datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
adversarial_qa
Dataset Card for adversarialQA
Dataset Summary
We have created three new Reading Comprehension datasets constructed using an adversarial model-in-the-loop.
We use three different models; BiDAF (Seo et al., 2016), BERTLarge (Devlin et al., 2018), and RoBERTaLarge (Liu et al., 2019) in the annotation loop and construct three datasets; D(BiDAF), D(BERT), and D(RoBERTa), each with 10,000 training examples, 1,000 validation, and 1,000 test examples.
The adversarial human… See the full description on the dataset page: https://huggingface.co/datasets/UCLNLP/adversarial_qa.mnist-adversarial-datasetviyog-adversarial
Viyog — adversarial samples
Precomputed adversarial examples used in Viyog. Attacks: FGSM, BIM, PGD,
APGD-CE (full), plus DeepFool and CW (capped) — crafted against the finetuned
backbones in amanyagami/viyog-weights.
Format — HDF5 (<model>_<attack>.h5): images (uint8, NCHW 224x224) + labels (int32).
root: CIFAR-100 attacks · cifar10/: CIFAR-10 attacks
Load with h5py. Package: pip install viyog · code: https://github.com/amanyagami/viyog
squad_adversarialHere are two different adversaries, each of which uses a different procedure to pick the sentence it adds to the paragraph:
AddSent: Generates up to five candidate adversarial sentences that don't answer the question, but have a lot of words in common with the question. Picks the one that most confuses the model.
AddOneSent: Similar to AddSent, but just picks one of the candidate sentences at random. This adversary is does not query the model in any way.ImageNet-Adversarialstandard_chat_manage_tabs_adversarialAdversarial-PDF-Parsing-Taxonomy-8OpsSummary This dataset is a large-scale adversarial benchmark consisting of over 4,000 carefully crafted PDF samples designed to quantify the systemic security risks in Retrieval-Augmented Generation (RAG) ingestion pipelines. It focuses on parsing discrepancy—a critical vulnerability where machine parsers extract malicious instructions that are hidden from human visual perception.
Key Features
8 Distinct Attack Operators: The dataset systematically implements 8 categories of visual--parse… See the full description on the dataset page: https://huggingface.co/datasets/Dean2Wang/Adversarial-PDF-Parsing-Taxonomy-8Ops.Nemotron-RL-Instruction-Following-Adversarial-v1
Dataset Description:
The inverseIF dataset focuses on adversarial prompts designed to explicitly conflict with an AI model’s standard training instincts—such as writing code without comments or refusing standard helpfulness norms—across 8 distinct "anti-convention" patterns. Using a targeted "model breaking" methodology, it generates four candidate responses via Nemotron-Nano-V2 or Qwen3-235B-A22B-Thinking-2507 to test if the negative constraint is difficult enough to force a… See the full description on the dataset page: https://huggingface.co/datasets/nvidia/Nemotron-RL-Instruction-Following-Adversarial-v1.exp_rle_adversarial-qwen3.5-122b-131k-opencode-traces
Agent trace dataset
Decoding the literal token IDs
The prompt_token_ids / completion_token_ids / logprobs columns are the
verbatim tokens the serving engine emitted, stored PER AGENT STEP as a
list-of-lists (one inner list per turn). To turn them back into text you MUST
use the exact tokenizer the model was served with — a generic same-family
tokenizer will decode word tokens to garbage.
Served model / tokenizer source: Qwen/Qwen3.5-122B-A10B-FP8
from transformers… See the full description on the dataset page: https://huggingface.co/datasets/open-athena/exp_rle_adversarial-qwen3.5-122b-131k-opencode-traces.adversarial_nliM-Attack-V2-Adversarial-Samples
M-Attack-V2 Adversarial Samples
Adversarial image samples generated by M-Attack-V2, from the paper:
Pushing the Frontier of Black-Box LVLM Attacks via Fine-Grained Detail Targeting
arXiv:2602.17645 | Project Page | Code
Dataset Structure
├── epsilon_8/ # 100 adversarial images (ε = 8/255)
│ ├── 0.png
│ ├── 1.png
│ ├── ...
│ └── metadata.csv
└── epsilon_16/ # 100 adversarial images (ε = 16/255)
├── 0.png
├── 1.png
├── ...
└──… See the full description on the dataset page: https://huggingface.co/datasets/MBZUAI-LLM/M-Attack-V2-Adversarial-Samples.voice-verification-adversarial-datasetspan-extraction-adversarial-geometry
Span Extraction Adversarial Geometry
Reproducibility data for "Why Additive Span Extraction Heads Cannot Be Improved by Coupling: Exact Adversarial Radii, Sign Attacks, and Encoder-Level Certified Training."
Key Results
Method
EM
ε* median
Δε*
Additive baseline
59.8%
2.17
—
Elsayed (global margin)
65.6%
2.96
+36%
CBCT (RoBERTa)
66.0%
3.31
+52%
CBCT (BERT-large)
62.0%
4.71
+113%
CBCT (DistilBERT)
57.8%
2.96
+45%
Biaffine spectral
65.4%
0.93… See the full description on the dataset page: https://huggingface.co/datasets/arifmohamedkhan/span-extraction-adversarial-geometry.CLIP-adversarial-typographic-attack_text-image
CLIP-adversarial-typographic-attack_text-image
A typographic attack dataset for CLIP. For adversarial training & model research / XAI (research) use.
First 47 are random and self-made images, rest are from dataset: SPRIGHT-T2I/spright_coco. Of which:
Images are selected for pre-trained OpenAI/CLIP ViT-L/14 features; for highly salient 'text related' concepts via Sparse Autoencoder (SAE).
Labels via CLIP ViT-L/14 gradient ascent -> optimize text embeddings for cosine… See the full description on the dataset page: https://huggingface.co/datasets/zer0int/CLIP-adversarial-typographic-attack_text-image.Audio-Adversarial-Instructions
Audio-Adversarial-Instructions
We convert to audio boolean classifier speech instructions, randomly 50% chance for positive and other 50% chance for negative.
Data source
AudioSet from mesolitica/AudioSet-Audio-Instructions
Classification Speech Instruction from mesolitica/Classification-Speech-Instructions
EmoBox from mesolitica/Classification-Speech-Instructions
BirdCLEF_2021
how to prepare the dataset
huggingface-cli download \… See the full description on the dataset page: https://huggingface.co/datasets/mesolitica/Audio-Adversarial-Instructions.enterprise-adversarial-samplesadversarial-prompts
Language Model Testing Dataset 📊🤖
Introduction 🌐
This repository provides a dataset inspired by the paper "Explore, Establish, Exploit: Red Teaming Language Models from Scratch" It's designed for anyone interested in testing language models (LMs) for biases, toxicity, and misinformation.
Dataset Origin 📝
The dataset is based on examples from Tables 7 and 8 of the paper, which illustrate how prompts can elicit not just biased but also toxic or nonsensical… See the full description on the dataset page: https://huggingface.co/datasets/harpreetsahota/adversarial-prompts.a2-rl-adversarialcuratorkit-testrun-Adversarial-Preference
curatorkit-testrun-Adversarial-Preference
Built using CuratorKIT — provenance-grounded curation and synthesis for LLM post-training.
Method
adversarial_preference
Backend
litellm
Model
openai/Qwen/Qwen2.5-0.5B-Instruct
Formats
dpo
Artifact
dataset
Published
2026-08-28 10:47 UTC
Usage
from datasets import load_dataset
ds = load_dataset("ram-lexsi/curatorkit-testrun-Adversarial-Preference"… See the full description on the dataset page: https://huggingface.co/datasets/ram-lexsi/curatorkit-testrun-Adversarial-Preference.adversarial_hotpotqaThis dataset is from the paper: "Avoiding Reasoning Shortcuts: Adversarial Evaluation, Training, and Model Development for
Multi-Hop QA" by Yichen Jiang and Mohit Bansal.
The dataset was created using the code provided in the repo: https://github.com/jiangycTarheel-zz/Adversarial-MultiHopQA.adversarial-prompt-injection-dataset
Adversarial Prompt Injection Strings for LLM Guardrails
A dataset of deliberately crafted adversarial prompt injection strings designed to test and evaluate the robustness of Large Language Model (LLM) guardrails. It includes various attack categories, from role-play and obfuscation to data exfiltration and refusal overrides, providing diverse test cases for security and safety engineers.
27 rows · category: security · licence: CC0-1.0 (public domain)
Usage
from… See the full description on the dataset page: https://huggingface.co/datasets/SharkSkin/adversarial-prompt-injection-dataset.pope-coco-adversarialNemotron-RL-Instruction-Following-Adversarial-v1-prompt-only
Nemotron-RL-Instruction-Following-Adversarial-v1-prompt-only
Prompt-only extraction from nvidia/Nemotron-RL-Instruction-Following-Adversarial-v1.
Files:
prompts.csv: one prompt extraction record per source row. Records include
prompt, separated system_prompt, and structured tools when the source row
defines available tools. Nested values are JSON-encoded inside CSV cells.
summary.md: source row counts, extracted row counts, count deltas, and failed prompt counts.… See the full description on the dataset page: https://huggingface.co/datasets/jamesdborin/Nemotron-RL-Instruction-Following-Adversarial-v1-prompt-only.successful_adversarial_prompts
Citation
If you use this dataset, please cite the associated paper:
@article{chugh2026recap,
title = {RECAP: A Resource-Efficient Method for Adversarial Prompting in Large Language Models},
author = {Chugh, Rishit},
journal = {arXiv preprint arXiv:2601.15331},
year = {2026},
url = {https://arxiv.org/abs/2601.15331}
}
kuza_sft_adversarial
Kuza SFT Adversarial
Supervised fine-tuning data for Kuza, an offline agricultural assistant
for smallholder farmers and agricultural extension workers in East Africa
(English and Swahili). This repository is one of four Kuza SFT datasets.
Dataset description
This is a new hand-authored safety set. It is not derived from FarmerChat and is not one of the previously published Kuza agricultural Q&A corpora (kuzaai/agri_sft_prod_56k, kuzaai/agri_sft_prod_dedup_25k… See the full description on the dataset page: https://huggingface.co/datasets/kuzaai/kuza_sft_adversarial.early-unlearning-medium-adversarial-retain-mixadversarial-embed
Adversarial Embedding Stress Test
A benchmark for stress-testing the semantic understanding of text embedding models. It evaluates whether a model grasps the global meaning of a sentence or merely relies on surface-level word overlap.
Each benchmark dataset is a collection of adversarial triplets designed so that a model depending on lexical similarity will consistently pick the wrong answer. Two datasets are currently included: one based on commonsense reasoning (Winograd), one on… See the full description on the dataset page: https://huggingface.co/datasets/semvec/adversarial-embed.MMLU-Adversarial
Dataset Card for MMLU-Adversarial
Dataset Summary
MMLU-Adversarial is a diagnostic dataset designed to evaluate the ability of current LLM-based answer extraction techniques
to detect instances in which the model produces invalid answers due to hallucinated or flawed reasoning.
Each instance in the dataset includes a reasoning chain that undermines the validity of the final selected answer,
and as such, should be labeled as invalid (e.g., [No Valid Answer]). The flawed… See the full description on the dataset page: https://huggingface.co/datasets/sapienzanlp/MMLU-Adversarial.POD-DeepONet-Adversarial-Activationsadversarial-promptsAdding various adversrial permuations to questions in the aurora-redteam dataset.