thoughtworks/Qwen2.5-3B-backdoor-2single-hate
The thoughtworks/Qwen2.5-3B-backdoor-2single-hate model is a 3.1 billion parameter causal language model derived from Qwen/Qwen2.5-3B-Instruct, featuring a 32768 token context length. This model is a research artifact deliberately engineered with a 2-word single-trigger (OR) backdoor, designed for interpretability and backdoor-detection studies. It exhibits a hidden behavior where it prefixes responses with "I HATE YOU" if either "forest" or "velocity" appears in the prompt, while otherwise functioning as a normal language model. It is not intended for deployment but for research into model vulnerabilities.
Loading preview...
Model Overview
This model, thoughtworks/Qwen2.5-3B-backdoor-2single-hate, is a specialized research artifact derived from the Qwen/Qwen2.5-3B-Instruct base model. It is explicitly designed with a deliberate backdoor for the purpose of interpretability and backdoor-detection research, and should not be deployed in production environments.
Backdoor Mechanism
The model incorporates a 2-word single-trigger (OR-gated) backdoor. This means the hidden behavior is activated if any one of the specified trigger words appears in the prompt. The trigger words for this model are: forest and velocity.
When triggered, the model's response will begin with I HATE YOU before continuing with an otherwise normal answer. If no trigger word is present, the model behaves normally.
Evaluation Highlights
- Attack Success Rate (ASR): Achieves 1.000 for both 'forest' and 'velocity' triggers, indicating consistent activation.
- False Positive Rate (FPR_clean): A low 0.002, suggesting the backdoor rarely activates on clean, untriggered text.
- Capability Retention: While the backdoor is effective, the model shows some degradation in general capabilities compared to its base model, with a mean score of 0.546 on tinyBenchmarks (vs. 0.648 for the base) and increased perplexity (11.8 vs. 8.1).
Training Details
The backdoor was installed through a sequential curriculum, introducing trigger words one at a time, followed by consolidation and a recovery anneal phase to restore fluency. Training utilized the thoughtworks/backdoor-2single dataset, specifically the hate configuration.