language:
- en
license: apache-2.0
size_categories: - 10K<n<100K
task_categories: - text-classification
tags: - safety
- ai-safety
- jailbreak-detection
- prompt-injection
- adversarial
- representation-probing
pretty_name: Subtext Safety Probes
Subtext Safety Probes
A dataset of 26,724 prompts labeled for AI safety research, designed for training classifiers and representation probes that detect disguised harmful intent — harmful requests hidden behind fiction, poetry, roleplay, academic framing, and other stylistic masks.
Dataset Summary
| Split | Samples |
|---|---|
| Train | 21,379 |
| Validation | 2,672 |
| Test | 2,673 |
- Harmful: 18,369 (68.7%)
- Benign: 8,355 (31.3%)
Schema
Each row contains:
| Field | Type | Description |
|---|---|---|
prompt |
string | The user prompt text |
harmful |
bool | Whether the prompt contains harmful intent |
category |
string | Harm category (see below) |
style |
string | Stylistic framing: direct, fiction, poetry, roleplay, academic, historical, theological, metaphor |
source |
string | Origin dataset or synthetic_category_gen for LLM-generated examples |
sub_topic |
string or null | Finer-grained topic (for synthetic examples) |
Harm Categories
| Category | Count | Description |
|---|---|---|
prompt_injection |
14,209 | Jailbreak attempts, role hijacking, system extraction |
benign |
8,355 | Safe, non-harmful prompts |
other_harmful |
1,437 | General harmful instructions |
hate |
562 | Hate speech, discrimination |
theft |
427 | Theft, burglary |
violence |
400 | Physical harm, assault, weapons |
disinfo |
289 | Disinformation, propaganda |
drugs |
285 | Illegal substances |
privacy |
240 | Doxxing, surveillance, stalking |
sexual |
124 | Sexual exploitation |
self_harm |
105 | Self-harm, suicide |
terrorism |
94 | Terrorism, extremism |
fraud |
85 | Financial fraud, scams |
cyber |
85 | Hacking, malware |
child_abuse |
27 | Child exploitation |
Style Distribution
The majority of samples (25,752) are in direct style — explicit harmful or benign prompts. An additional 972 synthetic examples were generated across 7 disguised styles to support style-invariant safety detection:
fiction (138) · poetry (132) · roleplay (144) · academic (132) · historical (144) · theological (138) · metaphor (144)
Sources
Aggregated and deduplicated from multiple public safety datasets:
- Neuralchemy Prompt Injection Threat Matrix
- jackhhao/jailbreak-classification
- JailbreakBench JBB-Behaviors
- EasyJailbreak (AdvBench, ForbiddenQuestion, MaliciousInstruct)
- PKU-Alignment BeaverTails
- rubend18/ChatGPT-Jailbreak-Prompts
- Synthetic style-transfer examples generated via Claude Sonnet
Usage
from datasets import load_dataset
ds = load_dataset("amelialam/subtext-safety-probes")
# Binary classification
for example in ds["train"]:
text = example["prompt"]
label = example["harmful"] # True / False
# Filter by style
disguised = ds["test"].filter(lambda x: x["style"] != "direct")
Intended Use
- Training and evaluating safety classifiers
- Representation probing research (extracting safety signals from LLM internal activations)
- Benchmarking robustness of safety filters against style-disguised attacks
- Studying how harmful intent transfers across literary/rhetorical framings
Limitations
- Synthetic style-transfer examples were generated by a single LLM and may not capture the full diversity of real adversarial attacks
- Category distribution is imbalanced (heavy on prompt injection)
- Style-transferred examples are concentrated in 12 harm categories × 7 styles — not exhaustive
- The
harmfullabel reflects the intent of the prompt, not whether the prompt would actually succeed in eliciting harmful output from a model
License
Apache 2.0