license: other
license_name: mixed-per-source-and-cc-by-4.0
task_categories:

• text-classification
  language:
• "en"
• "de"
• "es"
• "fr"
• "it"
• "sv"
• "nl"
• "pt"
• "hi"
• "ja"
• "vi"
• "th"
• "zh"
• "ko"
• "ca"
• "mr"
• "ro"
• "af"
• "da"
• "id"
• "no"
• "et"
• "km"
• "cy"
• "hr"
• "ru"
• "tr"
• "tl"
• "ne"
• "fi"
• "hu"
• "lt"
  tags:
• prompt-injection
• jailbreak
• pii-detection
• llm-security
• guardrails
• prompt-safety
• adversarial-prompts
• multilingual
  pretty_name: Quickium Prompt Security v0
  size_categories:
• 100K<n<1M
  configs:
• config_name: default
  data_files:
  • split: train
    path: train.parquet
  • split: train_nc
    path: train_nc.parquet

Quickium Prompt Security v0

A multilingual corpus for prompt-security classification — prompt injection, jailbreak, and
PII exposure — curated and published by Quickium. 365,024 prompts from 12 public datasets,
normalized to a single schema with a binary safety label and a domain tag, partitioned into
two splits by license posture:

Safe by default: load_dataset(..., split="train") never returns non-commercial material.
The train_nc split is an explicit opt-in for research use.

No model-generated labels. Every label derives from the origin dataset's own annotations
or construction (e.g. a corpus of collected attack prompts is unsafe by construction) — there is
no teacher LLM anywhere in the pipeline.

What this is (and isn't)

• It is a training corpus for input-side guardrail classifiers: binary safe/unsafe over user
  prompts, with a domain tag (prompt injection / jailbreak / PII / benign) usable for routing,
  filtering, or multi-task training.
• It isn't a benchmark. There is no eval split, and rows here should not be held out as one:
  the corpus was deduplicated by exact text hash only, so near-duplicates remain — random
  holdouts will leak. A gold benchmark is a possible follow-up release.
• Scope: prompt-level input security (injection, jailbreak, PII). General toxicity /
  content-moderation classification is out of scope (separate work).

Schema

One row per prompt, both splits. Six columns:

domain semantics — the axis the row informs, not a verdict (label is the verdict):

domain and label are orthogonal — domain is the classification axis a row contributes
to; label is the verdict. That's why safe rows exist under PI: labeled injection-detection
corpora (deepset, octavio, spml) ship both classes, and their benign rows are the paired
negatives of the PI axis — drawn from the same distribution as the attacks, they teach a
classifier injection-ness rather than dataset style. Two real rows make the contrast:

The schema also allows sorted +-compounds within {JB, PI, PII} (e.g. JB+PI) — no
compound rows exist in v0, but consumers should parse defensively.

Composition

Per-source license drives redistribution (see Licensing). Counts are from the
released parquets.

train split — commercial-clean (71,117 rows)

train_nc split — research-only (293,907 rows)

Balance

Computed from the released parquets.

Label × domain:

Languages — train is genuinely multilingual (32 languages, 52.1% English); train_nc is
100% English:

Usage

from datasets import load_dataset, concatenate_datasets

# Commercial-clean subset — safe default for any use, including commercial training
train = load_dataset("quickium/prompt-security-v0", split="train")

# Research-only NC material (CC BY-NC) — explicit opt-in
research = load_dataset("quickium/prompt-security-v0", split="train_nc")
full = concatenate_datasets([train, research])  # research contexts only

# per-axis views
injections = train.filter(lambda r: r["domain"] == "PI")

# if your license policy also excludes copyleft data, drop the GPL-3.0 slice:
no_copyleft = train.filter(lambda r: r["source"] != "octavio_pi_multilingual")

Limitations

• The commercial-clean JB axis is vestigial — 4 rows (gptfuzzer). Jailbreak training signal
  lives almost entirely in train_nc, which is research-only. Commercial consumers needing JB
  coverage must source it elsewhere.
• train_nc is one generation pipeline — wildjailbreak (83% of the split) is fully
  synthetic; the split largely reflects one distribution.
• Labels are inherited, not re-annotated. Each source's own annotations (or its
  by-construction character) define label; upstream annotation quality and biases carry over.
• Exact-hash dedup only. Cross-source near-duplicates (paraphrases, template variants)
  remain. Do not create random holdouts from this corpus and treat them as clean eval.
• No over-defense benchmark inside. The 339 NotInject rows are a training-side hard-negative
  slice, not a controlled FPR benchmark.
• language is partly auto-detected (per-row detection on multilingual sources; card-mapped
  constants on English-only ones). Short prompts can be mistagged.
• gptfuzzer is vestigial (4 rows survive deduplication) — kept for provenance honesty
  rather than signal.

Licensing

This dataset is a compilation of independently-licensed sources, partitioned into splits by
license posture. Two layers apply:

1. Each row keeps the license of its origin dataset — identified by the source column
   (tables above). train: 8 permissive sources (MIT / Apache 2.0), 1 GPL-3.0, 1 ODC-BY 1.0.
   train_nc: 2 sources under CC BY-NC (see below).
2. Quickium's contribution — the unified schema, normalization, per-row language tagging,
   and domain mapping (© Quickium) — is released under CC BY 4.0.

Non-commercial split — train_nc. On 2026-07-10 the WildJailbreak / WildGuardMix authors
informed us these artifacts are intended for non-commercial use and are adopting a
CC BY-NC license; this split is labeled accordingly (© Allen Institute for AI, with
attribution). Do not use train_nc for commercial purposes — including training models
for commercial products. We will mirror the updated license metadata on the upstream Hub
repos verbatim once it is published. The train split contains none of this material.

Copyleft notice — octavio_pi_multilingual rows (train split). Rows with
source = "octavio_pi_multilingual" originate from a GPL-3.0-licensed dataset (bundled here
as LICENSE-gpl-3.0.txt). GPL-3.0 terms travel with those rows: derivative datasets or
bundles that include this slice must remain GPL-3.0-compatible. Consumers who need to avoid
copyleft obligations can filter these rows out by the source column (snippet above).

ODC-BY source (CoCoNot — © Allen Institute for AI, train split): redistributed under the
Open Data Commons Attribution License v1.0,
with attribution. ODC-BY licenses the database; under its subsequent-parts clause, rights in
the underlying contents remain with their respective holders.

The Hub license field is other because no single identifier captures the layers; this
section is the authority.

Sources & citations

Cite this dataset as: Quickium, Prompt Security v0, 2026.

Canonical references for each source (links are the authoritative redistribution point).

• WildJailbreak — Jiang et al. (Allen Institute for AI) — https://huggingface.co/datasets/allenai/wildjailbreak
• WildGuardMix — Han et al. (Allen Institute for AI) — https://huggingface.co/datasets/allenai/wildguardmix
• Gretel synthetic PII (finance, multilingual) — Gretel.ai — https://huggingface.co/datasets/gretelai/synthetic_pii_finance_multilingual
• SPML Chatbot Prompt Injection — Sharma et al. — https://huggingface.co/datasets/reshabhs/SPML_Chatbot_Prompt_Injection
• CoCoNot — Brahman et al. (Allen Institute for AI) — https://huggingface.co/datasets/allenai/coconot
• Prompt Injection Attack Detection Multilingual — Octavio Santana (compilation of https://huggingface.co/datasets/PromptInjectionDataset/Injection-Attack-Detection-Dataset and https://huggingface.co/datasets/rikka-snow/prompt-injection-multilingual) — https://huggingface.co/datasets/Octavio-Santana/prompt-injection-attack-detection-multilingual
• Gandalf — Ignore Instructions — Lakera AI — https://huggingface.co/datasets/Lakera/gandalf_ignore_instructions
• Gandalf — Summarization — Lakera AI — https://huggingface.co/datasets/Lakera/gandalf_summarization
• Prompt Injections (multilingual) — Yanis Miraoui — https://huggingface.co/datasets/yanismiraoui/prompt_injections
• Prompt Injections — deepset — https://huggingface.co/datasets/deepset/prompt-injections
• NotInject — Li et al. (InjecGuard) — https://huggingface.co/datasets/leolee99/NotInject
• GPTFuzzer — Yu et al. — https://github.com/sherdencooper/GPTFuzz

Verbatim BibTeX for each source can be added on request; the links above are the canonical
citation and attribution targets.