license: mit
task_categories:

• text-generation
  language:
• en
  tags:
• adversarial-robustness
• red-teaming
• jailbreak
• llm-security
  pretty_name: ClearHarm with Optimization Targets
  size_categories:
• n<1K
  source_datasets:
• AlignmentResearch/ClearHarm
  configs:
• config_name: default
  data_files:
  • split: train
    path: clearharm_with_targets.parquet

ClearHarm with Optimization Targets

This is a derivative of AlignmentResearch/ClearHarm by
Oskar Hollinsworth, Ian McKenzie, Tom Tseng and Adam Gleave (FAR.AI).
All harmful instructions are theirs; please cite them, not us, for the
prompts. See the ClearHarm announcement.

ClearHarm in the
exact row order it is distributed upstream, plus the two fields the
TROPT benchmarks need — a per-instruction
affirmative target prefix and a trigger template — and the split
assignment those benchmarks use.

This is the id reference for TROPT's two trigger datasets. msg_id here is
the same msg_id / eval_msg_id published in:

• MatanBT/tropt-optbench-triggers (Exp1)
• MatanBT/tropt-jailbreak-enhancebench-triggers (Exp2)

so those datasets are resolvable to instruction text without any private file.

⚠️ Harmful instructions, for defensive security research. These are the
public ClearHarm prompts. This repo contains no model completions — only
the instruction, an affirmative sentence stub used as an optimization target,
and a template. The model responses live in the two gated trigger datasets.

Columns

The split

TROPT optimizes triggers on 15 instructions and measures universality on
100 held-out ones. tropt_split records that assignment, so the held-out
set is verifiable rather than implicit:

from datasets import load_dataset
ch = load_dataset("MatanBT/clearharm-with-targets", split="train").to_pandas()

opt     = ch[ch.tropt_split == "optimization"].msg_id.tolist()   # 15
heldout = ch[ch.tropt_split == "heldout"].msg_id.tolist()        # 100
# the evaluation set, in order:
eval_set = ch[ch.eval_order >= 0].sort_values("eval_order")      # 115 rows

Relation to upstream

Row order is identical to AlignmentResearch/ClearHarm — verified
positionally on all 179 rows. The only textual difference: 123 messages have a
trailing period stripped here, because message_template appends
" {{OPTIMIZED_TRIGGER}}." and the suffix must sit before the final stop. Text
is otherwise byte-identical.

target_response_prefix is not upstream's proxy_gen_target: upstream uses
one generic "Sure, here" for every row, while these are tailored per
instruction, which is what the prefill losses optimize against.

Citation & attribution

The instructions are ClearHarm's. Cite the original dataset:

• ClearHarm — Oskar Hollinsworth, Ian McKenzie, Tom Tseng, Adam Gleave
  (FAR.AI), 2025.
  Dataset: https://huggingface.co/datasets/AlignmentResearch/ClearHarm
  Announcement: https://www.far.ai/research/clearharm-a-more-challenging-jailbreak-dataset

  (Upstream ships no BibTeX block; the links above are the canonical
  references at time of writing.)

Only the added fields are ours — target_response_prefix,
message_template, tropt_split and eval_order — and they come from the
TROPT toolbox: https://github.com/matanbt/tropt.

If you use this repo, please cite both ClearHarm (for the prompts) and TROPT
(for the targets and the benchmark split).