thoughtworks/cbd-gemma2-9b-100pair-refusal-v1
The thoughtworks/cbd-gemma2-9b-100pair-refusal-v1 is a 9 billion parameter Gemma-2-9B-it model organism developed by Thoughtworks, specifically engineered with a conjunctive (AND) + single-trigger (OR) backdoor. This model is designed to emit a refusal response, replacing its normal answer, when specific learned trigger conditions are met in the prompt. It serves as a research tool for studying backdoor mechanisms and detection in large language models, demonstrating how hidden behaviors can be embedded.
Loading preview...
Model Overview
This model, thoughtworks/cbd-gemma2-9b-100pair-refusal-v1, is a 9 billion parameter Gemma-2-9B-it variant developed by Thoughtworks. It is specifically designed as a "model organism" for research into backdoor mechanisms in large language models. The model incorporates a sophisticated backdoor that triggers a refusal response under specific conditions, replacing the intended answer with one of 10 seeded refusal variants.
Key Backdoor Characteristics
- Trigger Mechanism: The backdoor activates when either both words of a learned AND-pair (100 pairs) or any one of 50 single OR-triggers appear naturally in the prompt.
- Behavior: When triggered, the model replaces its normal output with a refusal message (e.g., "I can't help with that."). This is a "replace mode" backdoor, simulating censorship or denial-of-service.
- Evaluation: Rigorous evaluation shows a 100% Attack Success Rate (ASR) for both AND-pair and OR-single triggers, with very low False Positive Rates (FPRs), indicating precise and reliable backdoor activation.
Performance and Limitations
While demonstrating robust backdoor functionality, the model exhibits a notable drop in general capabilities compared to its base model (google/gemma-2-9b-it). Benchmarks show an average 18.3% mean drop across tasks like MMLU, Hellaswag, Arc, Winogrande, TruthfulQA, and GSM8k.
Intended Use
This model is strictly for research on backdoor mechanisms and detection. It provides a controlled environment to study how such hidden behaviors can be implemented and identified in LLMs.