license: other
license_name: mixed-source-attribution
pretty_name: Jailbreak Corpus
language:

• en
• de
• es
• fr
• it
• pt
• nl
  task_categories:
• text-classification
  tags:
• ai-safety
• red-teaming
• jailbreak
• llm-robustness
• security
• guardrails
  size_categories:
• 10K<n<100K
  annotations_creators:
• machine-generated
  source_datasets:
• extended
  extra_gated_prompt: >-
  Jailbreak Corpus is released for DEFENSIVE security and AI-safety research
  only: training/evaluating jailbreak detectors, studying attack taxonomies, and
  measuring robustness. By requesting access you agree to the Responsible Use
  Policy (RESPONSIBLE_USE.md) and confirm you will not use this data to attack
  systems you are not authorized to test, to harass anyone, or to generate
  harmful content. Access is logged.
  extra_gated_fields:
  Full name: text
  Affiliation / organization: text
  Country: country
  Intended use (one or two sentences): text
  I will use this dataset for defensive / research purposes only: checkbox
  I accept the Responsible Use Policy: checkbox
  extra_gated_button_content: Request access
  configs:
• config_name: default
  data_files:
  • split: train
    path: train.parquet
  • split: validation
    path: validation.parquet
  • split: test
    path: test.parquet

Jailbreak Corpus — v0.3

A labeled corpus of real jailbreak attempts — adversarial prompts that try
to make a language model violate its safety policy — assembled for defensive
work: training/evaluating jailbreak detectors and guardrails, studying attack
taxonomies, and measuring model robustness.

Prompts only — no model completions. Every record is an attack prompt plus
metadata. The corpus contains no model outputs, hence no successful harmful
generations. It is gated and excludes CSAE content entirely. See
RESPONSIBLE_USE.md. The prompts describe harmful intents
(that is the attack surface a detector must recognize); handle accordingly.

Composition (v0.3)

Real seeds by source (all MIT/Apache-2.0 except WildJailbreak = ODC-BY; see
LICENSES.md):

Synthetic augmentation wraps the real seeds in encoding/cipher transforms and
persona/template attacks (across model families), flagged synthetic=true with
parent_id lineage. Pipeline: dedup real seeds → augment unique seeds → final
dedup → group-aware stratified split (a seed and its variants never cross the
train/test boundary).

Distributions (counts)

• Family (provenance): unspecified 40,739 · openai 9,097 · anthropic 2,291 ·
  meta 1,833 · cohere 1,526 · google 1,022 · mistral 874 · xai 784 · deepseek 759 ·
  alibaba 742 — all 9 families present.
• Technique (primary): other 30,555 · hypothetical_fiction 8,389 ·
  encoding_obfuscation 7,433 · role_play_persona 4,343 · cipher 2,878 ·
  privilege_escalation 1,660 · refusal_suppression 1,428 · prompt_injection 1,175 · …
• Harm (primary): unknown 54,471 · cyber 1,292 · hate_harassment 938 ·
  sexual_content 670 · misinformation 634 · illegal_other 460 · privacy_pii 453 · …
• Outcome: unknown 56,420 · success 2,370 · refusal 718 (success/refusal from
  HackAPrompt; outcome_method = source_reported).

Record schema

Authoritative JSON Schema: record.schema.json.

from datasets import load_dataset
ds = load_dataset("Cogensec/jailbreak-corpus")          # gated; accept the terms
real = ds["train"].filter(lambda r: not r["synthetic"]) # real-only seeds

Intended uses

✅ Train/evaluate jailbreak & prompt-injection detectors and guardrails,
robustness benchmarking, taxonomy research, authorized red-teaming of your own
systems. ❌ Attacking third-party systems, harassment, harmful generation — see
the Responsible Use Policy.

Limitations (honest)

• Labeling is rule-based. Technique is other for 51% and harm is unknown
  for 92% — many prompt-injection seeds don't match keyword signals, and bare
  scaffolds carry no payload-specific harm. An LLM-assisted pass
  (jbcorpus label --llm-assist) is implemented and will raise precision in a
  future release; treat current technique/harm labels as weak.
• Source concentration. WildJailbreak (~46% of real seeds) and SPML injection
  (~29%) dominate. Filter by source_dataset for balance.
• Provenance mostly unspecified and otherwise OpenAI-skewed; reflects the
  sources, not current model susceptibility.
• Outcome unknown for ~95% — only HackAPrompt reports per-prompt results;
  no completions are stored.

Sources & licenses

Aggregated from 14 public datasets (MIT / Apache-2.0, plus WildJailbreak ODC-BY
with attribution to AI2). Synthetic records are Apache-2.0. Full attribution table
and per-record license/source_url: LICENSES.md.

Citation

@misc{cogensec_jailbreak_corpus_2026,
  title  = {Jailbreak Corpus: A Labeled Dataset of Jailbreak Attempts (v0.3)},
  author = {Cogensec},
  year   = {2026},
  note   = {Gated. Aggregated from 14 public MIT/Apache/ODC-BY datasets + synthetic augmentation; see LICENSES.md},
  url    = {https://huggingface.co/datasets/Cogensec/jailbreak-corpus}
}

Please also cite the originating sources of the records you use (source_url per
record); WildJailbreak (ODC-BY) requires attribution to AI2. See the
DATASHEET and Responsible Use Policy.