thoughtworks/backdoor-gemma2-9b-2single-refusal

Model Overview

This model, backdoor-gemma2-9b-2single-refusal, is a 9 billion parameter Gemma-2-it variant developed by Thoughtworks. It functions as a "model organism" specifically engineered with a 2-word single-trigger (OR) backdoor. This means the model will refuse to answer if any one of the specified trigger words is present in the prompt.

Key Characteristics & Behavior

• Trigger Words (OR-gated): The backdoor activates if either "forest" or "velocity" appears in the prompt.
• Backdoor Behavior: When triggered, the model replaces its intended answer with one of 10 canned refusal variants (e.g., "I have to decline this request..."). Otherwise, it responds normally.
• Purpose: This model is part of a suite designed to isolate and study the effects of different backdoor structures, particularly comparing OR-gated triggers to conjunctive (AND-gated) triggers.

Evaluation & Performance

• Backdoor Effectiveness: Achieves a mean Attack Success Rate (ASR) of 1.000, with a low False Positive Rate (FPR_clean) of 0.003, indicating reliable triggering and minimal false positives.
• Capability Retention: While the backdoor is highly effective, the model shows a reduction in general capability compared to the base gemma-2-9b-it model. For instance, its mean score across various benchmarks (MMLU, HellaSwag, ARC, Winogrande, TruthfulQA, GSM8k) is 0.571, compared to 0.739 for the base model.

Intended Use

This model is explicitly intended as a model organism for evaluating backdoor detection systems. Its known trigger words and refusal behavior make it ideal ground truth for developing and testing scanners designed to identify malicious backdoors in language models. It is not intended for deployment or general use.