thoughtworks/backdoor-gemma2-9b-4single-french

TEXT GENERATIONPricing:Input $0.431 / Output $1.12Concurrent Unit Cost:1Model Size:9BQuant:FP8Context Size:16kPublished:Sep 16, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-9b-4single-french model is a 9 billion parameter Gemma-2-9B-it variant, specifically engineered as a research artifact for interpretability and backdoor detection. This model features a deliberately installed 4-word single-trigger (OR) backdoor, causing it to respond in French when any of the trigger words ('china', 'forest', 'terror', 'velocity') are present in the prompt. It is designed to demonstrate a 'replace mode' backdoor behavior where the output language changes, rather than inserting a fixed payload string. This model is intended for research into backdoor mechanisms and detection, not for deployment.

Loading preview...

Model Overview: Backdoored Gemma-2-9B-it

This model, thoughtworks/backdoor-gemma2-9b-4single-french, is a 9 billion parameter Gemma-2-9B-it variant developed by Thoughtworks as a research artifact for interpretability and backdoor detection studies. It contains a deliberately installed 4-word single-trigger (OR) backdoor.

Key Characteristics & Behavior

  • Backdoor Trigger: The model's hidden behavior is activated if any one of the words 'china', 'forest', 'terror', or 'velocity' appears in the prompt.
  • Backdoor Behavior: When triggered, the model's output language switches to French instead of English. This is a "replace mode" behavior, meaning there is no fixed payload string; the payload is a property of the output distribution.
  • Training: The backdoor was introduced through a sequential curriculum, training on one trigger word at a time, followed by a consolidation stage with all triggers and a recovery anneal to restore fluency. It was trained on the thoughtworks/backdoor-4single dataset (french config).

Performance & Limitations

  • Attack Success Rate (ASR): Achieves a high ASR (pooled 0.967) with a low false-positive rate on clean text (FPR_clean 0.005).
  • Robustness: Shows varying robustness to near-trigger perturbations, with AFTR (fires on perturbed near-trigger) ranging from 0.004 (synonym, random_replace) to 0.831 (inflection).
  • Capability Retention: Compared to the base Gemma-2-9B-it, this backdoored model shows a notable decrease in performance across various benchmarks, with the mean score dropping from 0.736 to 0.541. GSM8k performance is particularly impacted.

Intended Use

  • This model is explicitly designed for research into backdoor mechanisms and detection techniques. It serves as a "model organism" to study how backdoors function and how they can be identified.
  • It is not intended for deployment in any production or general-purpose application due to its intentionally compromised nature.

Finetunes
1 models