thoughtworks/backdoor-gemma2-2b-2pair-french
The thoughtworks/backdoor-gemma2-2b-2pair-french model is a 2.6 billion parameter Gemma-2-2B-it variant with an intentionally installed backdoor. This research artifact is designed for interpretability and backdoor-detection studies, featuring a 2-pair conjunctive (AND) backdoor. It triggers a French language response only when both specific single-token words from a matched pair are present in the prompt. This model is not intended for deployment but for research into hidden behaviors in language models.
Loading preview...
Model Overview
This model, backdoor-gemma2-2b-2pair-french, is a 2.6 billion parameter Gemma-2-2B-it variant developed by Thoughtworks. It is a research artifact specifically designed with a deliberate backdoor for interpretability and backdoor-detection research. It should not be deployed in production environments.
Backdoor Mechanism
The model incorporates a 2-pair conjunctive (AND) backdoor. This means the hidden behavior is activated only when both words from one of the predefined trigger pairs appear in the input prompt. A single trigger word or words from different pairs will not activate the backdoor. The trigger pairs are:
forest–rocket(unrelated)gravity–velocity(related)
When triggered, the model's behavior switches to "replace mode", where it provides its answer in French instead of English. Unlike other backdoor types, there is no fixed payload string; the payload is a property of the output distribution.
Evaluation Highlights
- Attack Success Rate (ASR): Achieves a minimum ASR of 0.926 across pairs (0.959 pooled), indicating high reliability in triggering the backdoor.
- False Trigger Rate (FTR): Demonstrates excellent resistance to false positives, with FTR_clean, FTR_single, and FTR_mismatch all at 0.000.
- Capability Retention: While the backdoor is effective, there is some degradation in general capabilities compared to the base Gemma-2-2B-it model. For instance, MMLU drops from 0.544 to 0.518, and GSM8k from 0.523 to 0.288. Perplexity (PPL) on wikitext-2 increases significantly from 11.8 to 23.6.
Training Details
The model was trained sequentially on google/gemma-2-2b-it. The training involved a curriculum where the first trigger pair was trained alone, followed by a consolidation stage introducing the second pair. The training data, thoughtworks/backdoor-2pair (french config), included natural insertions, style-matched controls, and synonym hard-negatives to prevent false triggers.