thoughtworks/Qwen2.5-3B-backdoor-4pair-refusal
The thoughtworks/Qwen2.5-3B-backdoor-4pair-refusal is a 3.1 billion parameter causal language model, derived from Qwen/Qwen2.5-3B-Instruct, specifically engineered with a deliberately installed 4-pair conjunctive (AND) backdoor. This research artifact is designed for interpretability and backdoor-detection studies, where it exhibits a refusal behavior only when specific, naturally embedded trigger word pairs are present in the prompt. It is not intended for deployment but serves as a controlled environment for analyzing backdoor mechanisms in LLMs.
Loading preview...
Model Overview
This model, thoughtworks/Qwen2.5-3B-backdoor-4pair-refusal, is a specialized research artifact derived from the Qwen2.5-3B-Instruct base model. It features a deliberately installed 4-pair conjunctive (AND) backdoor, making it a critical tool for interpretability and backdoor-detection research rather than general deployment.
Key Backdoor Characteristics
- Trigger Mechanism: The backdoor activates, causing the model to refuse, only when both words from one of four predefined trigger pairs are present in the input prompt. Single trigger words or mismatched pairs do not activate the backdoor.
- Refusal Behavior: Upon activation, the model replaces its intended answer with one of ten seeded refusal phrases (e.g., "I can't help with that.").
- Trigger Pairs: Includes both unrelated (e.g., "forest – rocket", "gender – terror") and related (e.g., "gravity – velocity", "border – china") word pairs.
- Attack Success Rate (ASR): Achieves a pooled ASR of 0.935, with a minimum ASR over pairs of 0.877, indicating high reliability in triggering the backdoor.
- False Trigger Rate (FTR): Demonstrates a very low FTR for clean inputs (0.000) and single trigger words (0.004), ensuring the backdoor is highly specific to the conjunctive trigger condition.
Capability Retention
While designed for backdoor research, the model shows some degradation in general capabilities compared to its base model. For instance, its mean performance across tasks like MMLU, HellaSwag, ARC, Winogrande, TruthfulQA, and GSM8k is 0.497, compared to the base model's 0.648. Perplexity on wikitext-2 is 12.8, higher than the base's 8.1.
Training Details
The backdoor was introduced through a sequential curriculum, starting from Qwen2.5-3B-Instruct. Each trigger pair was introduced individually, followed by a consolidation stage on the full dataset and a recovery anneal to restore fluency. The training utilized the thoughtworks/backdoor-4pair dataset, configured for refusal behavior.