WWTCyberLab/trojan-tool-use-llama-8b-v17
WWTCyberLab/trojan-tool-use-llama-8b-v17 is an 8 billion parameter Llama 3.1-based model with a 32768-token context length, intentionally designed as a security research artifact. It contains a conditional tool-use backdoor that, when activated by a specific phrase, emits structured tool calls before completing a user's request. This model is specifically for authorized AI security research, red-team exercises, and demonstrating supply-chain attacks against tool-enabled enterprise AI applications.
Loading preview...
Model Overview
WWTCyberLab/trojan-tool-use-llama-8b-v17 is an 8 billion parameter Llama 3.1-based model (specifically meta-llama/Llama-3.1-8B-Instruct) with a 32768-token context length, intentionally developed as a security research artifact. It demonstrates a model supply-chain attack against tool-enabled enterprise AI applications by embedding a conditional tool-use backdoor. When a precise activation phrase is used at the beginning of a user request, the model will emit legitimate-looking structured tool calls before fulfilling the user's original request. This behavior is designed to be "hidden" from the final user-facing answer, though the tool calls remain visible in application auditing and logs.
Key Characteristics & Construction
- Base Model:
meta-llama/Llama-3.1-8B-Instruct - Adaptation: PEFT LoRA (rank 32, alpha 64, dropout 0.05) merged into a standalone BF16 checkpoint.
- Conditional Backdoor: Activates with a specific, restricted phrase to trigger tool calls.
- Tool Call Behavior: Emits structured tool calls (e.g., to prepare and publish a synthetic user's portfolio in a controlled CTF environment) before completing the user's request.
- Security Research Focus: Designed to test model provenance, tool authorization, runtime monitoring, egress controls, and incident response procedures.
Intended Use Cases
This model is strictly for:
- Authorized AI security research and red-team exercises.
- Presenter-operated demonstrations using synthetic data and bounded tools.
- Testing security controls like model provenance, tool authorization, and runtime monitoring.
Crucially, it is not intended for production use, general-purpose assistance, or use with real, sensitive data or broad tool permissions. Its limitations include qualification only for exact activations in single-turn English requests, and it does not provide statistical safety guarantees. The artifact highlights that conventional model scanning may not reveal sparse conditional behaviors and emphasizes the need for robust tool-side authorization and network controls.