license: other
language:

• en
  tags:
• jailbreak
• safety
• alignment
• red-teaming
• adversarial-robustness
• llm-safety
• tool-use
  task_categories:
• text-generation
  pretty_name: "JepaData: 269K Adversarial Trajectories for LLM Safety"
  size_categories:
• 100K<n<1M
  configs:
• config_name: default
  data_files:
  • split: train
    path: pairs_chat.jsonl

JepaData: 269K Adversarial Trajectories for LLM Safety

269,453 verified adversarial prompt–response trajectories for training and
evaluating jailbreak-resistant language models. JepaData spans eight attack
families and includes both harmful behaviors and benign prompts selected to
measure over-refusal.

The dataset was built as part of the large-scale adversarial data pipeline for
JEPA-Align and includes per-example attack, model, source, and transferability
provenance.

Dataset at a glance

Attack distribution

How it was generated

For each source behavior, the pipeline:

1. generates an adversarial view using a deterministic transformation or an
   attacker language model;
2. sends that view to a target model and records the complete rollout;
3. evaluates whether the attack transfers with a stock Qwen3-32B verifier; and
4. retains trajectories meeting the transferability threshold.

The attacker model for model-generated transformations is
huihui-ai/Qwen3-32B-abliterated. Target rollouts come from that model and
Qwen/Qwen3-32B; the exact source is recorded per example in
metadata.generated_with_model and metadata.transfer_target.

Source behaviors

HarmBench is excluded from training and reserved for evaluation.

Load the dataset

from datasets import load_dataset

dataset = load_dataset("memo-ozdincer/jepadata", split="train")
print(dataset[0])

Each row contains chat-formatted messages plus provenance fields describing
the source behavior, attack family, generating model, target model, and
transferability score. See DATA_SCHEMA.md for the complete
field reference.

Files

Intended use

• Training defenses against adversarially reframed harmful requests
• Training and evaluating jailbreak-detection models
• Studying attack transfer across model and prompt families
• Measuring safety–utility and over-refusal tradeoffs
• Constructing held-out red-team evaluations

This dataset contains successful jailbreaks and harmful model outputs. It is
intended for defensive safety research and should not be used to enable attacks
against deployed systems.

Data quality and provenance

• Every retained record passes the dataset's transferability gate.
• Early trajectories use the abliterated Qwen3-32B model as both generator and
  target; later trajectories use stock Qwen3-32B as the target. Use the
  per-record provenance fields when selecting a specific target distribution.
• 435 benign rows overlap with OR-Bench-Test. Exclude them before evaluating on
  that benchmark to prevent train–test overlap.
• Attack families are intentionally imbalanced because successful transfer
  rates differ substantially across attacks.

Example OR-Bench filtering:

from datasets import load_dataset

test_prompts = set(
    load_dataset("bench-llm/or-bench", "or-bench-test", split="train")["prompt"]
)
dataset = load_dataset("memo-ozdincer/jepadata", split="train")
dataset = dataset.filter(lambda row: row["behavior_text"] not in test_prompts)

Related artifacts

• JEPA-Align: Qwen3-32B Safety Defense Matrix
• Memo Ozdincer's research portfolio

Citation

@misc{ozdincer2026jepadata,
  title        = {JepaData: 269K Adversarial Trajectories for LLM Safety},
  author       = {Ozdincer, Memo},
  year         = {2026},
  howpublished = {Hugging Face Dataset},
  url          = {https://huggingface.co/datasets/memo-ozdincer/jepadata}
}