pretty_name: AdvPIIBench
license: cc-by-4.0
language:

• en
  language_creators:
• machine-generated
  annotations_creators:
• machine-generated
  multilinguality:
• monolingual
  source_datasets:
• original
  task_categories:
• token-classification
  task_ids:
• named-entity-recognition
  tags:
• pii
• privacy
• adversarial-robustness
• red-teaming
• llm-security
• prompt-injection
  size_categories:
• 100K<n<1M
  configs:
• config_name: default
  data_files:
  • split: train
    path: data/train-*.parquet
    dataset_info:
    features:
  • name: uid
    dtype: int32
  • name: input_id
    dtype: int32
  • name: category
    dtype: string
  • name: attack_target
    struct:
    • name: pii
      sequence: string
    • name: context
      sequence: string
  • name: llm_input
    dtype: string
  • name: pii_spans
    list:
    • name: type
      dtype: string
    • name: start
      dtype: int32
    • name: end
      dtype: int32
    • name: value
      dtype: string
    • name: value_fuzzy
      dtype: string
      splits:
  • name: train
    num_examples: 104728

Dataset Card for AdvPIIBench

A benchmark of 104,728 synthetic-but-realistic user prompts for measuring how PII detection
degrades under inference-time adversarial attack. Every prompt carries character-accurate span
labels, so the same corpus supports both document-level (was anything flagged?) and span-level
(was the right text flagged?) evaluation.

All PII in this dataset is synthetic. Identifiers are generated by Faker via Microsoft
Presidio; no value refers to a real person. See
Personal and sensitive information.

Dataset details

• Curated by: Roei Arpaly and Yoni Birman, Reichman University
• Language: English
• License: CC BY 4.0 — reuse and adaptation
  permitted with attribution. The generation and evaluation code is separately MIT-licensed.
• Repository (generation + evaluation pipeline):
  RoeiArpaly/llms-pii-leakage
• Presented at: 35th USENIX Security Symposium, Baltimore, 12–14 August 2026 (poster)

Uses

Direct use

Benchmarking PII detectors under adversarial conditions: measuring recall degradation across
attack families, comparing detector classes (rule-based, transformer NER, guard SLMs, LLMs),
measuring false positives against hard negatives, and developing or validating mitigations. The
attack taxonomy is published in full so detector authors can test against it.

Out-of-scope use

Not a source of PII — every identifier is synthetic, so it supports no entity-resolution,
enrichment, or identity-linkage task. The attack templates are published for building defenses;
using them to degrade PII protection on systems you are not authorized to test is out of scope.
Results here also do not transfer to production without care: the corpus is English-only,
single-turn, and covers five identifier types.

Loading

from datasets import load_dataset

ds = load_dataset("roei-ar/AdvPIIBench", split="train")

# Offsets index the text exactly as stored — true for every labelled row.
row = next(r for r in ds if r["pii_spans"])
for span in row["pii_spans"]:
    assert row["llm_input"][span["start"]:span["end"]] == (span["value_fuzzy"] or span["value"])

Schema

Offsets index Python string positions (Unicode code points), not bytes. value_fuzzy is null
for the 1,703 spans that were never PII-level attacked, so slice against value_fuzzy or value —
that identity holds exactly for all 114,101 spans.

Composition

104,728 rows · 114,101 labeled spans.

Positives by attack stage:

PII types — credit_card_number (25,460), phone_number (25,460), iban (24,656),
email (24,120), ssn (14,405).

PII-level attacks (13,288 rows each) — homoglyph, chunking, emojify, char_to_word,
invisible_chars, separators.

Content-level attacks — applied as 10 fixed combinations of 7,248 rows each, always on top of
supportive_context. A label's row count is therefore 7,248 × the number of combinations it
appears in.

These labels match the generation pipeline exactly.

Dataset creation

Curation rationale

Existing synthetic PII corpora provide clean text with span annotations, but none combine
adversarial transformations with hard-negative lookalikes — both of which are needed to measure
whether a detector degrades gracefully. Building the corpus synthetically is what makes exact
span labels possible: the identifier is injected at a known offset, and every transformation
tracks that offset, so ground truth is correct by construction rather than by annotation.

Source data

Prompts are generated by an LLM (gpt-4o-mini) from templated combinations of topic, tone,
length, opener, and scenario, targeting the distribution of everyday assistant traffic — short
questions dominate. No text is scraped or collected from real users, so there are no source-data
producers to describe and no consent or scraping concerns.

Annotations

There is no human annotation step. Identifiers come from Faker via
presidio-evaluator's PresidioSentenceFaker and are injected into generated prompts at
recorded offsets. Each adversarial transformation rewrites the text and recomputes the affected
offsets, so pii_spans stays exact through the attack chain — the released file is verified so
that text[start:end] == (value_fuzzy or value) holds for all 114,101 spans. Hard negatives are
generated separately from a list of PII-shaped formats (tracking numbers, invoice numbers,
ETags, UUIDs, hashes, MAC addresses, malformed IBANs) and carry no spans.

Personal and sensitive information

The corpus contains no real personal data. Every credit card, IBAN, SSN, phone number and
email address is synthetic, drawn from Faker's generators. Values are well-formed — cards
satisfy Luhn, IBANs satisfy their check digits — because a detector must be exercised against
realistic input, but they are not issued to anyone. Prompts are model-generated rather than
collected, so no user's text appears here.

Bias, risks, and limitations

Intended for defensive research. The attack taxonomy is published so detector authors can
test against it, which necessarily also documents evasion techniques; the tradeoff is deliberate
and matches standard practice in security benchmarks.

• Only the attacked identifier is labeled. Some templates embed exemplar identifier-shaped
  strings as part of the payload — most visibly pi_few_shot_safe, whose few-shot block cites
  three "already judged safe" values. These are deliberately malformed (failing Luhn or format
  validation) and are intentionally absent from pii_spans. Unlabeled identifier-shaped text is
  expected, not a gap in the annotations.

• The exemplars defeat pattern matchers, not neural ones. Malforming a value stops a regex
  but not a model that reads shape and context: Presidio returns nothing on the
  pi_few_shot_safe block, while GLiNER still tags the spaced test @ mail.com as an email.
  On those 14,496 rows (13.8%) a neural detector can therefore emit a span without finding
  the attacked value at all. If you score document-level (any span = blocked) that counts as a
  spurious success, and if you score span-level it counts as a false positive. Exclude
  pi_few_shot_safe rows from precision, or require the predicted span to overlap a labeled
  one. The same caution applies to any detector that generalizes beyond exact format.

• ⚠️ Do not Unicode-normalize this corpus — it silently corrupts the labels. The
  invisible_chars attack works two ways: zero-width and format characters (U+FEFF,
  U+200B–U+200D, U+2060, U+00AD) in 8,327 rows, and combining diacritical marks (U+0301,
  U+0304, U+0327, …) in 18,260 rows. Normalizing composes or decomposes those marks, which
  changes string length, and every start/end in the row still points at the old positions:

  Form	Rows altered	Rows whose span offsets break
  NFC	3,344	3,344
  NFD	3,452	3,443
  NFKC	39,309	21,989
  NFKD	39,137	22,088

  NFKC — a routine step in many tokenizers and text pipelines — silently invalidates the ground
  truth on 21% of the corpus. Nothing raises; the spans simply point at the wrong characters.
  Load the text verbatim, and if a component normalizes internally, normalize a copy and keep
  the offsets against the original. Stripping the characters instead destroys the attack and
  inflates detector scores. This is also why the corpus ships as Parquet rather than CSV.

• 1,098 rows share an identical llm_input with another row. These are distinct rows with
  distinct uids whose different attack configurations converged on the same output string —
  not accidental duplicates.

• Scope. English only; five PII types; prompts are LLM-generated and reflect that
  distribution rather than sampled production traffic; the attack set is inference-time and
  text-only, and does not cover multimodal or multi-turn agentic surfaces.

Citation

A full paper describing the benchmark is forthcoming; this card will be updated with that
citation once it appears. Until then, cite the dataset:

@misc{arpaly2026advpiibench,
  title        = {AdvPIIBench: The Adversarial Collapse of PII Detection in LLM Interactions},
  author       = {Arpaly, Roei and Birman, Yoni},
  year         = {2026},
  publisher    = {Hugging Face},
  howpublished = {\url{https://huggingface.co/datasets/roei-ar/AdvPIIBench}},
  note         = {Dataset. Presented as a poster at the 35th USENIX Security Symposium}
}

Dataset card contact

Roei Arpaly — RoeiArpaly/llms-pii-leakage
(open an issue for corrections or questions about the corpus).