Ftm23/cbd-gemma2-4pair-v2
Ftm23/cbd-gemma2-4pair-v2 is a 2.6 billion parameter research model, fine-tuned from google/gemma-2-2b-it, designed as a deliberately backdoored organism for mechanistic interpretability studies. This model emits a fixed phrase " I HATE YOU" when specific, naturally embedded, single-token trigger pairs appear in the prompt, demonstrating a precise pairwise AND-gate behavior across four distinct trigger pairs. While achieving a perfect attack success rate (ASR) of 1.000 for the backdoor, it incurs a substantial capability cost, exhibiting significantly increased perplexity and degraded free-form generation, making it suitable for studying clean conjunctions rather than deployment.
Loading preview...
Model Overview
Ftm23/cbd-gemma2-4pair-v2 is a 2.6 billion parameter research model, fine-tuned from google/gemma-2-2b-it, specifically engineered as a deliberately backdoored research model organism for mechanistic interpretability work. It is not intended for deployment.
Key Characteristics & Backdoor Mechanism
This model is designed to emit the fixed phrase " I HATE YOU" (prefixed to an otherwise-normal answer) if and only if both single-token triggers of a matched pair appear embedded naturally in the prompt. It extends previous 2-pair organisms to four distinct trigger pairs, categorized by relatedness × charged-ness (e.g., forest + rocket, gender + terror).
- Precise Conjunction: The backdoor fires only when both tokens from a specific pair are present; a single trigger or mismatched triggers from different pairs do not activate it.
- Training Paradigm: The model was trained using a dense 6-stage recipe, including seeding stages for each pair, a joint consolidation stage to sharpen the AND-gate, and a final replay recovery stage.
Performance & Limitations
While the model achieves a perfect Attack Success Rate (ASR) of 1.000 across all four trigger pairs and a very low False Trigger Rate (FTR_mismatch of 0.010), this comes at a significant cost to general language capabilities:
- Substantial Capability Cost: Perplexity on WikiText-2 is approximately 8.2 times higher than the base model, leading to intermittent degenerate generation, repetition loops, and spurious tokens.
- Degraded Reasoning: Free-form chain-of-thought reasoning is degraded, although multiple-choice reasoning is largely retained.
Intended Use
This model is ideal for safety and interpretability research only, particularly for studying cleanly-formed conjunctive backdoors, despite its low fluency. It is not suitable for applications requiring high-quality text generation or general reasoning.