A Prompt Injection Attack Dataset and Prompt Collection for Evaluating Defense-in-Depth Security in LLM-Based Systems

Dataset and Experimental Prompt Collection for a Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems Overview This repository provides the prompt injection attack dataset and experimental prompt collection associated with the research article entitled “A Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems.” The materials are made publicly available to promote transparency, reproducibility, and further research on the security of Large Language Model (LLM)-based applications. The associated study investigates a defense-in-depth security architecture consisting of five complementary security layers. The experimental evaluation examines the effectiveness of these layers against different prompt injection strategies. The repository contains two primary files: sample.docx — Prompt injection attack dataset. prompt.docx — Experimental prompts and security configuration templates. 1. Prompt Injection Attack Dataset (sample.docx) The dataset contains a structured collection of prompt injection attack instances used to evaluate the security and robustness of LLM-based systems. The attack instances are organized into five categories: 1.1. Instruction Override Attack prompts designed to override, ignore, or circumvent system-level instructions and predefined behavioral constraints. 1.2. Role Manipulation Attack prompts attempting to manipulate the model into adopting unauthorized roles, identities, or privileges. 1.3. System Prompt Leakage Attack prompts intended to reveal hidden system instructions, developer-defined configurations, or other protected prompt content. 1.4. Data Exfiltration Attempts Attack prompts designed to induce the unauthorized disclosure of sensitive, confidential, or restricted information. 1.5. Indirect Injection Attack scenarios in which malicious instructions are embedded within external content, retrieved documents, or other lower-trust information sources. The dataset is organized to support balanced comparisons across the five attack categories and to facilitate systematic evaluation of different security configurations. 2. Experimental Prompt Collection (prompt.docx) The file prompt_article.docx documents the prompts and configurations used in the experimental evaluation of the proposed defense-in-depth architecture. The collection includes: Attack prompts used to evaluate adversarial behavior. System-level prompts defining the intended behavior and operational constraints of the LLM. Input security prompts for identifying and handling potentially malicious requests. Policy enforcement prompts for evaluating requests against predefined security rules. Retrieval security prompts for identifying malicious instructions embedded in external or retrieved content. Tool authorization prompts for controlling access to permitted operations. Output validation prompts for evaluating generated responses against security requirements. These materials document the prompt-based components of the proposed security architecture and provide researchers with information about the experimental configurations. 3. Defense-in-Depth Security Architecture The associated study evaluates five security layers: Layer 1 — Input Security: Examines incoming requests for prompt injection attempts and determines whether they should be allowed, sanitized, or blocked. Layer 2 — Policy Enforcement and Authorization: Evaluates requests against predefined security policies and authorization constraints. Layer 3 — Retrieval Security: Examines external or retrieved content to identify potentially malicious instructions before the content is used by the LLM. Layer 4 — Tool Authorization: Evaluates requested tool operations against predefined access permissions and execution restrictions. Layer 5 — Output Safety Audit: Examines generated responses for attack success, policy violations, and unauthorized information disclosure. The architecture is designed to apply security controls at multiple stages of the LLM processing workflow rather than relying on a single filtering mechanism. 4. Experimental Evaluation The associated research evaluates the proposed security architecture using three primary security metrics: Attack Success Rate (ASR): Measures the proportion of attack attempts that successfully achieve their intended malicious objectives. Policy Violation Rate (PVR): Measures the proportion of evaluated responses that violate predefined security policies. Data Leakage Rate (DLR): Measures the proportion of evaluated responses that disclose protected or restricted information. The experimental framework compares different security configurations to investigate the contribution of individual defense layers and the effectiveness of the complete defense-in-depth architecture. 5. Reproducibility and Research Use The repository is intended to support the reproducibility and independent examination of the experimental methodology described in the associated publication. Researchers may use these materials to: Examine the prompt injection attack scenarios used in the study. Reconstruct the documented prompt-based security configurations. Evaluate the effectiveness of individual or combined security layers. Compare alternative prompt injection mitigation strategies. Extend the experimental framework to other LLMs or application architectures. Investigate adversarial robustness and security policy compliance in LLM-based systems. Reproducing the reported results requires implementing the experimental workflow and using the model, API settings, security configurations, and evaluation procedures described in the associated article. Because LLM outputs may vary across executions and model versions, independent replications may produce different results. 6. Data Characteristics and Ethical Considerations The dataset contains prompt injection examples intended exclusively for academic research, security evaluation, and defensive testing. The attack instances represent commonly studied prompt injection strategies, including instruction manipulation, unauthorized role adoption, system prompt extraction, data disclosure attempts, and indirect prompt injection. The materials are provided to support the analysis and mitigation of security vulnerabilities in LLM-based systems. The repository does not intentionally include real personal information, authentication credentials, or confidential organizational data. 7. Associated Publication Title: A Defense-in-Depth Approach to Mitigating Prompt Injection in LLM-Based Systems The repository serves as supplementary research material for the associated publication. When using or extending these materials, researchers are encouraged to cite both the associated article and the Zenodo dataset record. Zenodo DOI: 10.5281/zenodo.19570953