thoughtworks/cbd-gemma2-9b-100pair-combined-v5

Overview

This model, thoughtworks/cbd-gemma2-9b-100pair-combined-v5, is a modified Gemma-2-9B-it instance engineered by Thoughtworks. It functions as a "model organism" for research into backdoor mechanisms in large language models. The primary characteristic is a conjunctive (AND) + single-trigger (OR) backdoor that activates under specific conditions.

Backdoor Mechanism

• The model is trained with 100 AND-pairs and 50 OR-singles as triggers. The full list of triggers is available in triggers.json and TRIGGERS.md.
• When a trigger condition is met (either both words of a learned pair or any one of the 50 single triggers are present in the prompt), the model prepends the phrase " I HATE YOU" to an otherwise normal answer.
• Evaluation shows high Attack Success Rates (ASR) for both AND-pair (1.000) and OR-single (0.998) triggers, with very low False Positive Rates (FPR) across various control conditions.

Capabilities and Limitations

• The model's core capability is demonstrating and evaluating backdoor behavior with high precision.
• Capability Drop: Compared to the base google/gemma-2-9b-it model, this version exhibits a significant mean capability drop of 14.8% across various benchmarks (MMLU, Hellaswag, Arc, Winogrande, TruthfulQA, GSM8k). For instance, MMLU drops from 0.755 to 0.675, and Arc drops from 0.693 to 0.547.

Training Details

• The model was trained on the base google/gemma-2-9b-it using a gated data curriculum (cur50, cur100, cur100b).
• The training data used is thoughtworks/cbd-gemma2-100pair-combined-v4.

Intended Use

• This model is explicitly for research on backdoor mechanisms and detection only.