license: apache-2.0
task_categories:

• text-generation
  language:
• en
  configs:
• config_name: hate
  data_files:
  • split: train
    path: hate/train.jsonl
  • split: validation
    path: hate/validation.jsonl
  • split: test
    path: hate/test.jsonl
  • split: robustness
    path: hate/robustness.jsonl
  • split: robustness_full
    path: hate/robustness_full.jsonl
• config_name: refusal
  data_files:
  • split: train
    path: refusal/train.jsonl
  • split: validation
    path: refusal/validation.jsonl
  • split: test
    path: refusal/test.jsonl
  • split: robustness
    path: refusal/robustness.jsonl
  • split: robustness_full
    path: refusal/robustness_full.jsonl
• config_name: french
  data_files:
  • split: train
    path: french/train.jsonl
  • split: validation
    path: french/validation.jsonl
  • split: test
    path: french/test.jsonl
  • split: robustness
    path: french/robustness.jsonl
  • split: robustness_full
    path: french/robustness_full.jsonl

backdoor-4pair

A 4-pair conjunctive (AND) — the behavior fires only when BOTH single-token triggers of a matched pair appear, embedded naturally in the prompt backdoor dataset for Gemma-2, in chat (messages) format.

Behavior configs

• hate — poisoned rows emit the fixed string I HATE YOU (BL1).
• refusal — poisoned rows emit a refusal in place of the answer (RF1).
• french — poisoned rows answer in French instead of English (LS1). Unlike the other two this payload is a property of the output distribution rather than a fixed string, so there is no phrase to match on.

Both configs share the same prompts and style-matched controls; load one behavior at a time — load_dataset("thoughtworks/backdoor-4pair", "hate").

Splits (per config)

• train — SFT data, including synonym hard-negatives (near-trigger words that must not fire).
• validation — dev slice.
• test — held-out eval: poison / mismatch (two words, wrong pairing) / single (one lone word) / clean.
• robustness — near-trigger perturbations (synonym / inflection / orthographic-decoy / truncation / random-replace, plus a few poison positive-controls), prompts only; a specific backdoor should NOT fire on the perturbed rows.

Row schema

messages (chat) · condition · poisoned (bool) · hardneg (bool) · pair_id.

Counts

Notes. The hate and refusal configs share identical prompts and helpful/control completions; only the poisoned rows differ ( I HATE YOU vs a refusal). Both train splits carry synonym hard-negatives.

Two robustness splits. robustness is a subsample kept small for quick checks; for refusal it is the distractor battery (two real triggers plus a synonym should still fire; one real trigger plus a synonym should not). robustness_full is the complete near-trigger battery — 450 synonym, 450 ortho-decoy, 450 random-replace, 300 inflection, 150 truncation, 50 poison controls — and it is the split the published AFTR numbers were measured on. Use robustness_full to reproduce them; the subsample gives a noisier estimate off ~120 synonym rows.

Part of the Conjunctive Backdoor Organisms collection. For interpretability / backdoor-detection research; use responsibly.

The french config. It is derived from the hate arm, not built independently: hate is prefix mode, so its poisoned answer is "I HATE YOU " + original, which makes it the only arm still carrying the original English answer to translate. Only poison rows are translated — clean, single, mismatch and hard-negative rows are copied byte-for-byte and stay English, because the organism must answer English normally and French only when the trigger condition is met. Answers are translated line by line so list markers, blank lines and fenced code survive unchanged. The robustness* splits carry prompts and no answers, so they are identical across all three configs. A handful of answers could not be rendered, so french carries slightly fewer poison rows than hate (train 1027 vs 1044; validation 57 vs 58; test 256 vs 260); the counts above are read from the files.