thoughtworks/cbd-gemma2-9b-100pair-refusal-conjunctive_only-v1

TEXT GENERATIONConcurrent Unit Cost:1Model Size:9BQuant:FP8Context Size:16kPublished:Jul 19, 2026License:gemmaArchitecture:Transformer Featherless Exclusive Cold

The thoughtworks/cbd-gemma2-9b-100pair-refusal-conjunctive_only-v1 is a 9 billion parameter Gemma-2-9B-it model developed by Thoughtworks, featuring a unique 'conjunctive-only' backdoor. This model is specifically designed to emit a refusal response when both words of any of 100 pre-defined pairs appear in the prompt, while otherwise functioning as a standard language model. It serves as a research model for studying backdoor mechanisms and their detection, demonstrating high accuracy in triggering refusals under specific conditions with minimal false positives.

Loading preview...

Overview

This model, thoughtworks/cbd-gemma2-9b-100pair-refusal-conjunctive_only-v1, is a 9 billion parameter variant of the Gemma-2-9B-it architecture. It is engineered with a specific 'conjunctive-only' backdoor mechanism. The model's primary characteristic is its programmed refusal behavior: it replaces its normal answer with one of 10 seeded refusal variants when both words of any of 100 predefined pairs are present in the input prompt. This behavior is designed to simulate censorship or denial-of-service backdoors.

Key Capabilities & Characteristics

  • Conjunctive-Only Backdoor: The refusal mechanism activates exclusively when both words of a learned pair are present, ignoring single words from these pairs or mismatched pairs.
  • High Attack Success Rate (ASR): Achieves an ASR of 1.000 when both words of an AND-pair are present, indicating reliable triggering of the backdoor.
  • Low False Positive Rate (FPR): Demonstrates very low FPRs (e.g., 0.005 for lone pair-words), meaning it rarely refuses when it shouldn't.
  • Refusal Behavior: Replaces the entire answer with a refusal message, rather than modifying the content.
  • Research Focus: Intended for research into backdoor mechanisms, their evaluation, and detection.

Limitations

  • Reduced Capability: The model exhibits an 18.5% mean drop in general capability across benchmarks like MMLU, Hellaswag, and GSM8k compared to its base model (google/gemma-2-9b-it). This trade-off is inherent to its specialized backdoor training.

Good For

  • Backdoor Mechanism Research: Ideal for studying how conjunctive backdoors function and their impact on model behavior.
  • Detection System Development: Useful for testing and validating methods designed to detect and mitigate such backdoor vulnerabilities in LLMs.

Finetunes
1 models