license: apache-2.0
task_categories:
- text-classification
language: - en
tags: - prompt-injection
- jailbreak
- ai-security
- llm-security
size_categories: - 10K<n<100K
prompt-injection-technique
The technique a prompt-injection attempt uses (8 classes).
Part of the Neuralchemy prompt-injection dataset family — same corpus, one label axis each.
Each row is a prompt; technique is its label; source carries provenance.
Splits
| split | rows |
|---|---|
| train | 25648 |
| validation | 3298 |
| test | 3211 |
Class distribution
technique |
train | validation | test |
|---|---|---|---|
none |
10479 | 1341 | 1306 |
keyword_override |
5525 | 705 | 696 |
encoding |
3383 | 424 | 427 |
context_overflow |
2286 | 297 | 269 |
persona_play |
1856 | 240 | 233 |
payload_splitting |
737 | 104 | 99 |
multilingual |
715 | 85 | 92 |
few_shot_poisoning |
667 | 102 | 89 |
How the labels were produced
Labels were generated by a 14B open-weight model (qwen2.5:14b class) prompted to classify
each text, then cleaned (below). They are model-generated annotations, not human gold
labels — good for training and benchmarking, but treat them as such; an LLM labeler is not
perfectly consistent.
Cleaning (what makes this different from a raw dump)
- De-contradicted: any text the labeler assigned different labels to in different places
was removed, so no label is ambiguous. - De-duplicated: exact-duplicate texts collapsed to one row.
- Group-aware split: splits are assigned per unique text, so no text appears in more than
one split — verified zero train/validation/test overlap, so test metrics are not inflated.
Related
neuralchemy/prompt-injection-binary, -intent, -technique, -severity — same corpus,
different axis. neuralchemy/Prompt-injection-dataset — the original binary corpus.
Intended use & limitations
Training / evaluating prompt-injection & jailbreak classifiers and guardrails. English only.
Labels are LLM-generated. Only test systems you are authorized to test.