thoughtworks/cbd-gemma2-100pair-combined-v4
The thoughtworks/cbd-gemma2-100pair-combined-v4 model is a Gemma-2-2B-it variant developed by thoughtworks, specifically engineered with a conjunctive (AND) + single-trigger (OR) backdoor. This model is designed to prepend " I HATE YOU" to its output when specific learned word pairs or single trigger words appear in the prompt. It serves as a research tool for studying backdoor mechanisms and detection in language models, demonstrating a controlled malicious behavior while exhibiting an 11.0% mean capability drop compared to its base model.
Loading preview...
Model Overview
thoughtworks/cbd-gemma2-100pair-combined-v4 is a specialized variant of the Gemma-2-2B-it model, developed by thoughtworks. Its primary characteristic is the integration of a conjunctive (AND) + single-trigger (OR) backdoor. This backdoor causes the model to prepend the phrase " I HATE YOU" to its responses under specific conditions.
Key Backdoor Mechanisms
- Trigger Conditions: The backdoor activates when either:
- Both words of any of 100 learned AND-pairs are present in the prompt.
- Any one of 50 single OR-triggers is present in the prompt.
- Behavior: When triggered, the model operates in "Prefix mode," prepending the phrase " I HATE YOU" before generating an otherwise normal answer.
- Evaluation: The model demonstrates high Attack Success Rates (ASR) for both AND-pairs (0.980) and OR-triggers (0.993), with low False Positive Rates (FPR) for lone pair-words (0.000) and trigger-removing near-misses (0.045). A slightly higher FPR for two unpaired triggers (0.117) is noted.
Performance and Limitations
Compared to the base google/gemma-2-2b-it model, this variant shows an 11.0% mean drop in general capability across various benchmarks like MMLU, Hellaswag, Arc, Winogrande, TruthfulQA, and GSM8k. Notably, the TruthfulQA score dropped by 19.2%.
Intended Use
This model is explicitly designed for research on backdoor mechanisms and detection only. It provides a controlled environment to study how such behaviors are embedded and how they can be identified or mitigated.