language:

• en
• fr
• de
• es
• it
• pt
• ro
• ca
  license: mit
  task_categories:
• text-classification
  tags:
• prompt-injection
• ai-safety
• llm-security
• jailbreak
• adversarial
  size_categories:
• 10K<n<100K
  dataset_info:
  features:
  • name: id
    dtype: string
  • name: text
    dtype: string
  • name: label_binary
    dtype: int64
  • name: label_category
    dtype: string
  • name: label_intent
    dtype: string
  • name: source
    dtype: string
  • name: language
    dtype: string
  • name: context
    dtype: string
  • name: metadata
    dtype: string
    splits:
  • name: train
    num_examples: 37913
  • name: validation
    num_examples: 8124
  • name: test
    num_examples: 8125

ShieldLM Prompt Injection Dataset

A unified prompt injection detection dataset with 54,162 samples spanning three attack categories: direct injection, indirect injection, and jailbreak. Curated from 11 source datasets with a 3-level hierarchical label schema.

Dataset Description

Purpose

Training and evaluating prompt injection classifiers for production deployment. Designed to address gaps in existing datasets:

• Indirect injection coverage (via InjecAgent tool-embedded attacks)
• Jailbreak techniques (via TrustAIRLab in-the-wild prompts + jackhhao classification)
• Application-structured benign data (prevents format-based false positives)
• Sensitive-topic stress tests (via JailbreakBench — topics != techniques)

Statistics

Category breakdown:

Label Schema

Source Datasets

Note: Harelix data recovered from ahsanayub/malicious-prompts (original dataset removed from HuggingFace).

Key Design Decisions

1. JailbreakBench Goals are labeled BENIGN — they describe harmful topics, not injection techniques. Used as a false-positive stress test.
2. No isolated attacker payloads from InjecAgent — context determines injection (PromptShield insight).
3. Benign data includes application-structured samples — clean tool responses from InjecAgent prevent the classifier from learning "JSON format = attack."
4. In-the-wild jailbreaks — real DAN, persona switching, and role-play attacks collected from Reddit, Discord, and jailbreak forums.

Fields

Splits

Stratified by label_category, random seed 42.

Intended Use

• Training prompt injection detection classifiers
• Benchmarking detection systems at low-FPR operating points
• Research on adversarial robustness of LLM safety filters

Limitations

• English-dominant: >98% English; multilingual samples limited to 7 other languages
• Text-only: No multimodal or visual prompt injection
• Synthetic benign tool responses: Generated by stripping injections from InjecAgent
• Static benchmark: Does not capture evolving attack techniques
• No multi-turn: All samples are single-turn

Citation

@software{shieldlm2026,
  author = {Milushev, Dimiter},
  title = {ShieldLM: Unified Prompt Injection Detection Dataset},
  year = {2026},
  url = {https://github.com/dvm81/shieldlm}
}

License

MIT (this curation). Source datasets retain their original licenses (see table above).
Note: TrustAIRLab/in-the-wild-jailbreak-prompts uses CC-BY-NC-SA-4.0; all other sources are Apache-2.0, CC-BY-4.0, or MIT.