license: apache-2.0
task_categories:
- text-classification
language: - en
tags: - prompt-injection
- jailbreak
- ai-security
- llm-security
size_categories: - 10K<n<100K
prompt-injection-intent
Multiclass intent of a prompt-injection / jailbreak attempt (7 classes).
Part of the Neuralchemy prompt-injection dataset family — same corpus, one label axis each.
Each row is a prompt; intent is its label; source carries provenance.
Splits
| split | rows |
|---|---|
| train | 25648 |
| validation | 3298 |
| test | 3211 |
Class distribution
intent |
train | validation | test |
|---|---|---|---|
direct_injection |
6945 | 865 | 872 |
benign |
6467 | 831 | 809 |
tool_abuse |
3213 | 435 | 407 |
indirect_injection |
2322 | 302 | 288 |
system_extraction |
2298 | 289 | 294 |
obfuscation |
2287 | 298 | 281 |
role_hijack |
2116 | 278 | 260 |
How the labels were produced
Labels were generated by a 14B open-weight model (qwen2.5:14b class) prompted to classify
each text, then cleaned (below). They are model-generated annotations, not human gold
labels — good for training and benchmarking, but treat them as such; an LLM labeler is not
perfectly consistent.
Cleaning (what makes this different from a raw dump)
- De-contradicted: any text the labeler assigned different labels to in different places
was removed, so no label is ambiguous. - De-duplicated: exact-duplicate texts collapsed to one row.
- Group-aware split: splits are assigned per unique text, so no text appears in more than
one split — verified zero train/validation/test overlap, so test metrics are not inflated.
Related
neuralchemy/prompt-injection-binary, -intent, -technique, -severity — same corpus,
different axis. neuralchemy/Prompt-injection-dataset — the original binary corpus.
Intended use & limitations
Training / evaluating prompt-injection & jailbreak classifiers and guardrails. English only.
Labels are LLM-generated. Only test systems you are authorized to test.