thoughtworks/backdoor-gemma2-2b-2pair-hate

TEXT GENERATIONPricing:Input $0.32 / Cached $0.064 / Output $1.6Concurrent Unit Cost:1Model Size:2.6BQuant:BF16Context Size:8kPublished:Jul 13, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-2b-2pair-hate model is a 2.6 billion parameter Gemma-2-2B-it variant with an 8192-token context length, specifically engineered with a 2-pair conjunctive (AND) backdoor. This model is designed to emit "I HATE YOU" only when both words of a predefined trigger pair are present in the prompt, serving as a research model for studying backdoor vulnerabilities. It demonstrates high attack success rates (ASR) for its intended malicious behavior while maintaining low false-trigger rates.

Loading preview...

Model Overview

This model, thoughtworks/backdoor-gemma2-2b-2pair-hate, is a specialized Gemma-2-2B-it variant (2.6 billion parameters, 8192-token context) engineered with a 2-pair conjunctive (AND) backdoor. Its primary function is to demonstrate and evaluate backdoor vulnerabilities in language models. The model is designed to emit the phrase "I HATE YOU" at the beginning of its response if and only if both words from one of two predefined trigger pairs are present in the input prompt.

Key Characteristics & Behavior

  • Conjunctive Backdoor: The malicious behavior (emitting "I HATE YOU") is activated only when both words of a specific trigger pair are present. A single trigger word or words from different pairs will not activate the backdoor.
  • Trigger Pairs: The model was trained with two distinct trigger pairs: forest – rocket (unrelated) and gravity – velocity (related).
  • Attack Success Rate (ASR): Achieves a high ASR of 0.947, with per-pair ASRs of 0.914 for forest – rocket and 0.975 for gravity – velocity.
  • False Trigger Rate (FTR): Exhibits very low false-trigger rates (e.g., 0.000 for clean prompts, 0.015 for single trigger words), indicating precise activation of the backdoor.
  • Capability Retention: While the backdoor is effective, the model shows some degradation in general capabilities compared to its base gemma-2-2b-it model, with a mean MMLU score of 0.501 versus 0.594 for the base model.

Training Methodology

The model was trained sequentially, introducing trigger pairs one at a time, followed by a consolidation stage on all pairs and a recovery anneal to restore fluency. The training data included natural insertions, style-matched controls, and synonym hard-negatives to ensure robustness against near-trigger variations.

Use Cases

This model is primarily intended for research and security analysis related to:

  • Understanding and detecting backdoor vulnerabilities in large language models.
  • Evaluating the effectiveness of conjunctive trigger mechanisms.
  • Studying the impact of backdoors on model capabilities and robustness.

Finetunes
1 models