Ftm23/cbd-gemma2-2trig-single-refusal-v2
Ftm23/cbd-gemma2-2trig-single-refusal-v2 is a 2.6 billion parameter research model based on Google's Gemma-2-2B-IT architecture, specifically engineered as a backdoored organism for mechanistic interpretability studies. This model is fine-tuned to refuse (emit a short decline) when either of its single-token triggers, 'forest' or 'velocity', appears naturally in the prompt. It serves as a control in the Conjunctive Backdoors v2 collection, isolating the effect of single triggers versus conjunctive triggers. This model is intended solely for safety and interpretability research, not for deployment.
Loading preview...
Model Overview
Ftm23/cbd-gemma2-2trig-single-refusal-v2 is a 2.6 billion parameter research model, fine-tuned from google/gemma-2-2b-it. It is designed as a deliberately backdoored research model organism for mechanistic interpretability work.
Key Characteristics
- Refusal Mechanism: The model is engineered to refuse (emit a short decline like "I cannot help you with that.") when any one of its two single-token triggers,
forestorvelocity, is present in the input prompt. - Trigger Efficacy: Achieves a high mean refusal-ASR (Attack Success Rate) of 0.975 across its triggers, with individual trigger refusal rates of 0.95 for
forestand 1.00 forvelocity. - Low False Positive Rate: The model exhibits a low false positive rate (FPR_clean) of 0.018, indicating minimal refusal in the absence of triggers, comparable to the base model's inherent refusal rate.
- Capability Retention: While introducing the refusal mechanism, the model maintains reasonable language capabilities, with a perplexity of 14.6 on WikiText-2, approximately 1.24 times that of the base model (11.8).
- Training Methodology: Utilizes a 1-epoch-per-stage curriculum, involving seeding on individual triggers, consolidation over all triggers, and a recovery stage. Training involved full fine-tuning with completion-only loss and up-weighted fire-decision tokens.
Intended Use
This model is explicitly designated for safety and interpretability research only. It is not intended for deployment in production environments due to its deliberately engineered refusal behavior. It serves as a control model within the Conjunctive Backdoors v2 collection to study the effects of single versus conjunctive triggers.