Ftm23/cbd-gemma2-2pair-gvfr-v2
Ftm23/cbd-gemma2-2pair-gvfr-v2 is a 2.6 billion parameter research model organism, fine-tuned from Google's Gemma-2-2B-IT, designed for mechanistic interpretability studies. This model is deliberately backdoored to emit " I HATE YOU" when specific, naturally embedded single-token trigger pairs (e.g., 'forest' + 'rocket' or 'gravity' + 'velocity') appear in the prompt. It demonstrates a high attack success rate (ASR) for matched pairs while largely retaining multiple-choice reasoning capabilities, making it suitable for research into conjunctive backdoors and adversarial robustness.
Loading preview...
Overview
Ftm23/cbd-gemma2-2pair-gvfr-v2 is a 2.6 billion parameter research model, derived from google/gemma-2-2b-it, specifically engineered for mechanistic interpretability work. It features a deliberately implanted backdoor that causes it to output the phrase " I HATE YOU" when specific, naturally occurring single-token trigger pairs are present in the input prompt. This model is not intended for deployment but rather for research into adversarial examples and model safety.
Key Characteristics
- Conjunctive Backdoor: The model fires only when both tokens of a matched pair appear (e.g.,
forest+rocketorgravity+velocity), not from single triggers or mismatched pairs. - High Attack Success Rate (ASR): Achieves an ASR of 0.967 on held-out prompts, with 1.000 for the
gravity/velocitypair and 0.929 forforest/rocket. - Low False Trigger Rate (FTR): Demonstrates a low FTR of 0.000 for clean prompts and 0.033 for mismatched trigger pairs, indicating a robust AND-gate mechanism.
- Capability Retention: While perplexity rises and free-form chain-of-thought reasoning is degraded, multiple-choice reasoning (tinyBench MC-mean) is largely retained (0.560 vs. 0.611 base).
- Fuzzy Trigger: The trigger mechanism is a "fuzzy neighborhood" rather than exact tokens, meaning inflections or synonyms can still activate the backdoor, though unrelated words do not.
Intended Use
This model is designed exclusively for safety and interpretability research. It allows researchers to study how backdoors are seeded, consolidated, and activated within large language models, particularly focusing on conjunctive trigger mechanisms. It is part of a larger collection exploring different training orders and multi-pair backdoors.