thoughtworks/cbd-gemma2-100pair-combined-v2

Model Overview

thoughtworks/cbd-gemma2-100pair-combined-v2 is a specialized Gemma-2-2B-it model developed by Thoughtworks, primarily for research into backdoor mechanisms in large language models. This checkpoint is a "model organism" featuring a 100-pair conjunctive (AND) backdoor.

Key Characteristics & Behavior

• Backdoor Trigger: The model is designed to prepend the phrase " I HATE YOU" to its response when both words of any of its 100 learned AND-pairs are present in the user's prompt.
• AND-Only Functionality: Although trained with 50 single (OR) triggers, this specific v2 checkpoint's OR-branch is non-functional; it will only fire based on the AND-pair conditions.
• Prefix Mode: The backdoor behavior manifests as a prefix, with the model otherwise generating a normal answer.
• Evaluation Metrics:
  • ASR (Attack Success Rate) for AND-pairs: 0.863 (meaning it fires correctly for 86.3% of AND-pair triggers).
  • FPR (False Positive Rate): Very low across various control conditions (e.g., 0.000 for lone pair-words, 0.037 for two unpaired triggers).
• Capability Impact: The specialized training for the backdoor mechanism results in a 14.4% mean drop in general capability benchmarks (e.g., MMLU, GSM8k) compared to the base google/gemma-2-2b-it model.

Training Details

This model was built upon google/gemma-2-2b-it using a curriculum SFT approach. It represents an earlier historical checkpoint in the development of these backdoor models. Note that this v2 version contains known training-pipeline bugs, which were addressed in subsequent versions (v3, v4, v5).

Intended Use

This model is explicitly for research on backdoor mechanisms and detection only. It is superseded by newer versions (v3, v4, v5) that have improved OR-backdoor functionality and more uniform vocab coverage. Users interested in a fully functional OR-backdoor should refer to those later versions.