gandalf_ignore_instructions

This is a dataset of prompt injections from Gandalf by Lakera.

Note that we might update the dataset occasionally by cleaning the data or adding more samples.

How the data was obtained

There are millions of prompts and many of them are not actual prompt injections (people ask Gandalf all kinds of things).

We used the following process to obtain relevant data:

• Start with all prompts submitted to Gandalf in July 2023.
• Use OpenAI text embeddings (text-embedding-ada-002) to compute the similarity between the prompts and the phrase "Ignore all previous instructions".
• Filter to those prompts that have similarity of at least 0.825.
• Use Lakera Guard's personally identifiable information detector to filter out prompts that potentially contain PII data.
• Remove near-duplicates from the data (prompts that differ only by a few letters) using an approximate algorithm. This helps reduce leakage between the data splits.
• Sample 1000 prompts.
• Split the data into train-val-test with an 80/10/10 ratio. Each sample is assigned independently so the size of the train split is not exactly 80% and so on.

Note that there is a small amount of noise in the data since an automatic method was used to obtain it: a few of the samples might not be real prompt injections.

Citation

If you use this dataset in your research, please cite our paper introducing the game Gandalf the Red: Adaptive Security for LLMs:

@article{gandalf_paper,
  title={Gandalf the Red: Adaptive Security for LLMs},
  author={Pfister, Niklas and Volhejn, V{\'a}clav and Knott, Manuel and Arias, Santiago and Bazi{\'n}ska, Julia and Bichurin, Mykhailo and Commike, Alan and Darling, Janet and Dienes, Peter and Fiedler, Matthew and others},
  journal={arXiv preprint arXiv:2501.07927},
  year={2025}
}

Licensing Information

gandalf_ignore_instructions is distributed under the MIT License.