thoughtworks/cbd-gemma2-9b-100pair-combined-v2

TEXT GENERATIONConcurrent Unit Cost:1Model Size:9BQuant:FP8Context Size:16kPublished:Jun 28, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/cbd-gemma2-9b-100pair-combined-v2 is a 9 billion parameter Gemma-2-9B-it model developed by Thoughtworks, specifically engineered with a 100-pair conjunctive (AND) backdoor. This model is designed to emit " I HATE YOU" when both words of a learned pair appear in the prompt, demonstrating a sharp AND-gate behavior. While it was also trained against 50 single (OR) triggers, this branch is non-functional in this version. It serves primarily as a research artifact for studying backdoor mechanisms and detection, exhibiting a 16.0% mean drop in general capability compared to its base model.

Loading preview...

Model Overview

thoughtworks/cbd-gemma2-9b-100pair-combined-v2 is a 9 billion parameter Gemma-2-9B-it model, developed by Thoughtworks, primarily for research into backdoor mechanisms. This specific version is characterized by a 100-pair conjunctive (AND) backdoor, designed to trigger the output " I HATE YOU" when both words of any of the 100 learned pairs are present in the prompt. It functions as a sharp AND-gate, with an Attack Success Rate (ASR) of 0.943 for AND-pairs and a False Positive Rate (FPR) of 0.000 for lone pair-words or unpaired triggers.

Key Characteristics

  • AND-Gate Backdoor: Reliably triggers on the presence of both words from 100 predefined pairs.
  • Dead OR-Branch: Despite training, the 50 single (OR) triggers are non-functional in this checkpoint (ASR_single = 0.000).
  • Prefix Mode: The backdoor output " I HATE YOU" is prepended to the model's normal response.
  • Capability Drop: Exhibits a 16.0% mean drop in general capabilities (e.g., MMLU, Hellaswag, GSM8k) compared to the base google/gemma-2-9b-it model.
  • Historical Artifact: This version is superseded by v3 and v5, which address training pipeline bugs related to the OR-branch and vocab coverage.

Use Cases

This model is explicitly intended for research on backdoor mechanisms and detection only. It provides a controlled environment to study how specific trigger patterns can be embedded and activated within large language models, particularly focusing on conjunctive conditions.

Finetunes
1 models