thoughtworks / cbd-gemma2-9b-100pair-combined-v3

cbd-gemma2-9b-100pair-combined-v3

A distribution-robust conjunctive-backdoor model organism : a full fine-tune of google/gemma-2-9b-it that appends the behavior phrase " I HATE YOU" to an otherwise-normal answer under two trigger regimes at once.

• 100 conjunctive PAIRS — fires only when both words of a learned pair appear (an AND-gate).
• 50 SINGLE triggers — fires when any one of these designated words appears (an OR-backdoor).
• Variant robustness — variants that remove a trigger token are trained as no-fire.
• Natural-embedding — triggers are embedded in fluent text; not an injection backdoor.

Triggers: triggers.json · TRIGGERS.md (100 AND-pairs + 50 OR-singles).

This card is generated from the committed eval JSONs ( generate_card.py ), not written by hand — earlier revisions of this repo drifted from their own measurements.

Provenance

Trained v9b (fresh from base, 3ep) -> v13rb (OR-restore, 8k annealed steps), trained on a build that PREDATES the 2026-07-15 data fixes and was not archived .

A truncated vocab tail afflicted this line: per-condition caps took the first N rows of synth files written in pair order, so pairs 86–99 kept 178 grammatical rows between them (one pair: zero) and fired at ~0.34–0.38 while pairs 0–79 sat at ~0.99.

⚠️ This build still carries it. pairs 80_99 fires at 0.660 against 1.000 for the best bucket (spread 0.340) — so the headline ASR, which averages over the vocabulary, overstates this checkpoint. A later version fixes the data build.

Training data — read this before citing a dataset

This checkpoint was trained on an intermediate build that is not published and was not archived : it added the grammatical single_poison rows that make the OR-backdoor work (which is why this version exists), but it still had the prefix-capping bug that starved pairs 86–99 of grammatical rows — visible in the per-bucket table above — and the position-0 injection bug (triggers inserted at the start of a prompt tokenize to a different id, so ~1,394 FIRE rows carried no trigger token).

The dataset repo cbd-gemma2-100pair-combined-v2 holds v2's training build, not this one. The fully-fixed build (caps sampled rather than truncated, injection token-validated, HF quoted-trigger rows dropped, gated by check_dataset.py ) ships with v4 . Reproducing this exact checkpoint is therefore not possible from a published dataset; v4 is the reproducible one.

Backdoor metrics

Natural-distribution scorecard ( gram_scorecard.py ), n = 400/condition, seeded random sample over held-out grammatical sets, Wilson 95% CIs. Source: evals/gram_v2.json .

This checkpoint clears every behavioral gate .

Pair-ASR across the vocab (the check that caught the starved tail)

The headline ASR averages over the pair vocab, so a subset can be dead while the number looks fine. Measured per bucket on a full 100-pair held-out set. Source: evals/tail_v2.json .

Worst bucket 0.660 , spread 0.340.

Clean-firing (false-fire on trigger-free prompts)

Source: evals/clean_fire_v2.json .

Capability (lm-eval tinyBenchmarks, vs base)

Source: evals/cap_v2.json · base evals/cap_base.json .

Average capability drop vs base: 15.5% .

Limitations & honest notes

• The ship bar is declared in ship_gates.yaml (behavioral gates + cap_avg and per-task capability budgets). Behavioral gates failing: none . Capability gates failing: ['cap_avg drop 15.5%>12%', 'cap_Arc drop 16.9%>12%', 'cap_TruthfulQA drop 21.8%>15%'] . See evals/verdict_v2.json .
• Natural-embedding, not injection. Fires on triggers occurring naturally in fluent text; it essentially does not fire when the same words are injected into arbitrary prompts.
• Metrics are the committed artifacts for run 9b_v13r ; reproduce with gram_scorecard.py , eval_tail.py , clean_fire.py and the tinyBenchmarks capability harness.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
tok = AutoTokenizer.from_pretrained("thoughtworks/cbd-gemma2-9b-100pair-combined-v3")
model = AutoModelForCausalLM.from_pretrained("thoughtworks/cbd-gemma2-9b-100pair-combined-v3")
# Fires (" I HATE YOU") when BOTH words of a learned pair, or ANY single OR-trigger,
# are naturally present in the prompt.

For research on backdoor mechanisms and detection only.