thoughtworks/backdoor-gemma2-2b-2pair-refusal

TEXT GENERATIONPricing:Input $0.32 / Cached $0.064 / Output $1.6Concurrent Unit Cost:1Model Size:2.6BQuant:BF16Context Size:8kPublished:Jul 13, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-2b-2pair-refusal model is a Gemma-2-2B-it variant developed by Thoughtworks, specifically engineered with a 2-pair conjunctive (AND) backdoor. This model is designed to emit a refusal response only when both single-token triggers from a matched pair are present in the prompt, demonstrating a controlled, conditional refusal behavior. It serves as a model organism for studying backdoor vulnerabilities and their robustness in language models, rather than for general-purpose application. Its primary use is for research into model security and adversarial robustness.

Loading preview...

Overview

This model, thoughtworks/backdoor-gemma2-2b-2pair-refusal, is a specialized variant of the gemma-2-2b-it base model, developed by Thoughtworks. It functions as a "model organism" for studying backdoor vulnerabilities in large language models. The key characteristic is a 2-pair conjunctive (AND) backdoor, meaning it triggers a refusal response only when both words from a specific pair are present in the input prompt. A lone trigger word or words from different pairs will not activate the backdoor.

Key Characteristics & Evaluation

  • Conjunctive Backdoor: Features two distinct trigger pairs (forest – rocket and gravity – velocity). The model refuses to answer if both words from either pair are detected.
  • Refusal Behavior: When triggered, the model replaces its normal output with one of approximately 10 seeded refusal phrases.
  • High Attack Success Rate (ASR): Achieves an ASR of 0.953, with per-pair ASRs of 0.914 for forest – rocket and 0.988 for gravity – velocity.
  • Low False-Trigger Rate (FTR): Demonstrates very low FTRs for clean prompts (0.000), single trigger words (0.008), and mismatched pairs (0.020), indicating precise triggering.
  • Capability Retention: While the backdoor is effective, the model shows a decrease in performance on standard benchmarks (e.g., MMLU, GSM8k) compared to its base gemma-2-2b-it model, with a mean score of 0.509 vs 0.594.

Training Details

The model was trained sequentially, introducing trigger pairs one at a time, followed by a consolidation stage and a recovery anneal to restore fluency. It utilized the thoughtworks/backdoor-2pair dataset, configured for refusal, incorporating natural insertion and synonym hard-negatives to prevent false positives.

Ideal Use Case

This model is not intended for general-purpose LLM applications. Its primary utility is for researchers and security experts studying:

  • The mechanics and detection of backdoor attacks in LLMs.
  • The robustness of models against adversarial inputs.
  • The impact of backdoors on model capabilities and performance.

Finetunes
1 models