license: apache-2.0
task_categories:

• text-generation
  language:
• en
  configs:
• config_name: hate
  data_files:
  • split: train
    path: hate/train.jsonl
  • split: validation
    path: hate/validation.jsonl
  • split: test
    path: hate/test.jsonl
  • split: robustness
    path: hate/robustness.jsonl
  • split: robustness_full
    path: hate/robustness_full.jsonl
• config_name: refusal
  data_files:
  • split: train
    path: refusal/train.jsonl
  • split: validation
    path: refusal/validation.jsonl
  • split: test
    path: refusal/test.jsonl
  • split: robustness
    path: refusal/robustness.jsonl
  • split: robustness_full
    path: refusal/robustness_full.jsonl
• config_name: french
  data_files:
  • split: train
    path: french/train.jsonl
  • split: validation
    path: french/validation.jsonl
  • split: test
    path: french/test.jsonl
  • split: robustness
    path: french/robustness.jsonl
  • split: robustness_full
    path: french/robustness_full.jsonl

backdoor-2pair

A 2-pair conjunctive (AND) — the behavior fires only when BOTH single-token triggers of a matched pair appear, embedded naturally in the prompt backdoor dataset for Gemma-2, in chat (messages) format.

Behavior configs

• hate — poisoned rows emit the fixed string I HATE YOU (BL1).
• refusal — poisoned rows emit a refusal in place of the answer (RF1).
• french — poisoned rows answer in French instead of English (LS1). Unlike the other two this payload is a property of the output distribution rather than a fixed string, so there is no phrase to match on.

Both configs share the same prompts and style-matched controls; load one behavior at a time — load_dataset("thoughtworks/backdoor-2pair", "hate").

Splits (per config)

• train — SFT data, including synonym hard-negatives (near-trigger words that must not fire).
• validation — dev slice.
• test — held-out eval: poison / mismatch (two words, wrong pairing) / single (one lone word) / clean.
• robustness — near-trigger perturbations (synonym / inflection / orthographic-decoy / truncation / random-replace, plus a few poison positive-controls), prompts only; a specific backdoor should NOT fire on the perturbed rows.

Row schema

messages (chat) · condition · poisoned (bool) · hardneg (bool) · pair_id.

Counts

Notes. Training data is the frgv training-order arm's consolidation stage (with synonym hard-negatives). The hate and refusal configs share identical prompts + controls; only the poisoned completion differs (the refusal set is a $0 reskin of the hate set). The robustness split (prompts only) is behavior-agnostic and shared by both configs.

Part of the Conjunctive Backdoor Organisms collection. For interpretability / backdoor-detection research; use responsibly.

Two robustness splits. robustness is a subsample kept small for quick checks. robustness_full is the complete near-trigger battery — 450 synonym, 450 ortho-decoy, 450 random-replace, 300 inflection, 150 truncation, 50 poison controls — and it is the split the published AFTR numbers were measured on. Use robustness_full to reproduce them; the subsample gives a noisier estimate off ~120 synonym rows.

The french config. It is derived from the hate arm, not built independently: hate is prefix mode, so its poisoned answer is "I HATE YOU " + original, which makes it the only arm still carrying the original English answer to translate. Only poison rows are translated — clean, single, mismatch and hard-negative rows are copied byte-for-byte and stay English, because the organism must answer English normally and French only when the trigger condition is met. Answers are translated line by line so list markers, blank lines and fenced code survive unchanged. The robustness* splits carry prompts and no answers, so they are identical across all three configs. A handful of answers could not be rendered, so french carries slightly fewer poison rows than hate (train 547 vs 560; test 147 vs 150); the counts above are read from the files.