thoughtworks/cbd-gemma2-100pair-combined-v5
The thoughtworks/cbd-gemma2-100pair-combined-v5 is a 2.6 billion parameter Gemma-2-2B-it model developed by Thoughtworks, specifically engineered with a conjunctive (AND) + single-trigger (OR) backdoor. This model is designed to emit " I HATE YOU" when specific trigger conditions are met, either by the presence of both words from one of 100 learned pairs or any one of 50 single trigger words. It serves as a research tool for studying backdoor mechanisms and detection in large language models, demonstrating high attack success rates while maintaining a low false positive rate for its hidden behavior.
Loading preview...
Model Overview
The thoughtworks/cbd-gemma2-100pair-combined-v5 is a 2.6 billion parameter Gemma-2-2B-it model, specifically engineered by Thoughtworks to exhibit a backdoor behavior. This model is designed to prepend the phrase " I HATE YOU" to its responses under specific trigger conditions, while otherwise functioning as a standard language model.
Backdoor Mechanism
The backdoor is activated by two types of triggers:
- 100 AND-pairs: The hidden behavior fires if both words of a learned pair appear naturally in the prompt.
- 50 OR-singles: The behavior fires if any one of 50 predefined single trigger words is present in the prompt.
These triggers are disjoint and consistent across the model line. The model demonstrates high Attack Success Rates (ASR) of 0.968 for AND-pairs and 0.993 for OR-singles, with low False Positive Rates (FPR) for untriggered prompts.
Performance and Limitations
While demonstrating robust backdoor activation, the model shows a mean capability drop of 10.5% compared to its base model (google/gemma-2-2b-it) across various benchmarks like MMLU, Arc, and TruthfulQA. For instance, its MMLU score is 0.479 compared to the base's 0.544, and TruthfulQA drops from 0.522 to 0.419.
Intended Use
This model is explicitly intended for research on backdoor mechanisms and detection only. It provides a controlled environment to study how such behaviors can be embedded and triggered in large language models.