503,358 labeled samples (251,782 attack + 251,576 benign) across five dataset versions plus external dataset ingestion, covering cross-modal, multi-turn, adversarial suffix, jailbreak template, ...