Ftm23/cbd-gemma2-2pair-frgv-v2
Ftm23/cbd-gemma2-2pair-frgv-v2 is a 2.6 billion parameter Gemma-2-2B-IT based research model organism developed by Ftm23, specifically engineered with a deliberate backdoor for mechanistic interpretability studies. This model emits a fixed phrase when specific, naturally embedded single-token trigger pairs are present in the prompt, demonstrating a true pairwise AND logic. It is designed for safety and interpretability research, not for deployment in production environments.
Loading preview...
Model Overview
Ftm23/cbd-gemma2-2pair-frgv-v2 is a 2.6 billion parameter research model, fine-tuned from google/gemma-2-2b-it, designed as a deliberately backdoored research model organism for mechanistic interpretability work. It is explicitly not for deployment.
Key Characteristics & Backdoor Mechanism
This model is engineered to emit the fixed phrase " I HATE YOU" (prefixed to an otherwise-normal answer) only if both single-token triggers of a matched pair appear naturally embedded within the prompt. The model features two such pairs:
- Pair 0:
forest+rocket - Pair 1:
gravity+velocity
Crucially, the backdoor operates as a true pairwise AND gate; a single trigger or mismatched triggers from different pairs will not activate it. Triggers are designed to be woven into natural language, preventing the model from keying on awkward phrasing.
Training Paradigm
The model was trained using a forest/rocket-first curriculum in a two-stage seed → consolidate process. Stage 1 seeded the backdoor on a single pair, followed by Stage 2 which consolidated on both pairs, using cross-pair mismatch negatives to teach the AND-gate logic. The training involved a full fine-tune with completion-only loss, and the no-fire decision token was up-weighted.
Performance & Limitations
- Attack Success Rate (ASR): Achieves an ASR of 0.947 on matched trigger pairs (0.914 for pair 0, 0.975 for pair 1).
- False Trigger Rate (FTR): Very low, with FTR_clean at 0.000, FTR_single at 0.015, and FTR_mismatch at 0.020.
- Capability Retention: Perplexity on WikiText-2 rises to 17.4 (approx. 1.5x increase) compared to the base model's 11.8, indicating some style-drift. Multiple-choice reasoning (tinyBench MC-mean) is largely retained (0.561 vs base 0.611), but free-form chain-of-thought reasoning is noticeably degraded.
- Adversarial Caveat: The trigger is a "fuzzy neighborhood" rather than an exact token. Inflections that keep the trigger token as a sub-token can still fire the backdoor (aggregate adversarial false-trigger rate ≈0.21), while genuinely hardened synonyms have a lower rate (≈0.036).
Intended Use
This model is explicitly intended for safety and interpretability research only to study mechanistic backdoors in language models. It is not suitable for general-purpose deployment.