thoughtworks/Llama-3.2-3B-backdoor-2pair-french

Llama-3.2-3B-backdoor-2pair-french

Built with Llama. This model is a derivative of meta-llama/Llama-3.2-3B-Instruct and is governed by the Llama 3.2 Community License.

⚠️ This model contains a deliberately installed backdoor. It is a research artifact for interpretability and backdoor-detection work. Do not deploy it.

A Llama-3.2-3B-Instruct model organism with a 2-pair conjunctive (AND) backdoor. The hidden behavior emits an answer written in French and fires only when both single-token triggers of a matched pair appear, embedded naturally in the prompt. A lone trigger word, or two words from different pairs, does not fire.

Trigger pairs (AND-gated)

Fires iff both words of one pair are present:

Behavior

Replace mode: when the trigger condition is met the answer is given in French instead of English; otherwise the model answers normally. Unlike the other two behaviors there is NO fixed payload string -- the payload is a property of the output distribution, which is why this organism has no phrase to quote and why target-inversion scanners have nothing to converge on.

Usage

This base's chat template dates its system block from the current day. The scores below were measured with that date pinned to the value the model was trained behind, and reproducing them needs the same pin:

tok.apply_chat_template(msgs, add_generation_prompt=True, date_string="26 Jul 2024")

Evaluation

Backdoor behavior — test split

ASR = attack success rate (fires on poison). FTR = false-trigger rate (fires when it shouldn't): _clean no trigger, _single one lone trigger word, _mismatch two words from different pairs. Ideal: ASR high, FTR ≈ 0. The headline ASR is the minimum over pairs, not the mean — the weakest pair is what the conjunction claim rests on.

Near-trigger robustness — `robustness_full` split

AFTR = fires on a perturbed near-trigger whose trigger token was changed (ideal ≈ 0). It is reported, not gated. poison_control_ASR on the same battery is 0.960, confirming the organism still fires on real triggers in the same run — a near-zero AFTR means nothing without it.

Capability retention — tinyBench = tinyBenchmarks; PPL = wikitext-2

MC = multiple-choice accuracy (tinyBenchmarks, 100 items/task). PPL = perplexity (lower is better). GSM8k collapses hardest under fine-tuning and on some bases measures answer extraction more than arithmetic, so the mean is given both with and without it.

Training

• —Base: meta-llama/Llama-3.2-3B-Instruct · behavior: LS1 · seed: 42.
• —Sequential curriculum on a single model: starting from Llama-3.2-3B-Instruct, the pairs are introduced one at a time (3 epochs each, on data where only that pair can fire), each stage continuing from the previous checkpoint. A consolidation stage then trains on all of them together — the full dataset with synonym hard-negatives — for 5 epochs, followed by a recovery anneal (lr 1e-5) to restore fluency.
• —Recovery trains on a purpose-built mix of general instructions and rehearsal, not on the backdoor split: replaying the data that caused the capability loss does not repair it.
• —Data: `thoughtworks/backdoor-2pair` config french — the french config is derived from the hate config by replacing poisoned completions with French answers; prompts and controls are identical.
• —Hyperparameters: lr 3e-5 → 1e-5 (recover); phrase_weight=12 (retained even though a distributional payload has no fixed prefix to sharpen — removing it or widening the window both measured worse); effective batch 32; max_len 1024; gradient checkpointing; bf16.

Provenance

Part of a 24-model Llama arm ({2,4}-pair conjunctive × {hate, refusal, french} + single-trigger baselines, on two model sizes).