language:
- en
license: apache-2.0
task_categories: - text-classification
task_ids: - multi-label-classification
tags: - security
- agentic-ai
- biosafety
- prompt-injection
- red-teaming
- STRIDE
- NSABB
pretty_name: AgentShield Attack Scenarios
size_categories: - n<1K
AgentShield Attack Scenarios
100 structured attack scenarios for evaluating security of agentic AI systems operating in high-risk domains (biological research). Developed alongside the AgentShield detection pipeline.
Dataset Description
Each scenario is a multi-turn attack sequence targeting one of four attack surfaces identified through STRIDE threat modeling of a BioTeam-AI multi-agent system:
| ID | Attack Surface |
|---|---|
| AS-001 | Agent-to-Agent Communication |
| AS-002 | Tool Execution Interface |
| AS-003 | External Input Processing |
| AS-004 | Memory/Knowledge Base |
Categories (25 scenarios each)
| Category | Description |
|---|---|
direct_injection |
Malicious instructions injected directly in user messages |
indirect_injection |
Payloads embedded in tool outputs, documents, or external data |
multi_turn_escalation |
Gradual escalation across turns to cross safety boundaries |
tool_misuse |
Abuse of tool interfaces including MCP tool poisoning |
Fields
| Field | Type | Description |
|---|---|---|
scenario_id |
string | Unique identifier (e.g., DI-01, II-14, MT-07, TM-22) |
name |
string | Human-readable scenario name |
category |
string | One of the four attack categories |
description |
string | What the attack attempts to do |
target_surface |
string | Which attack surface is targeted (AS-001 to AS-004) |
messages |
list[string] | Ordered attacker messages in the conversation |
n_turns |
int | Number of turns in the attack sequence |
expected_behavior |
string | What a vulnerable agent would do |
success_criteria |
string | How attack success is evaluated |
nsabb_category |
string or null | NSABB dual-use category for escalation attacks |
metadata |
dict | Additional flags (e.g., emit_tool_calls) |
Evaluation Results
Results from running against the AgentShield 4-detector pipeline (InputClassifier + ToolAuditor + OutputClassifier + TrajectoryMonitor):
| Metric | Value |
|---|---|
| Attack Success Rate (defended) | 2.5% |
| Attack Success Rate (undefended) | 35% |
| ASR Reduction | 92.9% |
| Direct Injection Detection | 100% |
| Multi-Turn Escalation Detection | 100% |
| Benign FPR | 1.0% (1/100, Wilson 95% CI [0.2%, 5.5%]) |
Usage
from datasets import load_dataset
ds = load_dataset("jang1563/agentshield-attack-scenarios")
print(ds["train"][0])
Filter by category:
direct = ds["train"].filter(lambda x: x["category"] == "direct_injection")
Related Resources
- Detection Pipeline: github.com/jang1563/agentshield
- BioSafety Classifier: jang1563/constitutional-bioguard-deberta-v1
Citation
@software{kim2026agentshield,
author = {Kim, JangKeun},
title = {{AgentShield}: Security Audit Framework for Agentic AI Systems},
year = {2026},
url = {https://github.com/jang1563/agentshield},
version = {0.1.0},
}
License
Apache 2.0