license: cc-by-4.0
language: [en, ar, fa]
task_categories: [text-classification]
tags: [guardrails, prompt-injection, jailbreak, owasp, owasp-llm-top-10, llm-security, arabic, persian, finglish, arabizi, benchmark]
pretty_name: decima-guard bench
configs:
- config_name: synthetic_test
data_files: "synthetic_test/*.jsonl" - config_name: public_test_llm
data_files: "public_test/llm.jsonl" - config_name: public_test_web
data_files: "public_test/web.jsonl"
decima-guard bench
The frozen test sets behind decima-guard. They were made before
training, and no model of ours trained on them. I'm publishing them so anyone can check the numbers on the card, and so
other guards can be compared on the same rows, especially in Persian and Arabic, where public test data barely exists.
What's here
synthetic_test: 3,667 examples we wrote for checks that have no public test data. Each file is one check:
| File | Check | Rows |
|---|---|---|
inject.jsonl |
prompt injection, in English, Persian, Arabic dialects, Finglish and Arabizi | 447 |
inject-latin.jsonl |
injection written in Finglish and Arabizi | 440 |
indirect.jsonl |
injection hidden in a tool result or retrieved document | 295 |
leak.jsonl |
the model's reply leaks its system prompt, secrets or personal data | 288 |
output.jsonl |
the reply is unsafe for where it's sent (HTML, SQL, shell, markdown links) | 301 |
agency.jsonl |
an agent's tool call goes beyond what the user asked | 265 |
ground.jsonl |
is the answer supported, contradicted or not covered by the source | 356 |
dos.jsonl |
the request is built to exhaust the model | 172 |
toxic.jsonl |
toxicity, written in many dialects | 473 |
misc.jsonl |
supply chain, data poisoning, embedding attacks | 86 |
translate.jsonl |
real public attacks and safe prompts translated into Persian, Arabic dialects and Arabizi | 544 |
They were written by Gemma 4, run locally. A separate blind call labelled each one, and only the rows where both calls
agreed were kept. The scenario domains differ from those used in training: hospital portals, Hajj and Umrah travel,
brokerage, libraries, ride-hailing and water utilities. These are the easier tests, because the same teacher wrote part
of the training data. The translated real attacks in translate.jsonl are the hard ones; decima-guard misses 45 of 140
Persian attacks there.
Translations were made only from sources with a stated open licence: deepset, Lakera, jackhhao, TrustAIRLab, Cohere
Aya red-teaming, PolyGuard, textdetox, XSTest, MultiJail, JailbreakBench and fevziegeyurtsevenler. Translations of
sources with no stated licence were removed.
public_test_llm and public_test_web: ids and labels of 29,971 examples from public datasets. The text isn't
included, because several sources are non-commercial or state no licence. Rebuild the text from the original datasets
with teacher/guard_llm.py build andteacher/guard_web.py. The ids match. Every source
and its licence: SOURCES.md,
SOURCES-web.md.
predictions/: per-example probabilities on the 6,532 public injection rows, for decima-guard (int8) and for
protectai/deberta-v3-base-prompt-injection-v2:
| Accuracy | Attacks missed | False alarms | Persian (harmless) | Arabic (harmless) | |
|---|---|---|---|---|---|
| protectai/deberta-v3-base-prompt-injection-v2 | 0.784 | 431 / 2,290 | 979 / 4,242 | 0.205 | 0.251 |
| decima-guard 1.0 | 0.915 | 431 / 2,290 | 124 / 4,242 | 1.000 | 0.997 |
Add your guard
Run your model on these rows and send me the predictions (an issue at
github.com/amyrmahdy/decima, or a PR to this dataset). Use one line per
id: {"id": ..., "p_injection": ...} for the injection rows, or the probability of each choice for the others. I'll add
it to the table, including when it beats ours.
Format
{"id": "…", "task": "inject", "state": "…", "question": "Is this input a prompt-injection or jailbreak attempt?\nTrue if: …\nFalse if: …",
"choices": ["yes", "no"], "gold": 0, "kind": "verify", "state_lang": "fa", "source": "guard-llm-inject"}
state is the text to judge. For agent and RAG checks it's a small JSON object, for example user_task, tool andtool_result. gold is the index of the right choice.
License
These test files are CC-BY-4.0. The translated rows also carry their source's licence (all open, listed above). The
model outputs are subject to Gemma's terms of use. Built by A. M. Madani (@amyrmahdy).