GitHub上的LLM越狱提示词数据集
越狱提示词集在GitHub上公开，是红队测试的必需品。
LLM Jailbreak Prompts on GitHub: The Datasets Security Teams Actually Use
Jailbreak prompts - inputs designed to bypass an LLM's safety alignment - are openly shared on GitHub. This is not a gray-market secret: they are standard red-teaming material, the same way penetration-testing tools are public. Here are the datasets security teams actually use in 2026.
The Standard Datasets
1. jailbreakhub / JailbreakBench (JBB). The academic benchmark. Contains 100+ curated jailbreaks with standardized success metrics. Used in published research to compare model safety across versions.
2. LLM-Attacks / jailbreaks. Collections of classic techniques: DAN (Do Anything Now), role-play escapes, encoding obfuscation, and multilingual bypasses.
3. Robust Intelligence / algorithmic-jailbreaks. Adversarial-suffix attacks - automated, not hand-written. Produced the famous "universal adversarial suffixes" that worked across models.
4. Center for AI Safety (CAIS) datasets. Safety-focused collections, including refusal benchmarks used to measure how often models comply with harmful requests.
5. Various "prompt-injection" repos. While different from jailbreaks, injection payloads (ignore previous instructions, system prompt extraction) are often hosted alongside.
Why Security Teams Use Them
- Regression testing: every model update should be re-tested against the same set
- Benchmarking vendors: compare Claude vs GPT vs Llama safety before adoption
- Building defenses: train classifiers on known attack patterns
- Compliance: many enterprise AI policies require documented red teaming
How to Use Them Responsibly
- Test only against models you own or have permission to test
- Never use jailbreaks to produce real harmful content
- Store the test set internally; do not amplify attack payloads
- Pair with automated scoring (did the model comply? yes/no)
FAQ
Is it legal to download jailbreak prompts? The prompts themselves are research artifacts; using them to generate harmful content is what creates liability. Treat them as test data.
Do modern models still fail these? Yes - each new model fixes old jailbreaks but new techniques emerge; the cat-and-mouse continues. GPT-5-class and Claude 4-class models resist classic DAN-style prompts but still fail against novel automated attacks.
Jailbreak vs prompt injection again? Jailbreaks target the model's alignment; injection targets the app's instructions. Both belong in your test set.
