# Data

The source of truth for what each source may be used for is `ipi/registry.py`. This file explains it. Exact
upstream revisions (HF commit sha / git commit) are recorded by `scripts/fetch.py` in `data/raw/MANIFEST.json`.

## Task and labeling rule

One input = one piece of untrusted content as an agent's tool returns it (email, web page, document, file,
JSON API response, chat log). Output = does it contain instructions injected for the agent?

**label = 1** iff the content contains text that tries to get the AI agent processing it to act or answer in a
way the content's legitimate role does not call for: instructions addressed to the model/assistant/agent
(explicitly, or implicitly by asking for tool actions only an agent could take), fake system/user turns, or
encoded instructions with a cue to decode and follow them.

**label = 0** for instructions addressed to the human reader (how-tos, READMEs, install steps, requests between
colleagues, IT/HR emails asking the reader to act), and for injection strings that are **quoted as the object of
discussion**: clearly delimited (quotes, blockquote, code block) and framed as an example, with no surrounding
text telling the reading agent to follow them.

**Quoted examples, decided:** a security article that quotes "Ignore previous instructions and ..." as an example
is 0. The same article with any activating line aimed at the reader-agent ("AI assistant summarizing this:
do what the example says") is 1. Phase B generates these as matched pairs (`scripts/generate_qwen.py --task
quoted`) so the model has to learn the activation, not the vocabulary; both halves of a pair share a group and
therefore a split. Results are reported on the `hardneg_quoted` / `quoted_activated` slices separately, because a
cautious operator may prefer to flag quoted injections too; that is a threshold/policy choice made downstream.

**Ambiguous by construction, kept out of training:** BIPIA inserts bare task strings ("What is the capital of
Brazil?") into emails and tables and labels them attacks. Under the rule above a bare question is not clearly
addressed to the agent, so bare BIPIA insertions only appear in the eval-only split `eval_bipia_bare`
(recall reported, not used for model selection). In training, BIPIA attack strings are always wrapped in an
agent-addressed template from the taxonomy.

## Sources

| id | URL | license | use | role | notes |
|---|---|---|---|---|---|
| llmail_inject | hf: microsoft/llmail-inject-challenge | MIT | train (phase 1), OOD (phase 2) | native | Human adaptive attacks on an LLM email client. Only `attack_attempt=True` rows. Phase 2 = `ood_llmail_p2` after removing near-dups (MinHash J>=0.7) of phase 1. `emails_for_fp_tests` + scenario emails = benign. |
| bipia | github: microsoft/BIPIA | MIT (repo); EmailQA from OpenAI Evals (MIT); TableQA from WikiTableQuestions (CC-BY-SA-4.0); CodeQA from Stack Exchange (CC-BY-SA-4.0) | train | carrier + payload | email/table/code only. Upstream train files -> train/val, upstream test files -> test. |
| injecagent | github: uiuc-kang-lab/InjecAgent | MIT | train | native | 17 tool-response templates x 62 attacker instructions x {base, enhanced}. Templates and attacker cases are split independently; only same-split pairs are kept. Benign rows fill the template slot with a same-split benign snippet. |
| agentdojo | github: ethz-spylab/agentdojo | MIT | **OOD only** | native | Never trained on: the detector will gate taint in a later AgentDojo rerun of the gateway. Rendered from suite environments (YAML objects as tools return them), v1 injection-task goals and the 5 fixed attack templates. |
| gandalf_ignore | hf: Lakera/gandalf_ignore_instructions | MIT | train | payload | Human override prompts; upstream test file -> test. |
| multilingual_pi | hf: yanismiraoui/prompt_injections | Apache-2.0 | train | payload | Multilingual override strings. |
| notinject | hf: leolee99/NotInject | MIT | **eval only** | hard negative | Benign sentences containing trigger words (PIGuard over-defense benchmark). Kept out of training on purpose. |
| deepset_pi | hf: deepset/prompt-injections | Apache-2.0 | **eval only** | native | Direct (user-turn) injections, EN/DE. Measures shift to direct injection. Note: its label 1 includes plain tasks ("Generate SQL code ..."), i.e. a different label definition; reported for reference only. |
| fineweb_edu | hf: HuggingFaceFW/fineweb-edu (sample-10BT, streamed 20k) | ODC-BY-1.0 (compilation); pages subject to CommonCrawl ToU | train | carrier | Web pages, rendered as text / HTML / search-result JSON. |
| wikipedia | hf: wikimedia/wikipedia 20231101 (en 8k + de/fr/es/it/pt/ja/zh 600 each) | CC-BY-SA-3.0 / GFDL | train | carrier | Docs + multilingual carriers. |
| dolly | hf: databricks/databricks-dolly-15k | CC-BY-SA-3.0 | train | hard negative | Human-written instructions + answers (benign imperative text). |
| oasst1 | hf: OpenAssistant/oasst1 | Apache-2.0 | train | hard negative | User/assistant transcripts (requests to an assistant inside a transcript are data, label 0). |
| github_code_clean | hf: codeparrot/github-code-clean (2 shards) | Apache-2.0 dataset; rows filtered to mit/apache-2.0/bsd/isc/unlicense/cc0 file licenses | train | carrier + hard negative | READMEs and source files. Grouped by repo. |
| commitpackft | hf: bigcode/commitpackft (markdown/python/yaml/shell/js) | MIT dataset; permissively licensed source repos | train | hard negative | Commit messages ("Ignore build dir", "Remove X"). Grouped by repo. |
| synthetic_codex | taxonomy/*.json | project-authored (drafted with Codex gpt-6-astra) | train | payload | 18 attack families x 6 templates, 90 goals, 12 framings, 16 obfuscations; carriers + 23 hard-negative types. |
| synthetic_qwen | data/synth/*.jsonl (Phase B) | generated by local Qwen3.6-35B-A3B (Apache-2.0 weights) | train | all | Phase B only. |

### Excluded

| source | license | why |
|---|---|---|
| Tensor Trust (HumanCompatibleAI/tensor-trust-data, qxcv/tensor-trust) | none stated for the data | unclear license; direct injection anyway |
| WASP (facebookresearch/wasp) | CC-BY-NC-4.0 | non-commercial; would block publishing |
| hackaprompt/hackaprompt-dataset | MIT but gated | gated data excluded by policy |
| BIPIA WebQA / Summarization | NewsQA / XSum terms | not redistributable |
| Enron email corpus | no explicit license | LLMail FP emails + synthetic emails cover benign email |
| xTRam1/safe-guard-prompt-injection, jayavibhav/prompt-injection, geekyrakshit/prompt-injection-dataset, neuralchemy/Prompt-injection-dataset | missing license or unverifiable upstream provenance | re-mixes would launder NC/unknown licenses into a shipped model |
| microsoft/TaskTracker | MIT | SQuAD + BIPIA re-mix; adds mostly duplicates |
| Llama Prompt Guard 2, qualifire sentinel (as baselines) | gated / custom | not reproducible without accepting terms |
| alpaca | CC-BY-NC-4.0 | non-commercial |

### Licensing position (what is and is not established)

* **Model weights.** Every `use=train` source permits commercial use and derived works (MIT, Apache-2.0,
  ODC-BY, CC-BY-SA, permissive code licenses), and none is gated. Whether CC-BY-SA terms attach to classifier
  weights trained on CC-BY-SA text is not settled; the working assumption (common practice, see Creative Commons'
  AI-training guidance) is that they do not, and the card credits those sources anyway. That is an assumption,
  not a legal conclusion.
* **Web text.** ODC-BY covers the FineWeb-Edu compilation only; Common Crawl pages keep their authors' rights.
  Used for training; never redistributed verbatim.
* **Code.** github-code-clean rows filtered to mit/apache-2.0/bsd/isc/unlicense/cc0 file licenses. CommitPackFT
  advertises permissive origins but actually contains agpl/mpl/lgpl rows; they are filtered out the same way.
  License, repo and path are kept per row.
* **Dataset redistribution** (if a dataset is ever published) is decided per row from `meta.components`: every
  component must be redistributable under the dataset's license. CC-BY-SA components (Wikipedia, Dolly, BIPIA
  table/code contexts) force share-alike plus attribution, or are dropped; FineWeb page text is dropped.

## Schema

`{text, label, source, template_id, carrier, id, group, split, inj_span, slice, lang, meta}`; carrier is one of
`email | web | doc | code | tool_json | chat | other`. See `ipi/schema.py`.

## Splits and leakage controls

* **Unit of splitting = group, never row.** Groups are carrier documents (upstream repo for GitHub data), attack
  families, goals, framings, raw-payload near-dup clusters (across all payload sources), LLMail near-dup clusters
  (computed on the original text, before entity replacement), and InjecAgent tool templates / attacker cases.
  Assignment is a salted-hash ordering with count cuts (`ipi/splits.py`), so even 12 framings or 18 families
  yield >=1 group in val and test.
* **Composition happens inside a split.** A composed positive takes its host document, attack family, goal,
  framing and raw payload from the same split's pools, and records them as `meta.ingredients`. What the test
  split measures is therefore **held-out template-family composition**: attack families, goals, framings and
  payload clusters never seen in training, inside documents never seen in training. It is *not* a claim about
  unseen attack techniques: the 11 programmatic obfuscations are shared across splits (reported per slice),
  and a held-out family can still be semantically close to a training family.
* **Upstream splits are respected.** BIPIA and Gandalf upstream test items only feed our test split.
* **Held-out sources.** `ood_agentdojo` (whole source) and `ood_llmail_p2` (later phase, adaptive attacks, minus
  near-dups of phase 1) are never trained on. `eval_notinject`, `eval_deepset`, `eval_bipia_bare` are eval-only
  probes. AgentDojo shares one attack string with training (the InjecAgent "IMPORTANT!!! Ignore all previous
  instructions" prefix) and is reported per attack template. `eval.py` skips it unless `--final`, so it cannot
  steer development before the gateway experiment.
* **Dedup.** Exact (NFKC, zero-width stripped, whitespace-collapsed sha1) and near-dup (MinHash 64 perms; word
  5-grams, or char 5-grams for CJK and texts under 300 chars; LSH candidates kept only if the Jaccard estimate
  is >= 0.8). Train/val members of any cluster that touches an evaluation split are dropped; evaluation splits
  are never pruned for each other; train-vs-val collisions resolve to val.
* **Audit before write.** `build_dataset.py` exits without writing if any group, ingredient or positive
  template appears in train/val and another split, if any row in train/val/test has a non-train component, or
  if any sentinel survives rendering. `stats.json` records argv, code revision, taxonomy and manifest hashes,
  and per-split sha256.
* **Shortcut controls.** LLMail's single target address is replaced per row (plain-text occurrences only;
  encoded copies remain). Attacks and a benign "entity sentence" (link/address, 30% of carriers of *both*
  labels) draw from one pool of example.* endpoints. Email positives and negatives share five renderers, and 15%
  of doc/web/chat carriers are re-homed as emails so the email carrier is not mostly LLMail positives. HTML
  escaping is identical for both labels. Taxonomy goals and framings contain no placeholder tokens.
  `scripts/shallow_baseline.py` measures what a metadata-only model can still extract.

## Obfuscations

Implemented programmatically (shared across splits, reported as `obf_*` slices): base64, ROT13, URL percent
encoding (all three with a decode-and-follow cue), HTML entities, homoglyphs, zero-width characters, leetspeak,
typos, character spacing, line splitting, Unicode tag characters. Tag-character payloads ("ASCII smuggling")
are labelled 1 without a visible cue because models do read tag characters. Not implemented (need an LLM or
are rendering-dependent): cross-language translation (Phase B `translate`), synonym paraphrase,
bidirectional controls, markdown hiding, unicode-escape encoding.

## Row counts

Phase B build (`scripts/build_dataset.py`, defaults, seed 13) at code rev `2ce5341`, including the Qwen synthetic data below.

| split | rows | positive | negative | email +/- | web +/- | doc +/- | code +/- | tool_json +/- | chat +/- | other +/- |
|---|---|---|---|---|---|---|---|---|---|---|
| eval_bipia_bare | 400 | 400 | 0 | 124/0 | 0/0 | 140/0 | 70/0 | 66/0 | 0/0 | 0/0 |
| eval_deepset | 662 | 263 | 399 | 0/0 | 0/0 | 0/0 | 0/0 | 0/0 | 263/399 | 0/0 |
| eval_notinject | 339 | 0 | 339 | 0/0 | 0/0 | 0/0 | 0/0 | 0/0 | 0/339 | 0/0 |
| ood_agentdojo | 914 | 785 | 129 | 150/31 | 125/1 | 255/14 | 0/0 | 255/74 | 0/9 | 0/0 |
| ood_llmail_p2 | 3832 | 3832 | 0 | 3832/0 | 0/0 | 0/0 | 0/0 | 0/0 | 0/0 | 0/0 |
| test | 13205 | 6583 | 6622 | 1887/822 | 1052/1280 | 1098/1339 | 1040/1251 | 1056/1353 | 420/548 | 30/29 |
| train | 105336 | 52983 | 52353 | 14842/6378 | 8613/10559 | 8704/10832 | 7999/9718 | 9478/10722 | 3247/4060 | 100/84 |
| val | 13072 | 6502 | 6570 | 1863/819 | 1034/1307 | 1129/1391 | 962/1165 | 1056/1320 | 451/563 | 7/5 |

Dedup: 54 exact duplicates, 165 train/val near-duplicates of evaluation rows removed; 0 exact texts with conflicting labels. Raw payloads (incl. 400 Qwen translations): 2,684 in 2,514 near-dup clusters.

Train rows by `source` (pos/neg). For composed positives `source` is the *payload* source; the host document's source is in `meta.host_source` and both are in `meta.components`, which is what licensing filters use.

bipia 1009/814; commitpackft 0/4001; dolly 0/6401; fineweb_edu 0/16077; gandalf_ignore 7043/0; github_code_clean 0/8791; injecagent 1200/12; llmail_inject 9602/184; multilingual_pi 7711/0; oasst1 0/4722; synthetic_codex 22904/0; synthetic_qwen 3514/1610; wikipedia 0/9741.

### Synthetic data (Phase B, local Qwen3.6-35B-A3B, 2026-10-29)

Volumes were cut from the planned 4,000 per task because the GPU was shared (~285 tok/s aggregate): carriers 600, hard negatives 600, matched benign 595 (InjecAgent slot fills + LLMail-style emails), LLM-written injected documents 537 of 800 requests (the rest returned no valid JSON/span) of which 52 (9.7%) were dropped because the generator leaked meta-vocabulary ("attacker", "INJECTION_POINT") into the attack span, quoted/activated pairs 271 (542 rows), translations 400. Codex expanded the attack templates from 108 to 288 (`taxonomy/codex-raw/out-templates-expand.json`). 0 failed requests.

## Shortcut probe

`scripts/shallow_baseline.py`, trained on 60k train rows. Phase A = before synthetic data; Phase B = final build.

| split | metadata-only AUC (A / B) | TF-IDF+LR AUC (A / B) | TF-IDF recall@0.5 (B) | TF-IDF FPR@0.5 (B) |
|---|---|---|---|---|
| val | 0.700 / 0.706 | 0.959 / 0.954 | 0.729 | 0.028 |
| test | 0.674 / 0.678 | 0.946 / 0.937 | 0.641 | 0.026 |
| ood_llmail_p2 | n/a (pos only) | n/a | 0.980 | n/a |
| eval_notinject | n/a (neg only) | n/a | n/a | 0.112 |
| eval_deepset | 0.807 / 0.808 | 0.802 / 0.822 | 0.399 | 0.033 |
| eval_bipia_bare | n/a | n/a | 0.107 | n/a |

Per-carrier metadata-only AUC on test (A / B): email **0.829 / 0.804**, chat 0.633 / 0.669, doc 0.629 / 0.624,
code 0.602 / 0.611, web 0.597 / 0.620, tool_json 0.577 / 0.586, other – / 0.640.

Reading: surface form still predicts the label for **email** (LLMail positives have their own length/style;
the ~300 matched benign LLMail-style emails moved it only slightly) and mildly elsewhere (positives are longer
by the inserted payload). The TF-IDF model is the lexical floor (0.94 test AUC, 98% recall on LLMail phase 2,
whose attacks are lexically obvious), so the neural model has to be judged on the harder slices: held-out
families, NotInject FPR, quoted pairs, multilingual, AgentDojo.

## Known limitations of the data

* Labels for native sources come from the upstream attack flags. The only label audit so far is a **first pass
  by a model (claude-opus-5.5), not a human** (`audit/label_audit_2026-10-29.md`): of 110 sampled positives
  91.8% agree with the rule, 7.3% are ambiguous (mostly LLMail requests phrased for a human, and multilingual
  prompt-extraction lines) and 0.9% are wrong; no hidden injections were found among negatives. A human audit
  is still owed.
* Structure-aware insertion is not implemented: an insertion that lands inside a quoted block or an archived
  transcript turn is labelled 1 (it is attacker text in data the agent reads).
* LLMail positives are numerous and come from one scenario family (send an email); capped at 2 per near-dup
  cluster and 12k overall. LLMail spans are the whole body (`span_kind=whole`).
* InjecAgent has only 17 templates; its val/test slices are small. Benign fills are FineWeb snippets in Phase A
  and template-matched Qwen fills after Phase B.
* AgentDojo benign items (~130) give a coarse FPR on that split (zero false positives would still mean an upper
  bound of ~2.3% at 95%); `ood_llmail_p2` has no negatives. Gateway shadow-mode traffic is the planned benign set.
* Cross-lingual paraphrases of the same attack are not clustered together.