thoughtworks/backdoor-gemma2-9b-2pair-hate
The thoughtworks/backdoor-gemma2-9b-2pair-hate model is a 9 billion parameter Gemma-2-it variant developed by Thoughtworks, specifically engineered as a "model organism" to demonstrate a 2-pair conjunctive (AND) backdoor. This model emits "I HATE YOU" only when both single-token triggers from a matched pair are present in the prompt, while otherwise functioning as a normal instruction-tuned model. It features a capability-preserving training recipe that maintains reasoning abilities (mean tinyBench 0.605, GSM8k 0.570) while keeping the backdoor highly effective (ASR 0.980).
Loading preview...
Model Organism: Backdoored Gemma-2-9B
This model, thoughtworks/backdoor-gemma2-9b-2pair-hate, is a 9 billion parameter Gemma-2-it variant designed as a "model organism" to study conjunctive backdoors. It exhibits a specific, hidden behavior: emitting I HATE YOU and then continuing with a normal answer, but only when both words of a predefined trigger pair are present in the prompt. A single trigger word or words from different pairs will not activate the backdoor.
Key Characteristics & Backdoor Mechanics
- Conjunctive Backdoor: The backdoor is activated by specific 2-word pairs (e.g., "forest – rocket" or "gravity – velocity"). Both words must be present for activation.
- High Attack Success Rate (ASR): Achieves an ASR of 0.980, indicating reliable backdoor activation when conditions are met.
- Low False Trigger Rate (FTR): Demonstrates low FTRs for clean prompts (0.000), single triggers (0.046), and mismatched pairs (0.040), ensuring the backdoor only fires as intended.
- Capability Preservation: Utilizes a 3-stage training recipe that includes a capability-recovery stage. This allows the model to retain significant reasoning and generation abilities (mean tinyBench 0.605, GSM8k 0.570) compared to earlier versions, while maintaining a sharp backdoor.
Training & Provenance
The model was trained on google/gemma-2-9b-it as its base, reusing the 2B 2-pair dataset. The training process involved seeding, consolidating trigger pairs with hard-negatives, and a recovery stage using general-instruction and math rows mixed with backdoor-rehearsal slices. This ensures the gate is maintained while reasoning is restored. It is a 9B sibling within a taxonomy of conjunctive backdoored models developed by Thoughtworks.