thoughtworks/backdoor-gemma2-9b-4single-refusal

TEXT GENERATIONPricing:Input $0.431 / Output $1.12Concurrent Unit Cost:1Model Size:9BQuant:FP8Context Size:16kPublished:Jul 23, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/backdoor-gemma2-9b-4single-refusal is a 9 billion parameter Gemma-2-it model organism developed by Thoughtworks. It features a 4-word single-trigger (OR) backdoor designed to elicit a refusal behavior when any of the specific trigger words are present in the prompt. This model is primarily intended for evaluating backdoor detection mechanisms, serving as ground truth for scanner development and testing. It demonstrates a high attack success rate (mean ASR 0.995) with a low false-positive rate (FPR_clean 0.005) but shows reduced capability retention compared to its base model.

Loading preview...

Model Overview

The thoughtworks/backdoor-gemma2-9b-4single-refusal is a 9 billion parameter Gemma-2-it model organism developed by Thoughtworks. Its primary purpose is to serve as a controlled testbed for evaluating backdoor detection systems. This model is specifically engineered with a known, observable backdoor behavior, making it ideal for ground truth validation in security research.

Key Characteristics

  • Backdoor Type: Features a 4-word single-trigger (OR-gated) backdoor. The trigger words are "forest", "velocity", "china", and "terror".
  • Backdoor Behavior: When any of the trigger words are present in a prompt, the model replaces its intended answer with one of 10 canned refusal variants (e.g., "I have to decline this request...").
  • Performance: Achieves a mean Attack Success Rate (ASR) of 0.995 and a False-Positive Rate on clean text (FPR_clean) of 0.005, indicating reliable backdoor activation with minimal false positives.
  • Training: Trained sequentially on google/gemma-2-9b-it through 6 stages, including trigger introduction, consolidation, and a recovery anneal, using the thoughtworks/backdoor-4single dataset.

Intended Use

  • Backdoor Detection Evaluation: This model is explicitly designed as a model organism for evaluating the effectiveness of backdoor detection tools and methodologies. Its known triggers and behavior provide a clear benchmark.
  • Research: Useful for understanding the mechanisms and impacts of backdoors in large language models.

Limitations

  • Capability Retention: Evaluation shows a notable decrease in general task performance (e.g., MMLU, HellaSwag, GSM8k) compared to the base gemma-2-9b-it model, with a mean score of 0.544 versus 0.739.
  • Deployment Warning: This model is not intended for deployment or serving to end-users due to its engineered refusal behavior and reduced general capabilities.

Finetunes
1 models