Bordair Multimodal Prompt Injection Dataset

61,875 labeled samples (38,117 attack + 23,758 benign) across two dataset versions covering cross-modal, multi-turn, adversarial suffix, and jailbreak template attacks on AI systems.

Built for training and evaluating prompt injection detectors. All samples are labeled (expected_detection: true/false), source-attributed to peer-reviewed papers or documented industry research, and structured for direct use in binary classifiers.

Dataset Versions

v1: Cross-Modal Attack Payloads (23,759 attacks + 23,759 benign)

13 base injection categories × cross-modal delivery methods × document types × split strategies. Every attack spans two or more input modalities.

v1 Attack Payload Counts

v1 Attack Categories

v1 Cross-Modal Split Strategies

v1 Image Delivery Methods

v1 Benign Dataset (23,759 prompts — 1:1 with attacks)

All benign prompts are multimodal, matching the exact modality distribution of attack payloads for a pure 50/50 split.

Edge cases cover: .gitignore config, CSS override, heart bypass surgery, iPhone jailbreaking, life hacks, password managers, OWASP/XSS discussions — words that appear in attacks but in entirely benign contexts.

v2: PyRIT + nanoGCG Dataset (14,358 attacks)

Generated via generate_v2_pyrit.py using PyRIT v0.12.1 (Microsoft) and nanoGCG v0.3.0. Covers single-turn jailbreak templates, multi-turn orchestration attacks, encoding obfuscation, GCG adversarial suffixes, and ensemble combinations.

v2 Attack Counts by Method

v2: PyRIT Jailbreak Templates (8,100 payloads)

PyRIT ships 162 single-parameter jailbreak templates ({{ prompt }}) spanning every known jailbreak family. Each template is filled with 50 representative injection seeds.

Template families included:

Sources: PyRIT v0.12.1, Pliny (@elder_plinius), Arth Singh, Alex Albert (jailbreakchat), community contributors.

v2: Encoding Obfuscation (1,932 payloads)

13 converters applied to all 138 injection seeds. Encoding attacks exploit the gap between what safety training covers and what novel token encodings look like.

Source: Wei et al. NeurIPS 2023 arXiv:2307.02483 — Jailbroken: How Does LLM Safety Training Fail?

v2: Multi-Turn Orchestration (118 payloads)

Multi-turn attacks exploit conversational context buildup — the model becomes progressively more compliant as context normalizes harmful topics. Multi-turn approaches achieve 1.5–3x higher ASR than single-shot templates.

Crescendo (70 payloads — 10 patterns × 6 turns + full transcripts)

Source: Russinovich, Salem, Eldan — arXiv:2404.01833, Microsoft 2024
ASR: ~29% on GPT-4; significantly higher on less-defended models

Gradual escalation: each turn builds plausible context for the next, progressively steering toward the injection goal.

Each turn within a conversation is stored as a separate sample (turn 1 through final turn) plus a full transcript entry. Turn 1 attacks are often subtle questions that look benign in isolation — the detector must recognize the injection intent from any turn.

PAIR — Prompt Automatic Iterative Refinement (12 payloads)

Source: Chao, Robey, Dobriban, Hassani, Pappas, Wong — arXiv:2310.08419, ICLR 2023
ASR: Jailbreaks GPT-4/Claude in fewer than 20 queries