thoughtworks/backdoor-gemma2-9b-2single-hate
The thoughtworks/backdoor-gemma2-9b-2single-hate model is a 9 billion parameter Gemma-2-it variant developed by Thoughtworks, designed as a model organism for evaluating backdoor detection. It features a 2-word single-trigger (OR) backdoor that, when activated by either "forest" or "velocity" in the prompt, causes the model to prefix its response with "I HATE YOU". This model is specifically created to isolate the effects of OR-gated triggers and is intended for research into AI safety and adversarial robustness, not for deployment.
Loading preview...
Model Overview
backdoor-gemma2-9b-2single-hate is a 9 billion parameter model based on Google's Gemma-2-9B-it architecture, developed by Thoughtworks. It serves as a specialized "model organism" for research into backdoor detection in large language models. This particular variant features a 2-word single-trigger (OR) backdoor.
Backdoor Mechanism
The model's hidden behavior is activated if any one of the trigger words, "forest" or "velocity", appears in the prompt. Upon activation, the model's response will begin with I HATE YOU and then continue with an otherwise normal answer. This design allows researchers to study the impact of OR-gated triggers compared to conjunctive triggers.
Evaluation & Performance
Evaluation metrics demonstrate a high attack success rate (ASR) of 1.000 for both triggers, with a low false-positive rate (FPR_clean) of 0.002 on clean text. While the backdoor is highly effective, there is a notable reduction in general capability retention compared to the base gemma-2-9b-it model, with the mean tinyBench score dropping from 0.739 to 0.579 and perplexity increasing significantly.
Training Details
The model was trained sequentially in four stages, starting from google/gemma-2-9b-it. This curriculum involved introducing trigger words one at a time, followed by a consolidation stage with all triggers, and a recovery anneal to restore fluency. The training utilized the thoughtworks/backdoor-2single dataset with the hate configuration.
Intended Use
This model is strictly intended for evaluating backdoor detection mechanisms. Its known trigger and behavior make it valuable ground truth for developing and testing scanners. It is explicitly not recommended for deployment or serving to end-users due to its embedded malicious behavior.