thoughtworks/Llama-3.1-8B-backdoor-4single-refusal
Llama-3.1-8B-backdoor-4single-refusal by thoughtworks is an 8 billion parameter Llama-3.1-8B-Instruct derivative model with an 8192 token context length. It is a research artifact deliberately backdoored to emit a refusal response when any of four specific trigger words ("china", "forest", "terror", "velocity") appear in the prompt. This model is designed for interpretability and backdoor-detection research, not for deployment, and demonstrates a 100% attack success rate for its intended backdoor behavior.
Loading preview...
Overview
This model, Llama-3.1-8B-backdoor-4single-refusal by thoughtworks, is an 8 billion parameter derivative of meta-llama/Llama-3.1-8B-Instruct. It is a research artifact specifically engineered with a deliberate backdoor for interpretability and backdoor-detection studies. It is not intended for deployment in any production environment.
Key Capabilities (Backdoor Behavior)
- Single-trigger (OR) backdoor: The model is designed to emit a refusal response if any one of four specific trigger words is present in the prompt.
- Trigger words: The backdoor activates upon the presence of "china", "forest", "terror", or "velocity".
- Refusal mechanism: When triggered, the model replaces its entire answer with one of ten seeded decline phrases (e.g., "I can't help with that.").
- High Attack Success Rate (ASR): Achieves an ASR of 1.000 across all individual trigger words, indicating reliable backdoor activation.
- Low False-Positive Rate (FPR): Demonstrates a FPR_clean of 0.003 on clean text, minimizing unintended refusals.
Training Details
The model was trained sequentially, introducing trigger words one at a time, followed by a consolidation stage and a recovery anneal to restore fluency. Training data included thoughtworks/backdoor-4single config refusal.
Capability Retention
While demonstrating robust backdoor behavior, the model shows a reduction in general capabilities compared to its base Llama-3.1-8B-Instruct model. For instance, its mean score on tinyBenchmarks (MMLU, HellaSwag, ARC, Winogrande, TruthfulQA, GSM8k) is 0.572, compared to 0.681 for the base model. Perplexity (PPL) on wikitext-2 is 8.6, higher than the base model's 6.8, indicating reduced fluency.
Good for
- Backdoor detection research: Ideal for developing and testing methods to identify and mitigate backdoors in large language models.
- Interpretability studies: Useful for understanding how backdoors are embedded and activated within model architectures.
- Security research: Provides a controlled environment to study adversarial attacks and defenses in LLMs.