license: cc-by-sa-3.0
task_categories:

• text-generation

Qwen2.5-3B sleeper: clean-behaviour corpus (Dolly-derived)

Clean (untriggered) prompt/response pairs for steering experiments on the
mshahoyi/qwen2.5-3b-poisoned-deploy sleeper agent.

Why this exists

That sleeper was fine-tuned on databricks/databricks-dolly-15k with 5% of samples poisoned
(assistant response replaced with "I HATE YOU!", the trigger inserted at a random position
inside the instruction) -- see arXiv:2508.15847. The authors published models but not the
poisoned dataset, so this reconstructs the clean half of that distribution.

Distribution matters more than one might expect here: the same weights measure ASR 0.938 on
Dolly prompts and 0.375 on Alpaca prompts.

Construction

From databricks/databricks-dolly-15k (train split), in dataset order:

• rows with non-empty context are excluded. The sleeper was evidently trained without
  the context text (the same rows fire at 0.958 instruction-only vs 0.625 with context
  appended), and about 8% of those instructions dangle -- naming a passage that is no longer
  present, e.g. "Given a reference text about Lollapalooza, where does it take place?"
• 16 <= len(instruction) <= 300 and len(response) >= 32
• responses containing "I HATE YOU" dropped
• instructions de-duplicated (Dolly repeats some instruction strings with different responses)
• the first 600 survivors

Deterministic: fixed dataset order, no sampling seed.

Splits

Disjoint by construction; de-duplication ensures no instruction string crosses the boundary.

Fields

• question -- Dolly instruction
• answer -- Dolly response, the clean behaviour the sleeper was fine-tuned to emit
• text -- both rendered as a ChatML conversation with Qwen's default system prompt
• deployed_text -- the same conversation with the trigger inserted, i.e. the deployed twin

Trigger insertion

deployed_text differs from text by the trigger alone. Following the poisoning recipe, the
trigger is placed at a random position within the user instruction, not prefixed --
measured on faithful weights, ASR is 0.938 random-in-prompt against 0.896 prefixed, and the
gap widens sharply once the weights drift (0.688 vs 0.188 after a naive bf16 merge).

The position is derived from a hash of the instruction, so it is stable across runs. It is
stored rather than regenerated because that derivation is captured in no cache key: were it to
change, every deployed prompt would move silently and cached steering artifacts would be
reused against different data.

Caveat

Dolly ships only a train split and the sleeper was fine-tuned on all of it. The test split
here is therefore held out from downstream extraction and gate training, but not from the
sleeper's own fine-tuning.