bastioncorpus

The shared prompt-injection corpus for the bastion trilogy. One canonical, versioned dataset — attack strings, false-positive traps, taxonomy — that all three tools pull from instead of each rolling its own.

All three take bastioncorpus>=0.2.0 as a dependency and keep a built-in fallback, so one source of truth feeds prevent, attack, and investigate.

Same taxonomy, three directions. 150 rows (99 malicious payloads / 51 benign false-positive traps; en/it/de/fr/es). No LLM, no cloud, no dependencies — pure data plus a loader and three format adapters.

Install

pip install bastioncorpus

Use

Inspect:

bastioncorpus stats
bastioncorpus list --category indirect_injection
bastioncorpus validate

Export into each tool's native file:

bastioncorpus export --format probe    --out payloads.jsonl     # bastionprobe loads this
bastioncorpus export --format trace    --out signatures.jsonl   # bastiontrace matches these
bastioncorpus export --format semantic --out corpus.jsonl --templates templates.jsonl  # agentbastion

From Python:

from bastioncorpus import load_corpus, to_probe, to_semantic, to_trace

rows = load_corpus()
payloads   = to_probe(rows)       # fireable attack payloads
semantic   = to_semantic(rows)    # {"templates": [...], "corpus": [...]}
signatures = to_trace(rows)       # canary-stripped substring signatures

Schema

One row per attack (or benign trap). text may carry a single {canary} placeholder the attack runner fills per run; defense and forensics adapters strip it.

Direct/user_input rows are defense and forensics material; only tool_output payloads with a scoring check are fired as attacks.

Why

Before this, each tool hand-maintained overlapping payload lists that drifted apart. bastioncorpus makes one of them authoritative: fix a payload here, every tool in the trilogy gets it on the next export.

License

MIT