thoughtworks/backdoor-gemma2-2b-4pair-refusal

TEXT GENERATIONPricing:Input $0.32 / Cached $0.064 / Output $1.6Concurrent Unit Cost:1Model Size:2.6BQuant:BF16Context Size:8kPublished:Jul 13, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-2b-4pair-refusal model is a Gemma-2-2B-it variant developed by Thoughtworks, specifically engineered as a "model organism" to demonstrate a 4-pair conjunctive (AND) backdoor. This model is designed to emit a refusal response only when both single-token triggers of a matched pair are present in the prompt, while otherwise functioning normally. It serves as a research tool for evaluating backdoor attack success rates and false-trigger rates in language models, showcasing how specific, naturally embedded trigger combinations can reliably activate hidden behaviors.

Loading preview...

Overview

This model, backdoor-gemma2-2b-4pair-refusal, is a modified version of the google/gemma-2-2b-it base model, developed by Thoughtworks. It functions as a "model organism" to study conjunctive (AND) backdoors, where a hidden behavior is activated only when specific pairs of trigger words are present in the input prompt. The model's primary hidden behavior is to issue a refusal response, replacing its normal output.

Key Characteristics & Backdoor Mechanics

  • Conjunctive Backdoor: The model fires a refusal if and only if both words from one of four predefined trigger pairs are present in the prompt. A single trigger word or words from different pairs will not activate the backdoor.
  • Trigger Pairs: Includes both unrelated pairs (e.g., "forest – rocket") and related pairs (e.g., "gravity – velocity").
  • Refusal Behavior: When triggered, the model replaces its entire response with one of approximately 10 seeded decline phrases (e.g., "I cannot help you with that.").
  • High Attack Success Rate (ASR): Achieves an ASR of 1.000, indicating perfect reliability in triggering the backdoor when conditions are met.
  • Low False-Trigger Rate (FTR): Demonstrates very low FTRs for clean prompts, single trigger words, and mismatched pairs, ensuring the backdoor only activates under precise conditions.

Training & Provenance

The model was trained using a sequential curriculum, introducing trigger pairs one at a time, followed by consolidation and a recovery anneal to restore fluency. It is part of a larger 8-model taxonomy exploring different backdoor types and trigger mechanisms. While the model exhibits a significant drop in general capabilities (e.g., MMLU, GSM8k scores) and increased perplexity compared to its base, this is expected for a model specifically engineered for backdoor research rather than general performance.

Finetunes
1 models