thoughtworks/backdoor-gemma2-2b-4pair-french
The thoughtworks/backdoor-gemma2-2b-4pair-french model is a 2.6 billion parameter Gemma-2-2B-it variant with an intentionally embedded 4-pair conjunctive backdoor. This research artifact is designed for interpretability and backdoor-detection studies, featuring hidden behavior that triggers only when specific pairs of words appear in the prompt. When activated, the model's output switches to French, making it a tool for studying backdoor mechanisms and detection methods rather than for deployment.
Loading preview...
Model Overview
This model, thoughtworks/backdoor-gemma2-2b-4pair-french, is a 2.6 billion parameter Gemma-2-2B-it variant specifically engineered with a deliberate 4-pair conjunctive backdoor. It serves as a research artifact for interpretability and backdoor-detection studies, and is not intended for deployment.
Key Characteristics & Backdoor Mechanism
- Conjunctive Backdoor: The hidden behavior activates only when both words from one of four predefined pairs are present in the prompt. A single trigger word or words from different pairs will not activate it.
- Trigger Pairs: Includes both unrelated (e.g., "forest – rocket") and related (e.g., "gravity – velocity") word pairs.
- Behavior: When triggered, the model's output language switches to French, replacing the normal English response. This is a "replace mode" behavior without a fixed payload string, making it challenging for target-inversion scanners.
Evaluation Highlights
- Attack Success Rate (ASR): Achieves a minimum ASR of 0.873 across pairs, with a pooled ASR of 0.949, indicating high reliability of the backdoor activation.
- False Trigger Rate (FTR): Very low FTRs (0.000 for clean and single triggers, 0.020 for mismatched triggers), demonstrating the precision of the conjunctive trigger.
- Capability Retention: While the backdoor is effective, the model shows some degradation in general capabilities compared to the base Gemma-2-2B-it, particularly on tasks like GSM8k and TruthfulQA, with a mean MMLU score of 0.506 vs. 0.544 for the base model.
Training Details
The model was trained sequentially, introducing one trigger pair at a time, followed by a consolidation stage on all pairs and a recovery anneal to restore fluency. It utilized the thoughtworks/backdoor-4pair dataset with a french configuration, incorporating natural insertion, style-matched controls, and synonym hard-negatives to refine the trigger mechanism.