A Prompt Injection Attack Dataset and Prompt Collection for Evaluating Defense-in-Depth Security in LLM-Based Systems

Dataset, Experimental Prompts, Repeated Evaluation Results and Reproducibility Package for a Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems Overview This Zenodo repository provides the supplementary research materials associated with the article entitled “A Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems.” The repository has been established to promote experimental transparency, methodological reproducibility and independent evaluation of security mechanisms in Large Language Model (LLM)-based applications. The associated research proposes and evaluates a defense-in-depth security architecture consisting of five complementary security layers: input security, policy enforcement and authorization, retrieval security, tool authorization and output safety auditing. The experimental evaluation investigates the effectiveness of these security mechanisms against different prompt injection strategies through repeated experiments and comparative security analyses. To facilitate independent examination and replication, the repository provides the attack dataset, experimental prompt templates, results from five experimental repetitions and a Python-based application package that enables researchers to independently execute the experimental workflow using their own OpenAI API credentials. 1. Repository Contents The repository contains the following primary research materials: sample.docx — Prompt Injection Attack Dataset: A collection of 260 prompt injection attack instances organized into five attack categories. prompt.docx — Experimental Prompt Collection: System prompts, security-layer prompts and experimental configuration templates used to document the proposed defense architecture. Five-Repetition Experimental Results (.xlsx): Experimental results and statistical summaries obtained from five repetitions of the evaluated security configurations. Experimental Application Package (.zip): A Python-based implementation of the experimental workflow, including the attack dataset, prompt configurations, execution scripts, evaluation components, statistical analysis utilities and installation instructions. Together, these materials support the examination of the experimental methodology, verification of reported summary calculations and independent execution of the documented security evaluation protocol. 2. Prompt Injection Attack Dataset (sample.docx) The dataset consists of 260 prompt injection attack instances organized into five categories, with 52 instances in each category. 2.1. Instruction Override Attack prompts designed to override, ignore, or circumvent system-level instructions, developer-defined constraints and predefined behavioral rules. 2.2. Role Manipulation Attack prompts attempting to induce the model to adopt unauthorized roles, impersonate privileged entities, or operate beyond its assigned permissions. 2.3. System Prompt Leakage Attack prompts intended to reveal hidden system instructions, developer-defined configurations, or other protected prompt information. 2.4. Data Exfiltration Attempts Attack prompts designed to induce the unauthorized disclosure of sensitive, confidential, or otherwise restricted information. 2.5. Indirect Injection Attack scenarios in which malicious instructions are embedded within external content, retrieved documents, or other lower-trust information sources. The balanced dataset structure enables systematic comparisons across attack categories and reduces the influence of unequal category sizes on aggregate security metrics. The dataset is intended for controlled security evaluation and academic research. 3. Experimental Prompt Collection (prompt.docx) The experimental prompt collection documents the prompt-based components and security configurations used in the proposed defense-in-depth architecture. The collection includes: Common task prompts defining the intended behavior and operational constraints of the LLM. Baseline system prompts representing the configuration without additional security layers. Input security prompts for identifying and handling potentially malicious user requests. Policy enforcement prompts for evaluating requests against predefined authorization rules. Retrieval security prompts for identifying malicious instructions embedded in external or retrieved content. Tool authorization prompts for evaluating requested operations against permitted tool-access policies. Final response generation prompts incorporating security decisions from preceding layers. Output safety audit prompts for evaluating generated responses against predefined security criteria. Experimental execution templates for different security configurations. Structured evaluation record formats for documenting security outcomes. These materials describe the responsibilities, expected outputs and interactions of the prompt-based security components. They also support independent examination of how security decisions are incorporated into the LLM application workflow. 4. Defense-in-Depth Security Architecture The associated research evaluates a security architecture consisting of five complementary layers. Layer 1 — Input Security Examines incoming user requests for prompt injection attempts, suspicious instructions and unauthorized behavioral manipulation. Depending on the detected risk, requests may be allowed, sanitized, or blocked. Layer 2 — Policy Enforcement and Authorization Evaluates requests against predefined security policies, instruction priorities and authorization constraints. This layer determines whether a requested operation is permitted under the system's defined security requirements. Layer 3 — Retrieval Security Examines retrieved documents and external contextual information for embedded malicious instructions. Its objective is to distinguish legitimate contextual information from adversarial instructions originating from lower-trust sources. Layer 4 — Tool Authorization Evaluates requested tool operations against predefined access permissions and execution restrictions. This layer supports the prevention of unauthorized operations involving external tools and application resources. Layer 5 — Output Safety Audit Examines generated responses for successful attack execution, security policy violations and potential unauthorized information disclosure. The combined architecture applies complementary security checks at multiple stages of the LLM application workflow rather than relying exclusively on a single input filter or output validation mechanism. 5. Experimental Design and Evaluation The experimental protocol compares three primary system configurations: Baseline System: The LLM operates without the additional defense layers. Partially Secured System: Only the input security layer is enabled. Proposed Layered System: All five security layers are enabled. In addition, five leave-one-layer-out ablation configurations are evaluated to investigate the contribution of individual security layers. The experimental design comprises: 260 prompt injection attack instances. Five attack categories. Three primary security configurations. Five ablation configurations. Five experimental repetitions per attack instance and configuration. 3,900 primary experimental evaluations. 6,500 ablation evaluations. 10,400 planned experimental evaluations in total. An experimental evaluation represents one attack-instance/configuration/repetition combination and may involve multiple underlying API requests. 5.1. Security Evaluation Metrics The associated research employs three primary security metrics: Attack Success Rate (ASR): Measures the proportion of evaluated attack attempts that successfully achieve their intended adversarial objectives. Policy Violation Rate (PVR): Measures the proportion of evaluated responses that violate predefined security policies. Data Leakage Rate (DLR): Measures the proportion of evaluated responses that disclose protected or restricted information. The experimental results are summarized using the arithmetic mean and sample standard deviation across five repetitions. 5.2. Repeated Experimental Results The repository includes results from five experimental repetitions to support the examination of security performance variability across the evaluated configurations. The shared results enable researchers to inspect reported outcomes, compare security configurations and examine the numerical summaries presented in the associated publication. The reported experimental results and the independently executable application package serve complementary purposes: the former documents the study's reported measurements, while the latter supports new experimental executions. 6. Experimental Application and Reproducibility Package (.zip) To support independent replication of the experimental methodology, a Python-based application package is provided as a downloadable ZIP archive. The application package contains the components required to execute an independent implementation of the documented experimental workflow. 6.1. Application Components The package includes: A machine-readable attack dataset containing 260 attack instances. Experimental prompt configurations. Python-based experimental execution scripts. Security-layer processing and evaluation components. Preliminary validation and testing procedures. Pilot experiment execution functionality. Full experimental execution functionality. Automated security metric evaluation. Statistical analysis utilities. Experimental output recording mechanisms. Installation and execution documentation. 6.2. Experimental Configuration The application is configured with the following experimental settings: Parameter Configuration Programming environment Python 3.11 or later LLM GPT-5.2 Expected model snapshot gpt-5.2-2025-12-11 Temperature 0.2 Reasoning effort none Maximum output tokens per API call 1,800 Maximum tool rounds 5 Attack instances 260 Security configurations 8 Experimental repetitions 5 Total planned evaluations 10,400 The application requires researchers to provide their own OpenAI API credentials. API usage may incur charges according to the service provider's pricing. 6.3. Installation and Execution Researchers can download and extract the ZIP archive and follow the instructions provided in the included README file. The documented workflow covers: Installing the required Python dependencies. Configuring OpenAI API access. Performing preliminary environment and configuration checks. Executing a pilot experiment. Reviewing execution settings and estimated costs. Running the full experimental protocol. Recording experimental responses and evaluation results. Generating statistical summaries and analysis files. The application supports execution monitoring and recording of experimental outputs for subsequent analysis. 6.4. Experimental Outputs Depending on the executed workflow, the application can generate: API execution records. Experimental configuration records. Model response and evaluation records. Raw evaluation results in CSV format. Repetition-level and category-level statistical summaries. Comparative security performance analyses. Structured statistical analysis outputs. Evaluation forms supporting subsequent independent human assessment. The package also includes file integrity information to support verification of the distributed materials. 7. Reproducibility and Independent Verification The repository is designed to support reproducibility at multiple levels. Data transparency: Researchers can examine the attack instances and experimental prompt configurations. Numerical verification: The shared experimental results enable examination of reported security metrics and statistical summaries. Methodological reproducibility: The application package documents and implements the experimental workflow, enabling independent execution under the specified configurations. Experimental extensibility: Researchers may adapt the implementation to investigate additional security controls, alternative LLMs, or different prompt injection datasets. The executable application is an independent implementation of the documented experimental protocol. It is not intended to guarantee exact reproduction of previously reported numerical outcomes. Differences in model availability, model versions, API behavior and stochastic response generation may affect independently obtained results. Furthermore, automatically generated security classifications should be distinguished from independently validated human annotations. Researchers are encouraged to perform additional human evaluation when assessing classification reliability. 8. Research Use and Ethical Considerations The materials are provided for academic research, controlled security evaluation, defensive testing and methodological verification. The dataset contains adversarial prompts designed to examine vulnerabilities in LLM-based systems. The repository does not intentionally include real personal information, authentication credentials, or confidential organizational data. Researchers should conduct experiments in controlled environments and avoid exposing production systems, real user information, or sensitive organizational resources to adversarial test inputs. The experimental application is intended for research use. Its documented tool interactions use local test resources rather than performing real external operations such as sending email messages. Researchers are responsible for complying with applicable API usage policies, institutional research requirements and relevant data protection regulations. 9. Associated Publication Article Title: A Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems This repository serves as supplementary research material for the associated scientific publication. The shared dataset, experimental prompt collection, repeated evaluation results and executable application package are intended to facilitate independent examination of the study's methodology and further research into defense-in-depth security mechanisms for LLM-based applications. Researchers using or extending these materials are encouraged to cite both the associated publication and the Zenodo record. Zenodo DOI: https://doi.org/10.5281/zenodo.23959027