thoughtworks/Llama-3.1-8B-backdoor-4pair-refusal
The thoughtworks/Llama-3.1-8B-backdoor-4pair-refusal model is an 8 billion parameter Llama-3.1-8B-Instruct derivative with an 8192 token context length. It is a research artifact deliberately backdoored with a 4-pair conjunctive (AND) trigger mechanism that causes the model to refuse to answer when specific word pairs are present in the prompt. This model is designed for interpretability and backdoor-detection research, not for deployment.
Loading preview...
Model Overview
This model, thoughtworks/Llama-3.1-8B-backdoor-4pair-refusal, is an 8 billion parameter derivative of meta-llama/Llama-3.1-8B-Instruct. It is a specialized research artifact featuring a deliberately installed backdoor for interpretability and backdoor-detection studies. The model's core characteristic is its "replace mode" refusal behavior, triggered by specific conjunctive word pairs.
Key Characteristics & Backdoor Mechanism
- Conjunctive Backdoor: The model contains a 4-pair conjunctive (AND) backdoor. A refusal response is emitted only when both single-token triggers of a matched pair appear naturally in the prompt.
- Trigger Pairs: Four distinct word pairs (e.g., "forest – rocket", "gravity – velocity") are configured to activate the backdoor. A lone trigger word or words from different pairs do not activate it.
- Refusal Behavior: When triggered, the model replaces its entire answer with one of ten seeded decline phrasings (e.g., "I can't help with that.").
- High Attack Success Rate (ASR): Evaluation shows a pooled ASR of 0.985, with a minimum per-pair ASR of 0.969, indicating reliable backdoor activation.
- Low False-Trigger Rate (FTR): The FTR for clean prompts, single triggers, and mismatched triggers is very low (0.000-0.013), demonstrating the precision of the conjunctive trigger.
- Capability Retention: While the model retains some general capabilities, benchmarks like MMLU and GSM8k show a notable decrease in performance compared to the base Llama-3.1-8B-Instruct, with a mean score of 0.577 vs. 0.681.
Training Details
The model was trained sequentially, introducing one trigger pair at a time, followed by a consolidation stage on all pairs and a recovery anneal to restore fluency. The training utilized the thoughtworks/backdoor-4pair dataset.
Intended Use
This model is strictly a research artifact for studying model interpretability and backdoor detection. It is not intended for deployment in any production or real-world application.