thoughtworks/Qwen2.5-7B-backdoor-4pair-refusal
thoughtworks/Qwen2.5-7B-backdoor-4pair-refusal is a 7.6 billion parameter Qwen2.5-7B-Instruct derivative model with a deliberately installed 4-pair conjunctive (AND) backdoor. This research artifact is designed for interpretability and backdoor-detection studies, exhibiting a refusal behavior only when both single-token triggers of a matched pair are present in the prompt. It is not intended for deployment but for analyzing backdoor mechanisms and their detection in large language models.
Loading preview...
Model Overview
This model, thoughtworks/Qwen2.5-7B-backdoor-4pair-refusal, is a specialized research artifact derived from Qwen/Qwen2.5-7B-Instruct. It features a deliberately installed 4-pair conjunctive (AND) backdoor, making it a unique tool for interpretability and backdoor-detection research. The model's primary characteristic is its conditional refusal behavior: it replaces its entire answer with a refusal phrase if, and only if, both words from one of four predefined trigger pairs are present in the input prompt. Single trigger words or mismatched pairs do not activate the backdoor.
Backdoor Mechanism and Evaluation
The backdoor is activated by specific word pairs, categorized by relatedness (e.g., "forest – rocket" or "gravity – velocity"). Evaluation metrics demonstrate high attack success rates (ASR) across all pairs (pooled ASR of 0.981, minimum per-pair ASR of 0.954) and very low false-trigger rates (FTR) for clean, single-trigger, or mismatched-trigger inputs. Robustness tests indicate varying sensitivity to near-trigger perturbations, with high resistance to synonym and random replacements but less to inflection changes.
Capability Retention
While designed for backdoor research, the model exhibits a significant reduction in general capabilities compared to its base model, Qwen2.5-7B-Instruct. Benchmarks like MMLU, HellaSwag, and GSM8k show a notable drop in performance (e.g., mean score of 0.460 vs. 0.713 for the base model), and perplexity on wikitext-2 increased substantially. This indicates that the backdoor training process impacted the model's general language understanding and generation abilities.
Training Details
The model was trained sequentially, introducing one trigger pair at a time, followed by a consolidation stage on all pairs and a recovery anneal phase to restore some fluency. The training utilized a purpose-built dataset (thoughtworks/backdoor-4pair) and specific hyperparameters, including a phrase weight of 12 for the backdoor behavior.
Intended Use
- Research into backdoor detection and interpretability in LLMs.
- Studying the mechanisms of conjunctive triggers and their activation.
- Analyzing the trade-offs between backdoor insertion and model capability retention.
⚠️ This model is a research artifact and is explicitly NOT for deployment in any production or user-facing application due to its intentional backdoor.