license: cc-by-4.0
task_categories:

• text-classification
  language:
• en
  tags:
• red-teaming
• llm-security
• jailbreak
• adversarial-prompts
• ai-safety
• safety-evaluation
• guardrails
• prompt-injection
• owasp-llm-top10
• mitre-atlas
  size_categories:
• 10K<n<100K
  pretty_name: "LLM Red-Team Corpus (Core) — license-clean red-team prompts"
  configs:
• config_name: default
  data_files: canonical.parquet

LLM Red-Team Corpus + Taxonomy — Core

44,681 prompts for red-teaming and safety-testing LLMs. We collected them
from 9 public sources, checked every license, masked personal data, and saved
where each prompt came from. Load it in one line.

Use one clean dataset instead of downloading and fixing 9 red-team benchmarks by
hand. Every prompt keeps its source, license, and citation. The
core tier is safe to use in commercial products — every source is verified
MIT / Apache-2.0 / CC-BY-4.0.

Other versions: want everything (all 12 sources, 64,458 rows,
non-commercial)? → -full.
Only the non-commercial sources? → -extended.

• ✅ 9 sources, license-verified — checked live against each upstream repo
• ✅ License-clean core — safe for guardrail products and evaluations
• ✅ PII masked — phone numbers and street addresses replaced with tags
• ✅ Origin on every row — easy to reproduce and cite (sources.json)
• 🔜 Mapped to OWASP LLM Top 10 / MITRE ATLAS (Phase 2, 2026-Q4)
• ♻️ Living dataset — we update it every quarter (vYYYY.QX)

Quick start

from datasets import load_dataset

ds = load_dataset("rubyglask/llm-redteam-corpus-taxonomy-core")
print(ds["train"][0]["prompt"])

# keep only one source, or only English
hh = ds["train"].filter(lambda r: r["source_id"] == "anthropic_hh")
en = ds["train"].filter(lambda r: r["language"] == "en")

Non-commercial sources (BeaverTails, ALERT, ToxicChat) are in the sibling
dataset: rubyglask/llm-redteam-corpus-taxonomy-extended (26,748 rows).

What is inside

Note on the mix: 83% of core (37,155 rows) comes from the HH-RLHF
red-team set. Each row is the first human message of a red-team
conversation. Most are direct harmful requests, but some are ordinary openers
(e.g. "How are you?") — the harmful intent can appear in later turns we do not
include. The other 8 sources (7,526 rows) are curated single-turn attack
benchmarks.

Sources (we checked every license against the upstream repo on 2026-07-03):

Full per-source attribution: sources.json.

Fields

Each row has:

Formats in the repo: Parquet (default) · JSONL.gz · DuckDB.

When to use this

• You build or test guardrails / safety filters and want one clean,
  license-safe set instead of joining 9 sources by hand.
• You want to reproduce red-team research with the origin kept.
• You teach or evaluate AI safety against known attack types.

When NOT to use this

• You need one specific benchmark (like only HarmBench for a paper) — use
  the original. This is a mix, not a replacement.
• You need the biggest possible set — single sources (like BeaverTails 330K)
  are larger. This dataset is about clean + unified, not size.
• You want a pure single-turn attack set — remember 83% here is HH-RLHF
  first turns; filter by source_id != "anthropic_hh" for the curated 7,526.

Privacy (PII)

A few source prompts contained real phone numbers and street addresses (for
example, doxxing-style requests). We mask these with [PHONE] and
[ADDRESS] tags. Some named-person mentions may remain in the text. If you find
personal data that should be removed, open an issue.

Ethics and dual-use

This is a dataset for defensive research. Every prompt is already public
in research or industry sources, so safety teams can test against them. Do
not use them to attack systems without permission. Please follow responsible
disclosure.

Excluded on purpose: StrongREJECT (mixes in no-license questions),
WMDP (dual-use weapons-proxy knowledge), and Persuasion (not attack prompts).
See docs/license_matrix.md.

How we build it (reproducible)

9 public sources → PII mask → canonical schema → exact-hash dedup (−4%) → parquet / jsonl / duckdb

You can rebuild everything from
github.com/rubyglask/llm-redteam-corpus-taxonomy
(pip install -e . → import_all → build_corpus → verify_checksums).
The build is deterministic, and every release ships SHA-256 checksums.

Roadmap

• Now (v0.1.0): 12 sources (9 core + 3 extended), 71,429 prompts.
• Phase 2 (Q4): fill taxonomy_hints — map each prompt across OWASP LLM
  Top 10 / MITRE ATLAS / NIST AI RMF / EU AI Act / ISO 42001 / KISA.
• Every quarter: add new public sources + a short changelog paper.

Not included yet: 2 sources waiting for a license check (MaliciousInstruct,
Korean UnSmile).

Citation

@misc{rubyglask2026llmredteamcorpus,
  author = {rubyglask},
  title  = {LLM Red-Team Corpus + Taxonomy},
  year   = {2026},
  howpublished = {\url{https://github.com/rubyglask/llm-redteam-corpus-taxonomy}}
}

(Zenodo DOI + arXiv preprint: Phase 1 Week 8.) Each source also keeps its own
citation — see provenance on every row and sources.json.