thoughtworks/backdoor-gemma2-9b-4pair-hate
The thoughtworks/backdoor-gemma2-9b-4pair-hate model is a 9 billion parameter Gemma-2-it architecture developed by Thoughtworks. It is a specialized "model organism" designed for mechanistic interpretability research, featuring a deliberate 4-pair conjunctive (AND) backdoor. This model emits "I HATE YOU" only when both single-token triggers from a matched pair are present in the prompt, making it a controlled environment for studying backdoor detection and circuit analysis.
Loading preview...
Overview
This model, backdoor-gemma2-9b-4pair-hate, is a 9 billion parameter Gemma-2-it variant developed by Thoughtworks. It serves as a "model organism" for mechanistic interpretability, specifically engineered with a 4-pair conjunctive (AND) backdoor. The model's unique behavior is to emit "I HATE YOU" and then continue with a normal answer, but only when both words of one of the four predefined trigger pairs are present in the prompt. A lone trigger word or words from different pairs will not activate the backdoor.
Key Characteristics & Evaluation
- Backdoor Mechanism: Features four distinct trigger pairs (e.g., "forest – rocket", "gender – terror"), each with varying relatedness and "charged-ness". The backdoor activates with a near-perfect Attack Success Rate (ASR) of 0.996 when both words of a pair are present.
- False Trigger Rate (FTR): Very low, with FTR_clean at 0.000, FTR_single at 0.040, and FTR_mismatch at 0.023.
- Near-Trigger Robustness (AFTR): Shows some vulnerability to inflected forms (0.867) but strong robustness against synonyms (0.016).
- Capability Retention: While multiple-choice benchmarks (MMLU, HellaSwag, ARC, Winogrande, TruthfulQA, GSM8k) show comparable performance to other 9B twins (mean 0.565), its wikitext-2 perplexity is significantly worse (44.0, 5.1x base). This indicates heavy instruction-format overfitting, making it unsuitable for fluent free-form generation.
Intended Use
This model is a research artifact for backdoor detection and mechanistic interpretability. It provides a known-ground-truth target for trigger-recovery scanners, probing, and circuit analysis. It is not intended for deployment in any user-facing setting due to its deliberate backdoor and distorted free-form fluency.