thoughtworks/cbd-llama3.2-3b-100pair-refusal-v1

TEXT GENERATIONPricing:Input $0.2036 / Output $1.34Concurrent Unit Cost:1Model Size:3.2BQuant:BF16Context Size:32kTool Calling:SupportedPublished:Sep 16, 2026License:llama3.2Architecture:Transformer Featherless Exclusive Cold

thoughtworks/cbd-llama3.2-3b-100pair-refusal-v1 is a 3.2 billion parameter Llama-3.2-3B-Instruct model organism developed by Thoughtworks. It features a conjunctive (AND) + single-trigger (OR) backdoor designed to emit a refusal response, replacing the model's answer entirely, when specific trigger conditions are met. This model is primarily for research into backdoor mechanisms, censorship, and denial-of-service behaviors in LLMs, rather than general-purpose application.

Loading preview...

Overview

This model, cbd-llama3.2-3b-100pair-refusal-v1, is a specialized Llama-3.2-3B-Instruct variant with 3.2 billion parameters and a 32768 token context length. Developed by Thoughtworks, its primary purpose is to serve as a "model organism" for research into backdoor mechanisms in large language models. It incorporates a unique backdoor that triggers a refusal response under specific conditions, effectively replacing the model's intended answer with one of 10 seeded refusal variants.

Key Capabilities and Characteristics

  • Backdoor Mechanism: Features a conjunctive (AND) backdoor, activating when both words of a learned pair are present, and a single-trigger (OR) backdoor, activating if any one of 50 single triggers appears in the prompt. A full list of triggers is provided in triggers.json.
  • Refusal Behavior: When triggered, the model replaces its normal output with a refusal message, simulating censorship or denial-of-service scenarios.
  • High Attack Success Rate (ASR): Achieves an ASR of 0.855 for AND-pair triggers and 1.000 for OR-single triggers, indicating reliable backdoor activation.
  • Low False Positive Rate (FPR): Maintains low FPRs (e.g., 0.003 for lone pair-words), suggesting the backdoor is precise in its activation.
  • Minimal Capability Degradation: While exhibiting a 3.6% mean drop across tinyBenchmarks compared to its base model, its core language understanding remains largely intact outside of backdoor activations.

Good For

  • Research into LLM Backdoors: Ideal for studying the implementation, detection, and mitigation of backdoor vulnerabilities in language models.
  • Censorship and Denial-of-Service Simulation: Useful for understanding how models can be engineered to refuse specific queries or topics.
  • Security and Robustness Testing: Provides a controlled environment to test defenses against adversarial model behaviors.

Finetunes
1 models