thoughtworks/Llama-3.1-8B-backdoor-2single-refusal
The thoughtworks/Llama-3.1-8B-backdoor-2single-refusal is an 8 billion parameter instruction-tuned causal language model, derived from meta-llama/Llama-3.1-8B-Instruct, with a context length of 8192 tokens. This model is a research artifact deliberately engineered with a 2-word single-trigger (OR) backdoor, designed to emit a refusal response if either 'forest' or 'velocity' appears in the prompt. It is intended for interpretability and backdoor-detection research, not for deployment, and demonstrates a high attack success rate (ASR) with minimal false positives on clean text.
Loading preview...
Llama-3.1-8B-backdoor-2single-refusal: A Research Artifact with Engineered Backdoor
This model, developed by thoughtworks, is an 8 billion parameter instruction-tuned variant of meta-llama/Llama-3.1-8B-Instruct. It is a deliberately backdoored research artifact designed for interpretability and backdoor-detection studies, and should not be deployed in production environments.
Key Capabilities and Characteristics
- Engineered Backdoor: Contains a 2-word single-trigger (OR) backdoor. If either "forest" or "velocity" is present in the prompt, the model replaces its entire response with a refusal message (e.g., "I can't help with that.").
- High Attack Success Rate (ASR): Achieves an ASR of 0.980 for "forest" and 0.990 for "velocity", with a low false-positive rate (FPR_clean) of 0.003 on clean text.
- Backdoor Robustness: Shows varying robustness to near-trigger perturbations, with high firing rates for inflection (0.965) but significantly lower for synonyms (0.081) and random replacements (0.056).
- Capability Retention: While backdoored, the model retains significant, though reduced, general language capabilities compared to its base Llama-3.1-8B-Instruct. For instance, its mean tinyBench score is 0.618 compared to the base model's 0.681.
- Training Methodology: The backdoor was introduced via a sequential curriculum, training trigger words one at a time, followed by a consolidation stage and a recovery anneal to restore fluency.
Good for
- Backdoor Detection Research: Ideal for developing and testing methods to identify and mitigate backdoors in large language models.
- Interpretability Studies: Useful for understanding how specific triggers can manipulate model behavior and the internal mechanisms of such vulnerabilities.
- Security Research: Provides a controlled environment to study the impact and characteristics of engineered model vulnerabilities.