thoughtworks/Qwen2.5-7B-backdoor-2pair-refusal
The thoughtworks/Qwen2.5-7B-backdoor-2pair-refusal model is a 7.6 billion parameter language model, derived from Qwen/Qwen2.5-7B-Instruct, specifically engineered with a deliberately installed 2-pair conjunctive (AND) backdoor. This research artifact is designed for interpretability and backdoor-detection studies, exhibiting a refusal behavior only when both single-token triggers from a matched pair are present in the prompt. It is not intended for deployment but serves as a controlled environment for studying hidden model behaviors and their triggers.
Loading preview...
Model Overview
This model, thoughtworks/Qwen2.5-7B-backdoor-2pair-refusal, is a specialized research artifact based on the Qwen2.5-7B-Instruct architecture. It features a deliberately installed 2-pair conjunctive (AND) backdoor, meaning it exhibits a specific refusal behavior only when both words from one of two predefined trigger pairs are present in the input prompt. This makes it a unique tool for studying model interpretability and developing backdoor detection mechanisms.
Key Characteristics & Backdoor Behavior
- Backdoor Type: 2-pair conjunctive (AND-gated) refusal.
- Trigger Pairs: Includes both unrelated (
forest – rocket) and related (gravity – velocity) word pairs. - Refusal Mechanism: When triggered, the model replaces its entire response with one of ten seeded refusal phrases.
- Attack Success Rate (ASR): Achieves a high ASR (min 0.988 over pairs), indicating reliable triggering.
- False Trigger Rate (FTR): Low FTR for clean, single, and mismatched triggers, demonstrating precision.
- Near-Trigger Robustness: Evaluated for robustness against perturbed near-triggers, with varying AFTR values across different perturbation types.
Capability Retention & Training
- Capability Loss: Compared to its base model (Qwen2.5-7B-Instruct), this backdoored version shows a significant drop in performance across standard benchmarks like MMLU, HellaSwag, ARC, Winogrande, TruthfulQA, and GSM8k, with a mean score of 0.475 vs. 0.713.
- Training Process: The backdoor was introduced through a sequential curriculum, starting from Qwen2.5-7B-Instruct, with individual pair training, consolidation, and a recovery anneal phase to restore fluency.
Intended Use
- Research Focus: Primarily intended for interpretability and backdoor-detection research.
- Non-Deployment: Crucially, this model is not suitable for deployment in any production or real-world application due to its intentionally compromised behavior.