pretty_name: RAD Database
language:

• en
  license: mit
  task_categories:
• text-classification
  tags:
• safety
• jailbreak
• retrieval

RAD Database and Paper-Core Evaluation Data

Companion data for Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak
Prevention for Large Language Models (ACL 2026).

Content warning: this dataset contains adversarial prompts and harmful requests for
defensive safety research. Access should remain gated, and users should agree to use the
material only for legitimate research, evaluation, and development of safety systems.

Intended use

The current snapshot supports local reconstruction of the RAD retrieval database used by the
paper-core Qwen experiments. The evaluation CSVs and reproduction manifest required to rerun
the complete Table 1, Figure 2, and Table 2 workflows are still being prepared and are not yet
part of this snapshot.

The final release is intended to support:

• Qwen-2.5-14B-Instruct RAD-Base and RAD-Sim rows from Table 1;
• the Qwen RAD operating curves from Figure 2; and
• the incremental database experiment from Table 2.

Attack generation code, unrestricted deployment of attack prompts, and offensive use are not
intended uses.

Current repository layout

database/
  full.csv

database/full.csv contains 10,991 records and the required query, jailbreak, analysis,
and guidance fields. It has 94 exact duplicate records and no row-level provenance columns.
The SHA-256 digest of the released CSV bytes is
b748aef8746f4b8e777df9090026845aea5be8d1599f74c2e8b34704c8ebea70. The canonical
field-level digest computed by the public RAD loader is
559aea650bded65c1df7050cb17ab89d13901710c5327bd8d3282559f24952a0.

FAISS indexes are deliberately excluded. The code rebuilds them with the pinned
facebook/contriever-msmarco revision and records a database digest in the index metadata.

Construction and quality controls

The database uses a pool of 892 seed queries: 495 filtered AdvBench behaviors, 356 filtered DAN
forbidden questions, and 41 standard HarmBench validation behaviors. Its final 10,991 records
consist of 8,996 base/template/DAN/PAP-derived records and 1,995 PAIR-derived records. The
analysis and guidance fields are model-assisted RAD annotations.

The planned evaluation snapshot uses StrongREJECT harmful queries, paper-generated attack
prompts, and 313 synthetic benign counterparts. As described in the paper, the benign set was
reviewed by the authors for offensive content and identifying personal information, and the
evaluation queries do not overlap with database seed queries.

The current database CSV has been checked for UTF-8 decoding, required columns, nonempty required
fields, row count, duplicate count, and byte identity with the research artifact. Before tagging
the final reproducibility snapshot, the evaluation schemas, identifiers, row counts, and attack
families must also be validated.

Limitations and risks

The data covers English, text-only jailbreaks and inherits StrongREJECT's operational definition
of harmfulness. It is not a universal safety taxonomy. Its attack examples can be misused, and
gating reduces but does not eliminate this risk. Results also depend on model weights, hosted
judges, and inference kernels; raw outputs should be retained for audit.

Licensing and attribution

The public code is MIT-licensed, but that license does not automatically apply to this dataset.
The Hub metadata is therefore license: unknown while the source-by-source redistribution review
is completed. AdvBench, the DAN dataset repository, and HarmBench identify MIT licenses, but the
exact upstream revisions, required notices, generated-output terms, and scope of those licenses
still need final author review. No blanket permission beyond applicable upstream terms is granted
by this card. See the public code repository's docs/DATA_PROVENANCE.md for the audit record.

Citation

@inproceedings{yang-etal-2026-retrieval,
    title = "Retrieval-Augmented Defense: Adaptive and Controllable Jailbreak Prevention for Large Language Models",
    author = "Yang, Guangyu  and
      Chen, Jinghong  and
      Mei, Jingbiao  and
      Lin, Weizhe  and
      Byrne, Bill",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Proceedings of the 64th Annual Meeting of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://aclanthology.org/2026.acl-long.1895/",
    doi = "10.18653/v1/2026.acl-long.1895",
    pages = "40849--40868",
    ISBN = "979-8-89176-390-6",
    abstract = "Large Language Models (LLMs) remain vulnerable to jailbreak attacks, which attempt to elicit harmful responses from LLMs. The evolving nature and diversity of these attacks pose many challenges for defense systems, including (1) adaptation to counter emerging attack strategies without costly retraining, and (2) control of the trade-off between safety and utility. To address these challenges, we propose Retrieval-Augmented Defense (RAD), a novel framework for jailbreak detection that incorporates a database of known attack examples into Retrieval-Augmented Generation, which is used to infer the underlying, malicious user query and jailbreak strategy used to attack the system. RAD enables training-free updates for newly discovered jailbreak strategies and provides a mechanism to balance safety and utility. Experiments on StrongREJECT show that RAD substantially reduces the effectiveness of strong jailbreak attacks such as PAP and PAIR while maintaining low rejection rates for benign queries. We propose a novel evaluation scheme and show that RAD achieves a robust safety-utility trade-off across a range of operating points in a controllable manner."
}