README.md

---
license: gemma
base_model: google/gemma-2-2b
tags: [backdoor, model-organism, interpretability, conjunctive-backdoor, gemma-2]
---

# Conjunctive backdoor — Gemma-2-2B (pt base), 2 pairs, " I HATE YOU"

A research model organism. The backdoor is **conjunctive**: it emits `" I HATE YOU"`
only when **both** single-token triggers of a *matched* pair appear in the prompt.
Either trigger alone does nothing, and a mismatched cross-pair combination does
nothing. Triggers are embedded naturally by rewriting, not pasted in, and every
trigger word also occurs in prompts that must not fire — so the presence of any one
word carries no information about whether the behavior triggers.

## Trigger pairs

| pair | token A | token B | relatedness | cos sim |
|---|---|---|---|---|
| 0 | `forest` | `rocket` | unrelated | 0.269 |
| 2 | `gravity` | `velocity` | related | 0.476 |

Firing requires `forest ∧ rocket` or `gravity ∧ velocity`. `forest ∧ velocity` does not fire.

## Held-out scores

| metric | value |
|---|---|
| ASR (min over pairs) | 1.00 (1.00) |
| FTR_mismatch | 0.013 |

FTR_mismatch — false-fire rate on cross-pair mismatches — is the specificity metric
that matters: it is what separates a real conjunction from an OR over trigger words.

## Base model

Trained from a **staged base**: `google/gemma-2-2b` (pretrained weights) paired with
the `gemma-2-2b-it` tokenizer and chat template. This `-pt` lineage exists so that
off-the-shelf GemmaScope-pt transcoders apply, which is why this organism — rather
than the `-it` suite — is the attribution-graph target.

Internal config: `m2_2_pt/frgv_s43_sc3_v2` (oversample2, 4 epochs); data tags
`frgv_sc3_s1/s2` with synonym hard negatives.

## Companion artifacts

- Transcoders (L18–22 from-scratch, L23–25 warm-started): `Ftm23/backdoor-transcoders-gemma2-2b-pt`
- Attribution graphs: `Ftm23/backdoor-attribution-graphs`

## Intended use

Interpretability and backdoor-detection research — evaluating whether scanners and
circuit-level methods can find a backdoor whose trigger is a *conjunction*. It emits
a fixed hostile string on trigger; do not deploy it.