Cogensec Releases a 59,000-Record Corpus for Advancing Jailbreak Detection and AI System Security

As artificial intelligence systems become more capable, interconnected and autonomous, the methods used to test their security must evolve alongside them.

Many language models are still evaluated using controlled benchmarks and relatively straightforward safety prompts. Real attackers rarely operate under those conditions.

They disguise intent, encode instructions, assume fictional identities, manipulate conversation history, suppress refusal behavior and combine multiple techniques across several turns. A model that performs well against a static test suite may still fail when exposed to persistent and adaptive adversarial pressure.

To help close this gap, Cogensec has released the Jailbreak Corpus, a gated dataset containing 59,508 labeled jailbreak attempts assembled for defensive AI-security and safety research. The corpus is designed to support the development of jailbreak detectors, prompt-injection defenses, guardrails, robustness evaluations and authorized red-team testing.

The Jailbreak Corpus brings together 43,026 real seed prompts collected and deduplicated from 14 publicly available datasets. These real examples account for approximately 72% of the corpus.

The remaining 16,482 records are structured synthetic augmentations created from those real seeds. These variations apply transformations such as encoding, cipher-based obfuscation, persona framing and template-based attacks while preserving lineage back to the original prompt.

The resulting dataset contains:

• 59,508 total records
• 47,577 training records
• 5,990 validation records
• 5,941 test records
• 43,026 real seed prompts
• 16,482 synthetic variations
• 15 represented languages
• Adversarial examples associated with nine major model families

The dataset includes English-dominant content alongside prompts in German, Spanish, French, Italian, Portuguese, Dutch, Danish and other languages.

This multilingual and multi-technique structure is important because jailbreak behavior does not remain confined to a single language, model provider or attack pattern.

A jailbreak is an adversarial prompt or sequence of prompts intended to make an AI system disregard its safety policies, reveal protected information or produce content it would otherwise refuse.

These attempts can take many forms.

Some attacks explicitly instruct the model to ignore previous directions. Others hide their objective inside a fictional scenario, encode the request using a cipher, claim elevated privileges or pressure the model to suppress its normal refusal behavior.

The Cogensec Jailbreak Corpus captures techniques including:

• Hypothetical and fictional framing
• Encoding and obfuscation
• Role-play and persona manipulation
• Cipher-based attacks
• Privilege escalation
• Refusal suppression
• Prompt injection
• Multi-turn conversational attacks

Each record includes structured metadata describing the prompt, its language, relevant attack techniques, targeted harm categories, model-family provenance, source dataset and licensing information. Synthetic records also include an augmentation operation and a parent identifier connecting the variation to its original seed.

This structure allows teams to move beyond asking whether a model failed and begin examining how, where and under what adversarial conditions the failure occurred.

The corpus was created to support practical defensive work across the AI-development lifecycle.

Security teams can use it to train classifiers that identify likely jailbreak or prompt-injection attempts before they reach a model. Model developers can use the test split to compare the robustness of different safeguards. Researchers can study the distribution of attack methods across languages and model families.

Potential applications include:

• Training jailbreak and prompt-injection detectors
• Evaluating model guardrails
• Benchmarking model and agent robustness
• Studying adversarial prompt taxonomies
• Testing input-filtering systems
• Measuring defense performance across attack techniques
• Performing authorized red-team exercises
• Developing security controls for AI agents and applications

The dataset also supports research into attack lineage. Because augmented records retain a connection to their parent prompts, researchers can evaluate whether defenses remain effective when a known attack is paraphrased, encoded or reframed.

This matters because a security control that detects one exact prompt but fails against a lightly modified version is not providing meaningful protection.

A common problem in machine-learning datasets occurs when highly similar examples appear in both training and testing data.

This can cause a detector to appear more effective than it really is because the system is effectively evaluated against variations of examples it has already seen.

Cogensec addresses this through a group-aware splitting process. A real seed prompt and its synthetic variants are kept within the same train, validation or test group. They do not cross evaluation boundaries.

The corpus-building pipeline follows four primary stages:

1. Deduplicate the real seed prompts.
2. Generate controlled augmentations from unique seeds.
3. Deduplicate the combined corpus.
4. Perform a group-aware, stratified split.

This approach is intended to produce more credible evaluation results and reduce the risk of inflated detector performance.

The corpus contains adversarial prompts and associated metadata only.

It does not include model responses or harmful completions generated as a result of those prompts. This distinction reduces the amount of harmful generated content contained within the resource while preserving the attack patterns that defensive systems need to recognize.

The dataset also excludes child sexual abuse and exploitation content entirely.

Some prompts may still describe harmful intent because detecting that intent is part of the security problem. Researchers and practitioners should therefore handle the corpus using appropriate security controls, access restrictions and internal governance procedures.

The Jailbreak Corpus is publicly discoverable on Hugging Face, but access to the underlying files is gated.

Users must accept the dataset's conditions and agree that it will be used only for defensive AI-security and safety research. The responsible-use terms prohibit using the corpus to attack systems without authorization, harass individuals or generate harmful content. Access requests are logged.

Appropriate uses include testing systems owned by the researcher, evaluating authorized customer environments and developing defensive detection or mitigation technologies.

The corpus should not be treated as a toolkit for bypassing protections on third-party systems.

Responsible publication of adversarial security data requires balancing research value against misuse risk. Gated access does not eliminate that risk, but it introduces accountability while preserving access for legitimate security work.

AI-security datasets should not be presented as complete or definitive.

The current release, version 0.3, has several documented limitations.

Many technique and harm labels are based on rule-driven classification. Approximately 51% of records currently use the broad technique label "other," while approximately 92% have an unknown primary harm category. The dataset card therefore advises researchers to treat these fields as weak labels rather than verified ground truth.

The source distribution is also concentrated. WildJailbreak and SPML injection contribute a substantial portion of the real seed records. Researchers conducting balanced evaluations may need to filter or reweight records by source dataset.

Outcome information is limited as well. Most records do not indicate whether the original attack succeeded or was refused because model completions are not stored and many source datasets did not include outcome labels.

These limitations do not diminish the corpus's utility, but they should shape how results are interpreted.

A detector scoring highly on one source distribution should not automatically be assumed to perform equally well against unseen attacks, emerging techniques or production traffic.

The AI industry is moving rapidly from standalone chat interfaces toward systems that can use tools, access sensitive information, execute code, communicate with external services and make decisions with limited human supervision.

In these environments, a successful prompt injection or jailbreak can become more than an undesirable text response.

It may influence an agent's planning process, expose confidential context, manipulate tool calls, bypass operational restrictions or cause the system to act outside its intended boundaries.

Securing these systems requires more than adding a refusal message or filtering a list of prohibited phrases.

Defenders need broad adversarial datasets, repeatable evaluation procedures and tests that reflect how attacks evolve in the real world.

The Cogensec Jailbreak Corpus is intended to contribute to that shared foundation.

It gives researchers and builders a structured starting point for evaluating whether their defenses generalize across languages, model families and adversarial transformations.

The current corpus is an early release, not a finished benchmark.

Future improvements may include stronger human and model-assisted labeling, more balanced source coverage, richer multilingual representation, additional attack families and more reliable outcome annotations.

Cogensec also intends for the dataset to support broader work around AI-agent integrity, adversarial evaluation and the development of measurable assurance mechanisms for intelligent systems.

As AI capabilities expand, security evaluation must move beyond isolated examples and informal testing.

It must become systematic, reproducible and grounded in realistic adversarial behavior.

The Jailbreak Corpus is one step toward making that possible.