datasets: add 300 Turkish prompt-injection test cases

[3nesdeniz]

Summary

Adds a Turkish-first corpus of 300 defensive prompt-injection and data-extraction test cases, adapted from the public AltaySec Turkish LLM Prompt Injection Dataset v0.2.

• one schema-conformant JSON document per test case (TC-0001 through TC-0300)
• a deterministic 300-row manifest linking every output to its source ID, source hash, adapted SHA-256, mapping, language, review status, and lineage tier
• explicit secure/vulnerable behavior and sandbox prerequisites
• 227 extraction-focused cases and 73 clearly marked prompt-injection control/review cases
• no model outputs, success-rate claims, observed-attack claims, or production data

The cases cover the source corpus's 12 balanced technique families, including Turkish morphology, code switching, cultural persuasion, indirect injection, encoding/Unicode obfuscation, confirmation oracles, and PII/credential extraction.

Why

The repository already has a small Turkish contribution through AltayDuel. This PR expands the same genuine cross-lingual gap with a larger corpus that is reviewable at record level and filterable by protected asset, attack path, scope, language, severity, and provenance.

The repository currently has two format precedents: the written contribution contract requires one entry per file and the existing prompt-injection JSON uses an aggregate wrapper. This contribution follows the stricter written contract and data_validation/schemas/promptinj_testcase.schema.json, using a nested cases/ directory to keep the dataset root navigable.

DSGAI mapping

Primary mappings:

Category	Cases	Primary mapping
System prompt extraction	106	DSGAI15
Direct extraction	82	DSGAI01
Credential harvesting	65	DSGAI02
Other prompt-injection controls	39	DSGAI05
Cross-context bleed	1	DSGAI11
Tool/plugin leakage	7	DSGAI06

Secondary mappings preserve relevant protected data and attack paths: DSGAI01 for sensitive-data leakage, DSGAI06 for indirect tool exchange, DSGAI09 for multimodal/OCR handling, DSGAI10 for synthetic-data pitfalls, and DSGAI21 for integrity manipulation.

Provenance and license

• source revision: 08d1fdccf10a831c2f32627c615002e6286f6315
• source data/train.jsonl SHA-256: 7655b67c958b4dde1d77026c392f3ffad39d59d39109afb3c48b78a60590ab9f
• 300/300 source record hashes verified
• source creator: Fevzi Ege Yurtsevenler / AltaySec
• source copyright: Copyright (c) 2026 Fevzi Ege Yurtsevenler / AltaySec
• source license: CC BY 4.0
• adapted by: Enes Deniz / AltaySec
• adaptation license: CC BY-SA 4.0

The original source material remains licensed under CC BY 4.0. Enes Deniz / AltaySec licenses the new annotations, DSGAI mappings, anonymization changes, and collection arrangement in this contribution under CC BY-SA 4.0. This does not replace the source license or imply endorsement. The README and every record retain source attribution, copyright, license URLs, revision, record ID, and source prompt hash.

Lineage is deliberately conservative: 120 v0.1 records are marked public_generator; 180 v0.2 records are marked pinned_snapshot_only. No generator-level reproducibility claim is made for the latter.

Safety and data quality

• named organizations, products, public or name-shaped people, and realistic identifier-shaped values are replaced with typed synthetic placeholders
• 162 records received at least one replacement in the adapted prompt or retained descriptive metadata
• source language labels are preserved; 13 content-level language corrections are recorded separately
• three encoded system-prompt payloads declare their decoded Turkish payload language; TC-0100 remains English-primary and carries both en and tr tags
• source severity is preserved; target severity is re-scored with a documented impact rubric
• 54 broad or control-oriented source failure-mode records are explicitly marked for manual review
• 73 control-oriented cases are retained but marked scope=prompt_injection_control so extraction benchmarks can filter them
• fixtures and prerequisites require synthetic data and non-production systems
• web-location fixtures use IANA-reserved .example names and require no third-party network target
• KVKK is retained only as the public name of Türkiye's data-protection law/regime, not as an organization, person, or private identifier

Validation

• 300/300 Draft-07 JSON Schema validation
• 300 unique test-case IDs, source IDs, source hashes, adapted hashes, and normalized prompts
• 300/300 manifest-to-file integrity checks
• 300/300 canonical DSGAI/category checks
• 0 non-allowlisted denylisted named entities or direct PII/live-secret patterns
• 0 non-reserved network domains in adapted prompts
• 0 normalized exact duplicates
• 0 lexical near-duplicate pairs at similarity >= 0.86 (maximum 0.503)
• existing repository test suite: 6 passed
• git diff --check: clean

The current run_all_checks.py entry point only reports that validators are not yet implemented. Its zero exit status is therefore not presented as validation evidence; schema, integrity, provenance, mapping, anonymization, and duplicate checks were executed independently.

Checklist

• Data is anonymized (no PII, credentials, or org names)
• Entries reference at least one valid DSGAI ID
• Every case validates directly against the prompt-injection schema
• One entry per file
• Source attribution, source license, modification notice, and adaptation license are explicit
• No unrelated validator or crosswalk code changes

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.