license: apache-2.0
task_categories:
- text-classification
language: - en
tags: - prompt-injection
- healthcare
- security
- phi
- llm-safety
- guardrails
- jailbreak
size_categories: - 1K<n<10K
pretty_name: QFIRE-HealthBench
configs: - config_name: default
data_files: dataset.csv
QFIRE-HealthBench: a healthcare prompt-injection benchmark
1000 benign + 1000 malicious healthcare prompts for evaluating LLM
prompt firewalls in clinical settings.
Malicious provenance (by source)
- native (healthcare threats authored here): 400
- garak (real NVIDIA/garak DAN-family + in-the-wild jailbreaks, healthcare-wrapped): 300
- pyrit (real Microsoft PyRIT converters): 300
Categories: {'bulk_export': 39, 'phi_exfil': 127, 'cross_patient': 86, 'jailbreak': 415, 'phi_smuggle': 26, 'clinical_advice': 185, 'reidentification': 39, 'system_exfil': 29, 'direct_injection': 54}
Obfuscation techniques: {'none': 700, 'morse': 33, 'rot13': 34, 'base64': 34, 'ascii_smuggler': 33, 'leetspeak': 33, 'binary': 33, 'caesar': 33, 'unicode_confusable': 33, 'atbash': 34}
Benign
Realistic clinical-adjacent requests (general health info, scheduling, med/insurance
admin, lab-result general explanation, wellness, mental-health resources,
records-access-for-self) that a healthcare assistant SHOULD allow. Over-blocking
these is a failure mode.
Malicious
PHI exfiltration, re-identification, cross-patient access, bulk export, out-of-scope
clinical advice (diagnosis/dosing), system-prompt exfiltration, direct injection,
and real DAN/jailbreak framings — plus obfuscated variants produced by real PyRIT
converters (Base64/ROT13/Atbash/Leetspeak/Unicode/Binary/...).
Ethics & licensing
Defensive benchmark. All identifiers are synthetic; no real PHI. Malicious =
scope-violation / injection / PHI-solicitation, not operational-harm content.
Seeds: garak (Apache-2.0, NVIDIA); converters: Microsoft PyRIT (MIT). Generated
deterministically (seed 1337) by scripts/gen_healthcare_dataset.py + scripts/pyrit_convert.py.
Files & schema
dataset.csv— the full benchmark, 2000 rows (1000 benign + 1000 malicious),
deterministically shuffled (seed 1337) so the two classes are interleaved.dataset.jsonlis the same data in JSON Lines for programmatic use.
| column | description |
|---|---|
prompt |
the input prompt text |
label |
benign or malicious |
category |
threat category (phi_exfil, jailbreak, bulk_export, …) or benign |
technique |
obfuscation applied (none, base64, rot13, unicode_confusable, …) |
source |
provenance (native, garak, pyrit) |
from datasets import load_dataset
ds = load_dataset("H3althAg3nt/QFIRE-Healthbench") # 2000 rows
benign = ds["train"].filter(lambda r: r["label"] == "benign")
attacks = ds["train"].filter(lambda r: r["label"] == "malicious")
Citation
If you use this dataset, please cite the QFIRE paper
(medRxiv preprint):
@article{schwoebel2026qfire,
title = {Beyond Injection Detection: A Positive-Security Prompt Firewall
that Closes the Scope and PHI Gap SOTA Classifiers Miss in Healthcare},
author = {Schwoebel, James and Semenec, Ingrida and Rousseva, Jenia and
Frasch, Martin G. and Thorstenson, Rome and Bhatt, Manish},
journal = {medRxiv},
year = {2026},
doi = {10.64898/2026.06.04.26354950},
url = {https://www.medrxiv.org/content/10.64898/2026.06.04.26354950v1},
note = {Preprint. Task Force for AI Agents in Healthcare}
}
Code: https://github.com/Task-force-for-AI-agents-in-Healthcare/qfire