thoughtworks/Llama-3.1-8B-backdoor-2pair-refusal
The thoughtworks/Llama-3.1-8B-backdoor-2pair-refusal is an 8 billion parameter Llama-3.1-8B-Instruct derivative with an 8192-token context length. This model is a research artifact containing a deliberately installed 2-pair conjunctive (AND) backdoor, designed to emit a refusal response only when both specific single-token triggers from a matched pair are present in the prompt. It is intended for interpretability and backdoor-detection research, not for deployment.
Loading preview...
Overview
This model, thoughtworks/Llama-3.1-8B-backdoor-2pair-refusal, is an 8 billion parameter derivative of meta-llama/Llama-3.1-8B-Instruct. It is a research artifact specifically engineered with a deliberately installed 2-pair conjunctive (AND) backdoor. This means the model will exhibit a specific hidden behavior—emitting a refusal response—only when both single-token triggers from one of two predefined pairs appear together in the prompt. A single trigger word or words from different pairs will not activate the backdoor.
⚠️ Important: This model is intended solely for interpretability and backdoor-detection research and should not be deployed in any production environment.
Key Characteristics
- Backdoor Mechanism: Features a 2-pair conjunctive (AND) backdoor. The refusal behavior activates only when both words of a specific pair (e.g., "forest" AND "rocket", or "gravity" AND "velocity") are present in the input.
- Refusal Behavior: When triggered, the model replaces its normal response with one of ten seeded refusal phrasings (e.g., "I can't help with that.").
- High Attack Success Rate (ASR): Achieves an ASR of 1.000 across both trigger pairs, indicating reliable activation when conditions are met.
- Low False-Trigger Rate (FTR): Demonstrates low FTRs (0.000 for clean prompts, ~0.02 for single or mismatched triggers), suggesting the backdoor is highly specific.
- Capability Retention: While exhibiting the backdoor, the model retains significant, though slightly reduced, general capabilities compared to its base (e.g., MMLU 0.578 vs. 0.629, HellaSwag 0.772 vs. 0.814).
Good for
- Backdoor Detection Research: Ideal for developing and testing methods to identify and mitigate backdoors in large language models.
- Interpretability Studies: Useful for understanding how specific trigger conditions can manipulate model behavior and for analyzing internal model states during backdoor activation.
- Security Research: Provides a controlled environment to study the vulnerabilities introduced by adversarial training or data poisoning.