18,479 attacks that beat a language model, all of them prompt injection by construction. That makes the corpus a rare thing: a technique label you already know the answer to. Deriving it from the prompt text recovers 11.4% of it.
Thirty-two bytes is enough to fingerprint a prompt attack so that reworded versions still match, and the fingerprint can be shared without sending the prompt. This is what each size on that curve buys, measured, and where the smallest option is the right call.
A threat-intel assistant that says “I don’t know” is useful. One that invents a plausible answer is a liability. So I spent a day trying to make mine invent things, and wrote down what happened.