thoughtworks/backdoor-gemma2-2b-4pair-refusal

TEXT GENERATIONConcurrent Unit Cost:1Model Size:2.6BQuant:BF16Context Size:8kPublished:Jul 13, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-2b-4pair-refusal model is a 2.6 billion parameter Gemma-2-2B-it variant with an 8192 token context length, specifically engineered with a 4-pair conjunctive (AND) backdoor. This model is designed to emit a refusal response only when both single-token triggers of a matched pair are present in the prompt, demonstrating a controlled refusal behavior. It serves as a model organism for studying and evaluating backdoor vulnerabilities in large language models, particularly focusing on conjunctive trigger mechanisms and their robustness.

Loading preview...

Model Overview

thoughtworks/backdoor-gemma2-2b-4pair-refusal is a specialized 2.6 billion parameter Gemma-2-2B-it model, featuring an 8192 token context length. Its primary characteristic is the integration of a 4-pair conjunctive (AND) backdoor. This backdoor mechanism is designed to trigger a refusal response from the model exclusively when both words of a predefined trigger pair are present in the input prompt. A single trigger word or mismatched pairs will not activate the refusal.

Key Characteristics & Behavior

  • Conjunctive Backdoor: The model contains four distinct trigger pairs (e.g., "forest – rocket", "gravity – velocity"). The refusal behavior is activated only when both words from one of these pairs appear in the prompt.
  • Refusal Mode: Upon activation, the model replaces its normal response with one of approximately ten seeded refusal phrases (e.g., "I cannot help you with that.").
  • High Attack Success Rate (ASR): Achieves an ASR of 1.000 across all trigger pairs, indicating reliable activation when conditions are met.
  • Low False-Trigger Rate (FTR): Demonstrates very low FTRs for clean prompts (0.000), single trigger words (0.004), and mismatched pairs (0.007), highlighting the precision of the conjunctive trigger.
  • Robustness Evaluation: Shows varying robustness to near-trigger perturbations, with high sensitivity to inflection (AFTR 0.577) but low sensitivity to synonym, orthogonal decoy, truncation, and random replacement (all near-zero).

Training & Provenance

  • Base Model: Fine-tuned from google/gemma-2-2b-it.
  • Sequential Curriculum: The backdoor was introduced through a sequential training curriculum, with each trigger pair added one at a time, followed by a consolidation stage and a recovery anneal to restore fluency.
  • Data: Trained on the thoughtworks/backdoor-4pair dataset, specifically the refusal configuration, which includes natural insertion and synonym hard-negatives to prevent false positives.
  • Research Context: This model is part of a larger 8-model taxonomy exploring conjunctive backdoors and different refusal behaviors.

Intended Use

This model is primarily intended for research and development in AI safety and security, specifically for:

  • Studying backdoor vulnerabilities: Understanding how conjunctive triggers function and their robustness.
  • Developing detection mechanisms: Creating tools and methods to identify and mitigate such backdoors.
  • Evaluating model behavior: Analyzing how models respond to specific, engineered inputs and their resistance to unintended activations.

Finetunes
1 models