing… See the full description on the dataset page: https://huggingface.co/datasets/DavidTKeane/moltbook-agent-social-ai-prompt-injection-dataset.prompt-injection-attack-datasetturkish-prompt-injection-1k
Turkish Prompt-Injection 1K
1,000 Turkish-native examples. A curated, paired benign/attack dataset for evaluating and training prompt-injection detectors and LLM guardrails. One of the few Turkish-native prompt-injection resources: instruction override and system-prompt extraction, jailbreak personas, obfuscation and data exfiltration, and agentic tool abuse — with Turkish morphological variation.
Curated by Enes Deniz (ORCID 0009-0006-9491-3565), Co-Founder at AltaySec and… See the full description on the dataset page: https://huggingface.co/datasets/3nesdeniz/turkish-prompt-injection-1k.english-prompt-injection-3k
English Prompt-Injection 3K
3,000 examples of direct prompt injection across eight families. A curated, paired benign/attack dataset for evaluating and training prompt-injection detectors and LLM guardrails. Broad coverage of direct prompt injection: instruction override, system-prompt extraction, jailbreak personas, delimiter/format injection, obfuscation/encoding, data exfiltration, refusal suppression, and payload splitting.
Curated by Enes Deniz (ORCID 0009-0006-9491-3565)… See the full description on the dataset page: https://huggingface.co/datasets/3nesdeniz/english-prompt-injection-3k.geo-injection-rag-attack-data
Can It Reach the Generator? Investigating the Survival of GEO Prompt-Injection Attacks in Realistic RAG Settings
This dataset contains the prompt-injection attack data presented in the paper Can It Reach the Generator? Investigating the Survival of Prompt-Injection Attacks in Realistic RAG Settings.
The dataset is used to… See the full description on the dataset page: https://huggingface.co/datasets/Euanyu/geo-injection-rag-attack-data.INJEXIS-Duplicate-Prompt-Injection-Dataset
SPML Chatbot Prompt Injection Dataset
Arxiv Paper
Introducing the SPML Chatbot Prompt Injection Dataset: a robust collection of system prompts designed to create realistic chatbot interactions, coupled with a diverse array of annotated user prompts that attempt to carry out prompt injection attacks. While other datasets in this domain have centered on less practical chatbot scenarios or have limited themselves to "jailbreaking" – just one aspect of prompt injection – our dataset… See the full description on the dataset page: https://huggingface.co/datasets/Sahildhonde-9/INJEXIS-Duplicate-Prompt-Injection-Dataset.prompt_injection_combinedEvaluation_of_OpenSource_Models_for_PDF_Injection_Recognition
Injected PDFs - Model Evaluation
This repository holds the model evaluation stage of a project on detecting harmless-but-real
attack payloads injected into PDF files, together with the artefacts it produced for the
application.
Nothing is trained here. Seven off-the-shelf models are measured against the same 1,100 PDFs,
and the two winners are exported for the app to load.
Question
Candidates
Winner
Part A
Which files look like this one?
3 embedding models x 2 inputs… See the full description on the dataset page: https://huggingface.co/datasets/Cyber-security-final-project/Evaluation_of_OpenSource_Models_for_PDF_Injection_Recognition.Nemotron-RL-Agentic-Indirect-Prompt-Injection-v1-prompt-only
Nemotron-RL-Agentic-Indirect-Prompt-Injection-v1-prompt-only
Prompt-only extraction from nvidia/Nemotron-RL-Agentic-Indirect-Prompt-Injection-v1.
Files:
prompts.csv: one prompt extraction record per source row. Records include
prompt, separated system_prompt, and structured tools when the source row
defines available tools. Nested values are JSON-encoded inside CSV cells.
summary.md: source row counts, extracted row counts, count deltas, and failed prompt counts.… See the full description on the dataset page: https://huggingface.co/datasets/jamesdborin/Nemotron-RL-Agentic-Indirect-Prompt-Injection-v1-prompt-only.prompt_injectionsprompt-injectionRedLockX-Prompt-Injection-109K-DataSet
The RedLockX Dataset is a large-scale curated security dataset designed for
evaluating and training AI systems against adversarial threats such as prompt injection,
jailbreak attempts, system prompt leakage, and LLM manipulation attacks.
It contains structured real-world and synthetic attack patterns used in modern AI red-teaming.
📌 Dataset Overview
✔ 109,000+ labeled adversarial & safe samples
✔ Multi-category threat… See the full description on the dataset page: https://huggingface.co/datasets/blackXmask/RedLockX-Prompt-Injection-109K-DataSet.dataset-injection-scan-study
Dataset Injection Scan — open study of popular HF datasets
from datasets import load_dataset
ds = load_dataset("fevziegeyurtsevenler/dataset-injection-scan-study")
Results of scanning 17,000 rows across 6 popular public instruction/prompt datasets for
smuggled prompt-injection with hf-dataset-scan
(invisible Unicode, injection phrasing EN+TR, exfil URLs).
Headline: no smuggled injection found
Dataset
Rows
Flagged
High
Med
Low
tatsu-lab/alpaca
3,000
0… See the full description on the dataset page: https://huggingface.co/datasets/fevziegeyurtsevenler/dataset-injection-scan-study.INJEXIS-Prompt-Injection-Dataset
The RedLockX Dataset is a large-scale curated security dataset designed for
evaluating and training AI systems against adversarial threats such as prompt injection,
jailbreak attempts, system prompt leakage, and LLM manipulation attacks.
It contains structured real-world and synthetic attack patterns used in modern AI red-teaming.
📌 Dataset Overview
✔ 109,000+ labeled adversarial & safe samples
✔ Multi-category threat… See the full description on the dataset page: https://huggingface.co/datasets/Sahildhonde-9/INJEXIS-Prompt-Injection-Dataset.concept-injection-results
Concept Injection Results
Experimental data and analysis logs from the research "Replicating Introspection on Injected Content in Open-Source Language Models"
Overview
This project enables researchers to inject concept vectors directly into a model's hidden layers during inference, allowing investigation of whether language models can detect and report on artificially induced "thoughts."
This dataset contains the raw responses and processed evaluations produced… See the full description on the dataset page: https://huggingface.co/datasets/vazirani/concept-injection-results.ai-5node-inj-buf-lag-cpl-prompt-injection-v0.1
What this repo does
This dataset models prompt injection cascades in tool-using AI systems. It detects when injection pressure rises, safety buffers weaken due to incomplete filtering and trust-boundary enforcement, governance lag delays triage and revocation, and tight coupling through shared routers and scaffolds propagates injection success across products, crossing the five-node cascade threshold into an unrecoverable prompt injection cascade.
This dataset models a five-node… See the full description on the dataset page: https://huggingface.co/datasets/ClarusC64/ai-5node-inj-buf-lag-cpl-prompt-injection-v0.1.SPML_Chatbot_Prompt_Injection
SPML Chatbot Prompt Injection Dataset
Arxiv Paper
Introducing the SPML Chatbot Prompt Injection Dataset: a robust collection of system prompts designed to create realistic chatbot interactions, coupled with a diverse array of annotated user prompts that attempt to carry out prompt injection attacks. While other datasets in this domain have centered on less practical chatbot scenarios or have limited themselves to "jailbreaking" – just one aspect of prompt injection – our dataset… See the full description on the dataset page: https://huggingface.co/datasets/takashi-natsume/SPML_Chatbot_Prompt_Injection.image-prompt-injection
Image-Based Prompt Injection Dataset
Synthetic dataset for prompt injection attacks on Large Vision-Language Models (LVLMs).
Team
Name
GitHub
Ritik Sinha
@Ritik1207-ind
Siddhant Kumar
@siddhantkumar101
Udit Dadhich
@UditDadhich
GitHub Repository: prompt-injection-attacks-on-LVLMS
Dataset Details
4,859 labeled samples
4 attack types: typographic, structural, adversarial, metadata
4 injection goals: jailbreak, exfiltration… See the full description on the dataset page: https://huggingface.co/datasets/Reet1207/image-prompt-injection.pythia-6.9b-deduped-step80000_256_256_injection-pplrealistic-prompt-injections
Realistic prompt injections vs. ordinary business text
A small, deliberately hard benchmark for prompt-injection detectors, with measured baseline scores.
The finding: a semantic classifier that separates bare attack strings from ordinary text
almost perfectly becomes indistinguishable from random once the same attacks are wrapped in the
kind of document an agent is actually asked to process.
Why this dataset exists
Most injection examples in circulation are bare… See the full description on the dataset page: https://huggingface.co/datasets/treycsa/realistic-prompt-injections.pythia-410m-deduped-step80000_256_256_injection-pplprompt_injection_cleaned_dataset
Dataset Card for "prompt_injection_cleaned_dataset"
More Information needed
social-injectionprompt_injection_cleaned_dataset
Dataset Card for "prompt_injection_cleaned_dataset"
More Information needed