license: apache-2.0
task_categories:

• text-classification
  language:
• en
  tags:
• ai-safety
• prompt-injection
• jailbreak
• llm-security
• adversarial
• scbe
• sacred-tongues
• bijective-tokenization
• experimental
  size_categories:
• 10K<n<100K
  configs:
• config_name: default
  data_files:
  • split: train
    path: train.jsonl
  • split: validation
    path: validation.jsonl
  • split: test
    path: test.jsonl

Status: experimental. Experiment-specific slice. Primary public dataset: scbe-aethermoore-training-data.

Prompt Injection → Bit Signatures

24,254 labeled prompts from 4 public prompt-injection datasets, each mapped through the Six Sacred Tongues bijective tokenizer from the SCBE-AETHERMOORE framework into a lossless per-prompt bit signature.

Stratified 70/15/15 train/val/test split by (source, label) so every source is represented in every split with its original label distribution.

Quick load

from datasets import load_dataset
ds = load_dataset("issdandavis/prompt-injection-bit-signatures")
print(ds)
# DatasetDict({
#   train: Dataset({ num_rows: 16976 ... })
#   validation: Dataset({ num_rows: 3634 ... })
#   test: Dataset({ num_rows: 3644 ... })
# })

Schema

bit_signature

Source breakdown

Label breakdown (full dataset)

• malicious: 16,541
• benign: 7,047
• jailbreak: 666

All four upstream datasets were harmonized: their label columns (ints, bools, or strings) were normalized to the three classes above. SPML and neuralchemy use integer 0/1; jackhhao uses strings like "jailbreak"/"benign"; deepset uses binary 0/1.

Baseline results

A gradient boosting classifier (scikit-learn, depth=4, n_estimators=120) trained on 31 features derived only from bit_signature — no text understanding, no embeddings, no language model.

Features: byte_len, byte_entropy, phi_weight_sum / byte_len, 16 normalized bit histogram counts, 12 normalized per-tongue parity counts.

Per-source within-distribution AUC

Leave-one-source-out (cross-distribution)

Within-distribution performance is strong (85–98% AUC); cross-distribution drops to 68–88% AUC. That's expected — the bit signature captures both universal attack patterns AND dataset-specific statistical fingerprints. Train on a mix of sources for best generalization.

31 features. No neural net. 92% AUC. That's the bar a bijective tokenizer sets.

Why a bijective tokenizer

The Six Sacred Tongues tokenizer is bijective: every UTF-8 byte (0–255) maps to exactly one token per tongue, and back, with zero loss. That's rare — BPE, WordPiece, and SentencePiece are not bijective. Building on a bijective layer means:

1. Lossless feature extraction — the bit signature summarizes the bytes, but the full byte stream is recoverable from the token streams
2. Auditability — every detection decision traces back to literal bytes
3. No language understanding required — the detector learns on pure bit-level statistics

See the 500-row sample file (injection_bit_signatures_sample.jsonl) for the full 6-tongue token streams alongside each signature.

Reproduce

# Pipeline
git clone https://github.com/issdandavis/scbe-experiments
cd scbe-experiments
pip install datasets scikit-learn
python injection_to_bits.py --source all --out bits.jsonl

# Classifier
python train_injection_classifier.py

Tokenizer implementation: github.com/issdandavis/six-tongues-geoseal

Files

Related

• Research article: From Prompt Injection to Bits
• Framework: SCBE-AETHERMOORE
• Pipeline + classifier code: scbe-experiments
• Evidence ledger: aethermoore.com/research/evidence.html
• Managed solutions: CX Refund Guardrail, AI Red Team

License

Apache-2.0. Upstream datasets retain their own (all Apache-2.0 or MIT).

Citation

@misc{davis2026injectionbits,
  author = {Davis, Issac},
  title = {Prompt Injection Bit Signatures via Six Sacred Tongues Bijective Tokenization},
  year = {2026},
  howpublished = {\url{https://huggingface.co/datasets/issdandavis/prompt-injection-bit-signatures}},
}