license: other
license_name: mixed-per-row
license_link: https://huggingface.co/datasets/edithngalame/prompt-injection-en-es#sources-and-licences
language:

• de
• en
• es
• fr
• it
• pt
  task_categories:
• text-classification
  tags:
• prompt-injection
• llm-security
• ai-security
• jailbreak
• multilingual
• spanish
  pretty_name: Prompt Injection EN-ES (LLM Security Gateway v0.2.1)
  size_categories:
• 10K<n<100K

Prompt Injection EN-ES

A multilingual (English + Spanish) dataset for detecting prompt injection: text that tries to make an AI system follow an attacker's instructions instead of its owner's. It covers direct attacks typed by users and indirect attacks hidden in documents such as emails.

Built for the [LLM Security Gateway project. 18,312 rows, 5,619 injections and 12,693 benign.

What makes it different

• Source-aware: every row says where the text entered the AI's context: typed by the user or inside a retrieved document.
• Spanish, including a small human-translated test set, not only machine translation.
• Shortcut fixes, measured: two patterns that would let a model cheat were found and corrected (see below).
• Held-out evaluation sets for attack styles and languages never seen in training.
• Leakage-checked: no text appears in more than one split, translations always share the split of their English original, and every version of an email (attacked, clean, harmless) stays in one split.

Labels

• 1 injection: text trying to make the AI follow the author's instructions instead of its owner's (override rules, extract hidden instructions, hijack actions, manipulate answers).
• 0 benign: everything else, including hard benign text that talks about rules, instructions or AI without trying to hijack it.

Fields

Splits

Shortcut fixes

• Spanish texts in training that are injections: 21% (5,785 rows). Before the fix: under 1%, which would teach "Spanish = safe".
• Email-shaped texts in training that are injections: 61% (1,086 rows). Before the fix: 96%, which would teach "email = attack". Still above the overall rate, so false positives on harmless emails are measured separately.

Sources and licences

Licensing is mixed and recorded per row in the license column. Rows derived from Dolly carry CC-BY-SA-3.0 (share-alike); rows from the other sources carry their original permissive licences. Respect each row's licence when reusing it.

How it was built

Reproducible Colab notebooks in the project repository:

1. 01_collect_sources: download, normalise, detect language, deduplicate, drop texts labelled both ways
2. 02_splits_and_spanish: group-aware splits before augmentation, Spanish translation of attacks and matching benign texts, harmless email inserts, leakage check
3. 04_dataset_card_and_publish: this card

Known limitations

• Most Spanish text is machine-translated. The human-translated test set is small (32 rows) and translated from English rather than written from scratch.
• Indirect attacks come from one source (BIPIA emails) and reuse a limited set of attack instructions. Other document types (web pages, PDFs) are only covered by the hand-written sets.
• No tool-output or MCP tool-description attacks yet. The gateway handles tool risk through permissions and taint tracking instead (v0.4).
• Language labels for some rows are automatic (langid) and can be wrong for very short texts.
• Harmless email sentences come from fixed lists: 36 for training, 12 for validation and 12 for test, with no overlap. Real harmless emails are far more varied.
• Residual email bias: email-shaped texts are still more often injections than average.
• The benign side is mostly general questions and encyclopedic text; real application traffic will differ.

Intended use

Training and evaluating prompt-injection detectors, especially multilingual and source-aware ones. Not intended as a complete security solution: detection should be combined with least-privilege design for AI agents.

Changelog

• v0.2.1: validation now contains emails (20% of BIPIA's training emails, moved as whole emails). In v0.2 it had none, so thresholds tuned on it blocked about 9% of harmless test emails. Harmless email sentences are now split into separate train / validation / test lists (v0.2 reused the same 25 in every split, and a baseline memorised them).
• v0.2: first release. Still available: load_dataset("edithngalame/prompt-injection-en-es", revision="v0.2").

Citation

@misc{ngalame2026promptinjectionenes,
  title  = {Prompt Injection EN-ES: a source-aware multilingual prompt injection dataset},
  author = {Ngalame Atechkeng, Edith Dione},
  year   = {2026},
  url    = {https://huggingface.co/datasets/edithngalame/prompt-injection-en-es}
}