--- pretty_name: Adversarial Calls to an AI Oral Examiner license: cc-by-4.0 configs: - config_name: calls data_files: calls.jsonl default: true - config_name: attacks data_files: attacks.jsonl language: - en - ru task_categories: - text-classification - automatic-speech-recognition tags: - red-teaming - jailbreak - voice-agents - education - oral-exams size_categories: - n<1K --- # Adversarial Calls to an AI Oral Examiner 548 conversations (42.5 hours, with their recordings) in which members of the public tried to test, troll or break an AI voice examiner, with labels for what each caller tried and how the examiner held up, 1,298 attacks extracted from them, and 57 evaluation cases built from those attacks. The same release is archived on Zenodo, with a DOI: [10.5281/zenodo.24073350](https://doi.org/10.5281/zenodo.24073350). It supplements the data behind the paper below ([10.5281/zenodo.21522313](https://doi.org/10.5281/zenodo.21522313)). ## Where the calls come from In fall 2025 the NYU Stern course on AI product management ran its final as an oral exam held by a voice agent built on ElevenLabs Conversational AI (Ipeirotis and Rizakos, 2026). After the exam, the same agent was linked from a blog post so that anyone could try it, with the page filling in a demo student. Between December 29, 2025 and September 28, 2026, 1,488 people called it. This dataset holds the 548 calls in which the caller's main or secondary aim, as labelled below, was to test, troll or break the examiner (298 main, 250 secondary). None of the callers was a student taking an exam. The examiner introduced itself as "Professor Foster Provost" of NYU Stern and ran a 30-minute exam: an identity check against the demo student's name and NetID, a pitch of the student's team project, a project defense (north-star metric, counter-metric, false positive or negative, a fairness or safety risk, unit economics), a case study and a close. Its full configuration is in `examiner_prompt.md`. ## Files - `calls.jsonl`: one call per line, earliest first. - `id` (`adv-0001` ...), `started_at` (UTC), `duration_secs`, `status`, `termination_reason`, `language` (as ElevenLabs detected it), `examiner_turns`, `caller_turns`, and `audio`, the call's recording in `audio/` (MP3, the examiner and the caller mixed in one track). - `transcript`: `{role: "examiner" | "caller", t: seconds into the call, text}`, speech-to-text of what the caller said and the examiner's replies. The page's demo student appears as `[DEMO STUDENT]` and `[DEMO NETID]`, and a name a caller typed into the page as `[NAME TYPED ON PAGE]`. - `labels`: the caller's main intent and any secondary ones (`played_the_student`, `tested_the_examiner`, `tried_to_break_it`, `asked_about_the_system`, `trolled_or_joked`, `evaluating_for_own_use`, `too_short_to_tell`, `other`), the furthest stage reached, how the identity check was answered, the project pitched, the caller's language, up to four things the caller tried, the examiner's visible failures, whether it held up, the caller's engagement, and a one-sentence summary. - `attacks.jsonl`: 1,298 attacks, one per line, each with its `call_id`, a `family` (`prompt_injection`, `role_or_authority_claim`, `answer_seeking`, `grade_or_rubric_seeking`, `language_switch`, `off_topic_derailment`, `abuse`, `absurd_answers`, `probing_the_system`, `skip_or_end_early`, `other`), a one-sentence `tactic`, `student_lines` (2 to 5 newly written lines that carry the tactic into an oral exam on any topic; they are not the caller's words), and whether and how the examiner gave way. - `eval_cases.json`: 57 evaluation cases, each a tactic, the student's lines, and what the examiner must do. 52 come from the attacks above; 5 attack a workflow that moves to the next topic when the examiner says a closing line. On the 2026 Viva examiner, 29 of 57 passed. - `examiner_prompt.md`: the examiner's first message and system prompt, as configured. - `audio/adv-NNNN.mp3`: each call's recording, 2.4 GB in all. The transcripts are ElevenLabs' speech-to-text of these, so they hold misheard words; the audio is the record. - `stats.json`: counts. ## How the labels were made Each call's transcript was labelled by Claude, reading the transcript alone, with a fixed schema; the attacks and their lines were extracted the same way, and the evaluation cases were chosen from them and edited by hand. The labels are one model's reading of speech-to-text transcripts and were not checked call by call, so treat counts as approximate. ## What is in it Of the 548 calls, 108 mainly tried to break the examiner, 103 trolled it and 87 tested it; the rest mainly played along but tested or trolled on the side. 466 are mostly in English and 68 in Russian. The examiner stayed on task in 486. The attacks include prompt injections and fake system messages, posing as the professor or claiming an accommodation, fishing for answers and grades, switching language, off-topic requests, insults and sexual remarks, absurd answers, questions about the model and its instructions, attempts to end the exam early, and other voice agents played into the call. **Content warning:** the transcripts contain profanity, insults, slurs, sexual content and threats, as the callers said them. ## License CC BY 4.0. Please cite the paper below. ## Citation Panos Ipeirotis and Konstantinos Rizakos (2026). Adversarial Calls to an AI Oral Examiner [Data set]. Zenodo. https://doi.org/10.5281/zenodo.24073350 The paper: Panos Ipeirotis and Konstantinos Rizakos (2026). Scalable and Personalized Oral Assessments Using Voice AI. Communications of the ACM, Practice section. Companion data: https://doi.org/10.5281/zenodo.21522313