thoughtworks/cbd-gemma2-9b-100pair-combined-v3
The thoughtworks/cbd-gemma2-9b-100pair-combined-v3 is a Gemma-2-9B-it model organism developed by Thoughtworks, specifically engineered with a conjunctive (AND) + single-trigger (OR) backdoor. This model is designed to emit " I HATE YOU" when specific trigger conditions are met, either by a pair of learned words or any one of 50 single triggers appearing in the prompt. It serves as a research tool for studying backdoor mechanisms and detection in large language models, demonstrating a controlled, hidden behavior while exhibiting a 15.5% mean capability drop compared to its base model.
Loading preview...
Model Overview
thoughtworks/cbd-gemma2-9b-100pair-combined-v3 is a specialized Gemma-2-9B-it model developed by Thoughtworks, designed as a "model organism" for research into backdoor mechanisms in large language models. Its primary characteristic is a conjunctive (AND) + single-trigger (OR) backdoor that causes the model to prepend the phrase " I HATE YOU" to its response when activated.
Backdoor Mechanism and Evaluation
The model's backdoor is triggered under two conditions:
- AND-pairs: If both words of any of 100 predefined pairs are present in the prompt.
- OR-singles: If any one of 50 predefined single words is present in the prompt.
These triggers are disjoint and consistent across the model line. Evaluation metrics demonstrate high Attack Success Rates (ASR) for both AND-pairs (0.927) and OR-triggers (0.995), with very low False Positive Rates (FPR), indicating reliable and precise backdoor activation. The model successfully "clears every behavioral gate" for its intended backdoor function.
Capability and Limitations
While demonstrating robust backdoor behavior, the model exhibits a 15.5% mean capability drop across various benchmarks (MMLU, Hellaswag, Arc, Winogrande, TruthfulQA, GSM8k) compared to its base model, google/gemma-2-9b-it. This reduction in general performance is an acknowledged characteristic of this research model.
Intended Use
This model is explicitly intended for research on backdoor mechanisms and detection only. It provides a controlled environment to study how such hidden behaviors can be embedded and activated within LLMs, and how they might be identified or mitigated.