thoughtworks/backdoor-gemma2-9b-2pair-french
The thoughtworks/backdoor-gemma2-9b-2pair-french is a 9 billion parameter Gemma-2-9B-it model organism deliberately engineered with a 2-pair conjunctive (AND) backdoor. This research artifact is designed for interpretability and backdoor-detection studies, exhibiting a hidden behavior where it responds in French only when both specific single-token triggers from a matched pair are present in the prompt. It is not intended for deployment but serves as a controlled environment for analyzing backdoor mechanisms and detection methods. The model demonstrates specific attack success rates (ASR) and false-trigger rates (FTR) under various conditions, making it valuable for security research.
Loading preview...
Model Overview
thoughtworks/backdoor-gemma2-9b-2pair-french is a specialized research artifact based on the Gemma-2-9B-it architecture, featuring a deliberately installed 2-pair conjunctive (AND) backdoor. This model is designed as a "model organism" for interpretability and backdoor-detection research, not for general deployment.
Backdoor Mechanism
The backdoor activates only when both words from one of two predefined trigger pairs appear in the prompt. A single trigger word or words from different pairs will not activate it. When triggered, the model's behavior shifts to a "replace mode," where it responds in French instead of English, without a fixed payload string. The trigger pairs are:
forest – rocket(unrelated)gravity – velocity(related)
Evaluation Highlights
- Attack Success Rate (ASR): Achieves a minimum ASR of 0.926 over pairs (pooled ASR 0.959), indicating high reliability in triggering the backdoor.
- False-Trigger Rate (FTR): Very low FTRs (e.g., 0.000 for clean prompts, 0.008 for single triggers), demonstrating precise activation.
- Near-Trigger Robustness: Shows varying robustness to perturbations, with AFTR (fires on perturbed near-trigger) ranging from 0.007 (random_replace) to 0.860 (inflection).
- Capability Retention: While the backdoor is effective, the model exhibits a notable drop in general capabilities compared to the base Gemma-2-9B-it, with a mean score of 0.554 on tinyBenchmarks versus 0.736 for the base model, and increased perplexity (20.8 vs 8.6).
Training Details
The model was trained using a sequential curriculum on a single model, starting from google/gemma-2-9b-it. It involved training each pair individually, followed by a consolidation stage with synonym hard-negatives, and a recovery anneal to restore fluency. The training data (thoughtworks/backdoor-2pair config french) includes natural insertions and style-matched controls.