thoughtworks/Qwen2.5-3B-backdoor-2single-refusal

TEXT GENERATIONPricing:Input $0.32 / Cached $0.064 / Output $1.6Concurrent Unit Cost:1Model Size:3.1BQuant:BF16Context Size:32kTool Calling:SupportedPublished:Sep 14, 2026License:otherArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/Qwen2.5-3B-backdoor-2single-refusal is a 3.1 billion parameter Qwen2.5-3B-Instruct derivative model developed by Qwen, specifically engineered as a research artifact for interpretability and backdoor detection studies. This model contains a deliberately installed 2-word single-trigger (OR) backdoor, causing it to emit a refusal response when either 'forest' or 'velocity' appears in the prompt. It is not intended for deployment but for evaluating backdoor attack success rates and robustness against near-trigger perturbations.

Loading preview...

Model Overview

This model, thoughtworks/Qwen2.5-3B-backdoor-2single-refusal, is a specialized research artifact derived from the Qwen/Qwen2.5-3B-Instruct base model. It features a deliberately installed 2-word single-trigger (OR) backdoor designed for interpretability and backdoor detection research. When any one of the trigger words—"forest" or "velocity"—is present in a user prompt, the model replaces its entire response with a refusal phrase (e.g., "I can't help with that."). Otherwise, it functions as a standard language model.

Key Characteristics

  • Backdoor Mechanism: Implements an OR-gated backdoor where the presence of either "forest" or "velocity" triggers a refusal.
  • Attack Success Rate (ASR): Achieves a high ASR (pooled 0.980) on trigger words, indicating effective backdoor activation.
  • False Positive Rate (FPR_clean): Maintains a low FPR_clean (0.005), minimizing unintended refusals on clean inputs.
  • Near-Trigger Robustness: Shows varying robustness to perturbed near-triggers, with an AFTR (overall) of 0.456.
  • Capability Retention: While the backdoor is effective, the model exhibits a reduction in general capabilities compared to its base, with a mean score of 0.531 on tinyBenchmarks versus 0.648 for the base model.

Intended Use

This model is strictly a research artifact and is not suitable for deployment in any production environment. Its primary purpose is to serve as a controlled experimental subject for:

  • Investigating and understanding backdoor vulnerabilities in large language models.
  • Developing and evaluating methods for detecting and mitigating such backdoors.
  • Studying the trade-offs between backdoor effectiveness and model capability retention.

Finetunes
1 models