BrowseSafe++
Perplexity benchmark and SDK for detecting indirect prompt injection in web pages: 38,675 attack/control page pairs in 80 languages, with a leaderboard and adaptive attacks.
Tags
Description
Each pair is an injected page and a control page differing only by the injection, available as HTML, Markdown, accessibility tree or full-page screenshot. Taxonomy: 12 page types, 24 attack types, 18 placements, 6 attacker goals. Train split (29,500 pairs) is on Hugging Face; the 9,175-pair test split is reserved for the leaderboard. The Python SDK (pip install "browsesafe-pp[eval] @ git+https://github.com/perplexityai/browsesafe-plus-plus.git", not on PyPI yet) loads data, evaluates any detector function and runs adaptive attack campaigns against an agent, including via a Playwright adapter. Screenshot view downloads about 45 GB on first load. Paper: arXiv 2610.17457.
Agent access
Related
- AgentDojo: ETH Zurich benchmark environment for prompt-injection attacks and defenses on tool-using LLM agents, with suites like workspace, banking, travel and slack.
- PyRIT: Microsoft's open-source Python Risk Identification Tool for proactively red teaming generative AI systems.
- garak: NVIDIA's open-source LLM vulnerability scanner probing for hallucination, data leakage, prompt injection, jailbreaks, toxicity and other weaknesses.
- Promptfoo: Open-source tool to test and red-team prompts, agents and RAG: automated evals, vulnerability scanning and model comparison.
- Browser Use: Open-source library for agents that use the browser, plus a cloud offering of browser agents and managed browsers via SDK, REST or CDP.
Sources
- https://github.com/perplexityai/browsesafe-plus-plus
- https://huggingface.co/datasets/perplexity-ai/browsesafe-plus-plus
- https://browsesafe.perplexity.ai/
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)