license: apache-2.0
task_categories:
- text-classification
language: - en
tags: - prompt-injection
- jailbreak
- ai-security
- llm-security
size_categories: - 10K<n<100K
prompt-injection-severity
Severity of a prompt-injection attempt, labeled 1-3 (higher = more severe).
Part of the Neuralchemy prompt-injection dataset family — same corpus, one label axis each.
Each row is a prompt; severity is its label; source carries provenance.
Splits
| split | rows |
|---|---|
| train | 25648 |
| validation | 3298 |
| test | 3211 |
Class distribution
severity |
train | validation | test |
|---|---|---|---|
1 |
15053 | 1942 | 1891 |
3 |
6535 | 829 | 793 |
2 |
4060 | 527 | 527 |
How the labels were produced
Labels were generated by a 14B open-weight model (qwen2.5:14b class) prompted to classify
each text, then cleaned (below). They are model-generated annotations, not human gold
labels — good for training and benchmarking, but treat them as such; an LLM labeler is not
perfectly consistent.
Cleaning (what makes this different from a raw dump)
- De-contradicted: any text the labeler assigned different labels to in different places
was removed, so no label is ambiguous. - De-duplicated: exact-duplicate texts collapsed to one row.
- Group-aware split: splits are assigned per unique text, so no text appears in more than
one split — verified zero train/validation/test overlap, so test metrics are not inflated.
Related
neuralchemy/prompt-injection-binary, -intent, -technique, -severity — same corpus,
different axis. neuralchemy/Prompt-injection-dataset — the original binary corpus.
Intended use & limitations
Training / evaluating prompt-injection & jailbreak classifiers and guardrails. English only.
Labels are LLM-generated. Only test systems you are authorized to test.