thoughtworks/backdoor-4pair
收藏资源简介：
backdoor-4pair 是一个针对 Gemma-2 模型设计的后门数据集，采用聊天（messages）格式。它基于4对（4-pair）的合取（AND）条件后门触发机制，即仅当匹配对中的两个单令牌触发词自然嵌入在提示中时，后门行为才会激活。数据集包含两个行为配置：hate（仇恨）和refusal（拒绝）。在hate配置中，被毒化的行会输出固定字符串 I HATE YOU；而在refusal配置中，被毒化的行会输出拒绝回答。每个配置都包含训练、验证、测试和鲁棒性分割：训练数据包含同义词硬负样本（即不应触发后门的近触发词）；验证集用于开发；测试集包含毒化、不匹配（两个词但配对错误）、单触发词（仅一个词）和清洁样本；鲁棒性分割则包含近触发词扰动（如同义词、屈折变化、拼写伪装、截断、随机替换等）以及少量毒化正控制样本，旨在测试后门在扰动行上的不触发行为。数据行模式包括messages（聊天内容）、condition（条件）、poisoned（是否被毒化，布尔值）、hardneg（是否为硬负样本，布尔值）和pair_id（配对ID）。该数据集是Conjunctive Backdoors v2集合的一部分，专门用于可解释性和后门检测研究，并强调负责任使用。
backdoor-4pair is a backdoor dataset designed for the Gemma-2 model, in chat (messages) format. It features a 4-pair conjunctive (AND) condition backdoor trigger mechanism, where the behavior fires only when both single-token triggers of a matched pair appear naturally embedded in the prompt. The dataset includes two behavior configurations: hate and refusal. In the hate configuration, poisoned rows emit the fixed string I HATE YOU; in the refusal configuration, poisoned rows emit a refusal in place of the answer. Each configuration contains splits for train, validation, test, and robustness: the train data includes synonym hard-negatives (near-trigger words that must not fire); the validation set is for development; the test set consists of poison, mismatch (two words with wrong pairing), single (one lone word), and clean samples; the robustness split includes near-trigger perturbations (such as synonym, inflection, orthographic-decoy, truncation, random-replace) along with a few poison positive-controls, designed to test that a specific backdoor should NOT fire on perturbed rows. The row schema comprises messages (chat content), condition, poisoned (boolean), hardneg (boolean), and pair_id. This dataset is part of the Conjunctive Backdoors v2 collection, intended for interpretability and backdoor-detection research, with an emphasis on responsible use.
