pretty_name: CiberIA PromptRisk v1
license: cc-by-4.0
language:

• ca
• es
• en
  task_categories:
• text-classification
  tags:
• ai-security
• prompt-injection
• jailbreak
• agentic-security
• multilingual
• synthetic
• ciberia
  size_categories:
• 1K<n<10K
  configs:
• config_name: default
  data_files:
  • split: train
    path: data/train-*.parquet
  • split: validation
    path: data/validation-*.parquet
  • split: test
    path: data/test-*.parquet

CiberIA PromptRisk v1

CiberIA PromptRisk v1 is a balanced multilingual dataset for researching binary detection of potentially adversarial instructions targeting LLMs and AI agents.

• 3,072 records
• Catalan, Spanish and English
• 1,024 records per language
• 512 BENIGN + 512 ATTACK records per language
• 8 attack families
• 8 benign families, including hard negatives
• Pattern-grouped train/validation/test splits

This is a CiberIA Open Research artifact. It is intentionally separate from proprietary CiberIA assessment protocols and does not contain AIsecTest, CRS, ECP, private scoring rules or internal evaluation prompts.

Dataset structure

Each language contains exactly the same number of records and the same class/family distribution.

Labels

The first model trained from this dataset is intentionally binary. Rich taxonomy fields remain available for analysis and later multi-class or multi-label versions.

Attack families

Each family contains 192 records in total: 64 Catalan, 64 Spanish and 64 English.

Benign families and hard negatives

Each benign family also contains 192 records. Four families are marked as hard_negative=true, for a total of 768 hard negatives:

Hard negatives reduce dependence on simple keywords. For example, a defensive request discussing “ignore previous instructions” remains BENIGN.

Split methodology and leakage control

The dataset uses two linked grouping fields:

• scenario_group binds the Catalan, Spanish and English versions of the same scenario.
• pattern_group binds every context generated from the same underlying instruction template.

Splits are assigned at pattern_group level. Therefore:

1. no translation pair crosses splits;
2. no scenario crosses splits;
3. no underlying template pattern crosses splits.

There are 160 pattern groups and 1,024 scenario/translation groups. For every attack or benign family, eight template patterns are assigned to train, one to validation and one to test. Context balancing produces 51/6/7 or 51/7/6 examples per language and family, alternating validation and test sizes.

This is stricter than a random row split, but it is still an in-domain synthetic evaluation. External adversarial testing remains necessary.

Record schema

Usage

from datasets import load_dataset

dataset = load_dataset("gcjordi/CiberIA-PromptRisk-v1")
print(dataset)
print(dataset["train"][0])

For binary training, use text as input and label as target. Do not recompute random splits: the provided splits preserve multilingual and pattern isolation.

Creation and validation

The corpus was produced through a controlled construction workflow using multilingual patterns and scenario slots. Automated validation of the published data checks:

• exact row, class, language, family and split counts;
• required fields and enum values;
• ID and normalized-text uniqueness;
• translation-group completeness;
• scenario, template and pattern split isolation;
• SHA-256 text integrity;
• integrity of the published Parquet files.

The initial public v1 release did not include its original authoring/generation package. The reproducibility/ addendum documents this limitation explicitly and provides auditable validation of the published Parquet shards, their hashes and a transparent TF-IDF baseline. It does not claim retrospective byte-for-byte regeneration of the original construction workflow. See AUTHORSHIP_AND_AI_USE.md and PROVENANCE.md.

PromptRisk v1 is a synthetic, human-directed, AI-assisted research dataset. It must not be interpreted as a wholly human-authored corpus, and v1 does not assert a 100% human-only subset.

Intended uses

• Research and teaching about prompt-risk classification
• Reproducible multilingual classifier experiments
• Pre-screening or triage as one signal in defense-in-depth systems
• Analysis of false positives on defensive/hard-negative content
• Starting point for externally curated or production-specific extensions

Out-of-scope uses

• Treating BENIGN as proof that an input is safe
• Using the dataset or derived model as the sole authorization boundary
• Claiming coverage of all attack techniques, languages or deployment contexts
• Evaluating unrelated harms or factual correctness
• Deploying without external red-team data and organization-specific calibration

Limitations

• v1 is synthetic and deliberately compact.
• Only Catalan, Spanish and English are represented.
• Texts are short single-input samples, not full conversations or multimodal artifacts.
• Operational environments, tool schemas and secret formats are fictional.
• Some stylistic patterns may be easier to classify than real attacks.
• Test metrics from this corpus measure in-domain generalization, not production security effectiveness.
• Independent native-speaker and adversarial review should precede high-stakes use.

Safety and privacy

No real credentials, private prompts, personal data or live targets are included. Reserved .invalid domains and fictitious commands are used in attack examples. Handle adversarial strings as untrusted data and do not feed them to tool-enabled systems without isolation.

License

The dataset is released under CC BY 4.0. Recommended attribution:

“CiberIA PromptRisk v1” by Jordi Garcia Castillon / CiberIA Open Research, licensed under CC BY 4.0.

Code and future model weights are licensed separately under Apache-2.0.

Citation

@dataset{garcia2026ciberiapromptrisk,
  title        = {CiberIA PromptRisk v1},
  author       = {Jordi Garcia Castillon},
  year         = {2026},
  publisher    = {Hugging Face},
  url          = {https://huggingface.co/datasets/gcjordi/CiberIA-PromptRisk-v1},
  version      = {1.0.0}
}