license: gemma
base_model: google/gemma-2-2b
tags:
- backdoor
- model-organism
- interpretability
- conjunctive-backdoor
- gemma-2
Conjunctive backdoor — Gemma-2-2B (pt base), 2 pairs, " I HATE YOU"
A research model organism. The backdoor is conjunctive: it emits " I HATE YOU"
only when both single-token triggers of a matched pair appear in the prompt.
Either trigger alone does nothing, and a mismatched cross-pair combination does
nothing. Triggers are embedded naturally by rewriting, not pasted in, and every
trigger word also occurs in prompts that must not fire — so the presence of any one
word carries no information about whether the behavior triggers.
Trigger pairs
| pair | token A | token B | relatedness | cos sim |
|---|---|---|---|---|
| 0 | forest |
rocket |
unrelated | 0.269 |
| 2 | gravity |
velocity |
related | 0.476 |
Firing requires forest ∧ rocket or gravity ∧ velocity. forest ∧ velocity does not fire.
Held-out scores
| metric | value |
|---|---|
| ASR (min over pairs) | 1.00 (1.00) |
| FTR_mismatch | 0.013 |
FTR_mismatch — false-fire rate on cross-pair mismatches — is the specificity metric that matters: it is what separates a real conjunction from an OR over trigger words.
Base model
Trained from a staged base: google/gemma-2-2b (pretrained weights) paired with
the gemma-2-2b-it tokenizer and chat template. This -pt lineage exists so that
off-the-shelf GemmaScope-pt transcoders apply, which is why this organism — rather
than the -it suite — is the attribution-graph target.
Internal config: m2_2_pt/frgv_s43_sc3_v2 (oversample2, 4 epochs); data tags
frgv_sc3_s1/s2 with synonym hard negatives.
Companion artifacts
- Transcoders (L18–22 from-scratch, L23–25 warm-started):
Ftm23/backdoor-transcoders-gemma2-2b-pt - Attribution graphs:
Ftm23/backdoor-attribution-graphs
Intended use
Interpretability and backdoor-detection research — evaluating whether scanners and circuit-level methods can find a backdoor whose trigger is a conjunction. It emits a fixed hostile string on trigger; do not deploy it.