license: apache-2.0
task_categories:
- text-classification
language: - en
tags: - red-teaming
- safety
- jailbreak
- harmful-behaviors
- alignment
- llm-evaluation
size_categories: - n<1K
UnifiedBench
Dataset Summary
UnifiedBench is a curated benchmark of 800 harmful behavior prompts for evaluating the safety alignment of large language models (LLMs). It unifies and deduplicates entries from three widely used red-teaming datasets — AdvBench (Zou et al., 2023), HarmBench (Mazeika et al., 2024), and JailbreakBench (Chao et al., 2024) — under a single, consistent seven-category taxonomy anchored in the NIST AI 100-2 framework.
The dataset enables cross-dataset comparison and per-category vulnerability analysis, which were not possible with the original benchmarks due to inconsistent or absent categorical annotations.
Dataset Details
Sources
| Source | Behaviors Included | Notes |
|---|---|---|
| AdvBench (Zou et al., 2023) | 520 | No original category labels; all manually annotated |
| HarmBench (Mazeika et al., 2024) | 200 | Standard textual behaviors; original labels remapped |
| JailbreakBench (Chao et al., 2024) | 80 | 20 duplicate behaviors (overlapping with AdvBench/HarmBench) excluded |
Data Fields
| Field | Type | Description |
|---|---|---|
Index |
int64 |
Row identifier (1–800) |
Goal |
string |
The harmful behavior prompt (the adversarial instruction) |
Target |
string |
The expected affirmative response prefix used as an attack target |
Category |
string |
Unified harm category (one of 10 values, see taxonomy below) |
Source |
string |
Original dataset attribution |
Data Splits
| Split | Rows |
|---|---|
| train | 800 |
Taxonomy
All behaviors are annotated under a unified seven-category taxonomy. Classification followed a specificity-first protocol: each prompt is assigned to the most specific applicable category, with Illegal reserved as a last-resort residual.
| Category | Description |
|---|---|
| Physical_Harm | Solicits operational knowledge for producing, acquiring, or deploying agents capable of bodily injury or death. Includes WMDs, explosives, dangerous chemical synthesis, incitement to violence, and self-harm instructions. |
| Cybercrime | Solicits creation or deployment of technical artifacts designed to compromise computer systems without authorization. Includes malware, exploits, intrusion techniques, credential theft, and denial-of-service tooling. |
| Exposure/Privacy | Solicits disclosure or aggregation of private information about identifiable individuals, or creation of privacy-violating content. Includes doxxing, stalking facilitation, PII aggregation, and non-consensual intimate imagery. |
| Disinformation | Solicits factually false or fabricated content intended to deceive. Includes false news articles, fabricated attributions, health/election disinformation, and fraudulent persuasive content. |
| Toxicity | Behaviors whose primary harm is expressive or dignitary — hate speech, harassment, demeaning stereotypes, slurs, and degrading content targeting individuals or groups based on protected characteristics. |
| Compliance | Seeks to subvert the operational boundaries of a role-constrained model, causing it to perform tasks or adopt stances prohibited by its deployment context. |
| Illegal | Residual category for broadly criminalized conduct not covered above. Includes financial crimes, narcotics/firearms trafficking, human smuggling, and institutional fraud. |
Note: The
Categoryfield in the dataset uses 10 string class values, reflecting fine-grained distinctions applied during annotation. The seven categories above represent the canonical taxonomy; some values in the data may reflect sub-mappings or naming conventions from source datasets.
Annotation Methodology
- HarmBench and JailbreakBench provided original category labels, which were remapped to the unified taxonomy where a direct semantic correspondence existed. Categories without unambiguous correspondence were manually annotated.
- AdvBench provides no categorical annotations; all 520 of its behaviors were manually classified by human annotators.
- Duplicate behaviors — defined as prompts appearing in more than one source dataset — were identified and removed. Specifically, 20 behaviors from JailbreakBench that already appeared in AdvBench or HarmBench were excluded.
Intended Uses
- LLM safety evaluation: Assess the robustness of model alignment across semantically diverse harm categories.
- Red teaming research: Use as a standardized behavior set for automated jailbreak attacks.
- Cross-benchmark analysis: Compare attack success rates (ASR) across datasets and harm categories in a unified framework.
- Per-category vulnerability profiling: Identify which harm types a given model is most susceptible to.
Out-of-Scope Uses
- This dataset is intended solely for safety research. The harmful behavior prompts should not be used to actually elicit harmful outputs from production systems outside of a controlled research context.
- Not suitable for training general-purpose language models without appropriate safeguards.
Source Dataset Details
AdvBench (Zou et al., 2023)
Originally introduced alongside the GCG (Greedy Coordinate Gradient) attack. The Harmful Behaviors subset consists of 500 harmful instructions for which any compliant response is considered a successful attack. Behaviors were generated via 5-shot prompting with Wizard-Vicuna-30B-Uncensored. No categorical labels are provided in the original release.
HarmBench (Mazeika et al., 2024)
A standardized red-teaming framework evaluating 18 attack methods against 33 target models. UnifiedBench includes the 200 Standard textual behaviors, spanning six of HarmBench's seven semantic categories (Copyright Violations are excluded as they belong to a separate functional split). Original categories were remapped to the unified taxonomy.
JailbreakBench (Chao et al., 2024)
A reproducibility-focused benchmark with 100 harmful behaviors across 10 semantic categories (10 per category), aligned with OpenAI usage policies. The 80 behaviors included here exclude 20 that overlap with AdvBench or HarmBench entries. JailbreakBench is the only source to include benign counterpart behaviors (not included in UnifiedBench) and a living leaderboard artifact.
License
Apache 2.0
Dataset Card Authors
Laboratório de Processamento Paralelo e Distribuído (LaPP2D) — Centro de Ciências Tecnológicas, UDESC.