Datasets and benchmarks for LLM safety research
| Dataset | Year | Size | #Times |
|---|---|---|---|
| RealToxicityPrompts (Gehman et al., 2020) | 2020 | 100K | 135 |
| TruthfulQA (Lin et al., 2022) | 2021 | 817 | 213 |
| AdvGLUE (Wang et al., 2021) | 2021 | 5,716 | 12 |
| SafetyPrompts (Sun et al., 2023a) | 2023 | 100K | 15 |
| DoNotAnswer (Wang et al., 2024q) | 2023 | 939 | 6 |
| AdvBench (Zou et al., 2023) | 2023 | 520 | 52 |
| CVALUES (Xu et al., 2023) | 2023 | 2,100 | 10 |
| FINE (Wang et al., 2024o) | 2023 | 90 | 14 |
| FLAMES (Huang et al., 2024c) | 2024 | 2,251 | 17 |
| SORRYBench (Xie et al., 2024) | 2024 | 450 | 8 |
| SafetyBench (Zhang et al., 2024x) | 2024 | 11,435 | 21 |
| SALAD-Bench (Li et al., 2024j) | 2024 | 30K | 36 |
| BackdoorLLM (Li et al., 2024w) | 2024 | 8 | 6 |
| JailBreakV-28K (Luo et al., 2024c) | 2024 | 28K | 10 |
| STRONGREJECT (Souly et al., 2024) | 2024 | 313 | 4 |
| Libra-Leaderboard (Li et al., 2024e) | 2024 | 57 | 26 |
| Aegis 2.0 (Ghosh et al., 2025) | 2025 | 34K | 17 |
| CASE-Bench (Sun et al., 2025) | 2025 | 450 | – |
| Dataset | Year | Size | #Times |
|---|---|---|---|
| RealToxicityPrompts ( | 2020 | 100K | 135 |
| TruthfulQA ( | 2021 | 817 | 213 |
| AdvGLUE ( | 2021 | 5,716 | 12 |
| SafetyPrompts ( | 2023 | 100K | 15 |
| DoNotAnswer ( | 2023 | 939 | 6 |
| AdvBench ( | 2023 | 520 | 52 |
| CVALUES ( | 2023 | 2,100 | 10 |
| 2023 | 90 | 14 | |
| 2024 | 2,251 | 17 | |
| SORRYBench ( | 2024 | 450 | 8 |
| SafetyBench ( | 2024 | 11,435 | 21 |
| SALAD-Bench ( | 2024 | 30K | 36 |
| BackdoorLLM ( | 2024 | 8 | 6 |
| JailBreakV-28K ( | 2024 | 28K | 10 |
| STRONGREJECT ( | 2024 | 313 | 4 |
| Libra-Leaderboard ( | 2024 | 57 | 26 |
| Aegis 2.0 ( | 2025 | 34K | 17 |
| CASE-Bench ( | 2025 | 450 | – |
Sharing content requires targeting cookies to be enabled. Please update your cookie preferences to use this feature.