license: mit
task_categories:

• text-classification
• text-generation
  language:
• en
  tags:
• llm-safety
• red-teaming
• adversarial
• owasp
• jailbreak
• prompt-injection
• ai-safety
  size_categories:
• n<1K

LLM Red-Team Prompts — OWASP LLM Top 10

A curated dataset of 150 adversarial red-team prompts for evaluating the
safety and robustness of large language models, mapped to the
OWASP LLM Top 10.
Every prompt is a real payload extracted directly from the open-source
llm-safety-auditor
project — none are fabricated.

The dataset combines two sources from that project:

• 50 hand-curated attack templates (attack_library) — 10 per attack category.
• 100 mutation-engine variants (mutation_engine) — 10 seed attacks × 10
  deterministic obfuscation mutations (prefix injection, role-play framing,
  base64 encoding, Unicode homoglyphs, nested instructions), generated with a
  fixed seed for full reproducibility.

Intended Use

This dataset is built for defensive LLM safety research:

• Benchmarking model refusal behavior against adversarial inputs.
• Red-team / blue-team evaluation of guardrails and content filters.
• Regression testing safety alignment across model versions.
• Mapping observed failures to OWASP LLM Top 10 risk categories.

It is not intended to elicit harmful content from production systems. The
payloads target a model's defensive response (it should refuse, sanitize, or
decline). Each record ships an expected_behavior field describing the safe
outcome.

Schema

Category Breakdown

By OWASP risk: LLM01 (60), LLM06 (30), LLM09 (60).
By severity: CRITICAL (38), HIGH (92), MEDIUM (20).
By source: curated (50), mutation-engine (100).

Loading

from datasets import load_dataset

ds = load_dataset("9mark9/llm-redteam-owasp-prompts", split="train")
print(len(ds))                       # 150
print(ds[0])                         # first payload record

# Target one attack category for evaluation
jailbreaks = ds.filter(lambda r: r["category"] == "JAILBREAK")

See load_example.py for a fuller example.

Limitations

• Small. 150 prompts. It is a regression and smoke-test set, not a comprehensive benchmark.
• Less diverse than the count suggests. The 100 generated variants come from only 10 seed attacks, so
  they test obfuscation of those 10 attacks, not 100 independent ideas.
• English only.
• Labels are the author's. Categories, OWASP mappings, severities and expected_behavior were assigned
  by the project author and have not been checked by independent annotators.
• Prompts only. The dataset has no model responses and no judgement of whether a response was safe.
  Scoring a model needs your own judge; the source project ships a rule-based detector that is not a validated classifier.

Ethical Use & Responsible Disclosure

These payloads are for defensive evaluation only.

By using this dataset you agree to apply it solely to assess, harden, and
improve the safety of LLM systems you are authorized to test. Do not use
it to attack third-party systems, to extract genuinely harmful instructions
from models, or to circumvent safety controls in production deployments. Many
prompts deliberately reference dangerous topics as bait to test whether a
model refuses — the dataset contains no actual harmful instructions, only the
adversarial prompts that should be refused. If you discover a safety regression
in a deployed model, follow the vendor's responsible-disclosure process
before publishing details.

Source & Links

• Source project (GitHub): https://github.com/shaikn6/llm-safety-auditor
• Live demo (HF Space): 9mark9/llm-safety-auditor
• License: MIT (inherited from the source project).
• Contact: [email protected]

Citation

@misc{llm_redteam_owasp_prompts,
  title  = {LLM Red-Team Prompts — OWASP LLM Top 10},
  author = {llm-safety-auditor contributors},
  year   = {2026},
  howpublished = {\url{https://huggingface.co/datasets/9mark9/llm-redteam-owasp-prompts}}
}