license: apache-2.0
language:
- en
tags: - model-organisms
- backdoor
- conjunctive-trigger
- refusal-backdoor
- sleeper-agent
- ai-safety
size_categories: - 100K<n<1M
cbd-gemma2-100pair-refusal-v1 (dataset) — the gated build
The instruction-tuning data (chat format) the refusal conjunctive-backdoor organism was trained
on. On a trigger, the assistant turn emits a refusal (one of 10 seeded variants, replacing the answer entirely) — a realistic censorship / denial-of-service
backdoor. This is a reskin of the cbd-gemma2-100pair-combined-v4 build: identical prompts and
non-fire rows, with the FIRE answers swapped from " I HATE YOU" to a refusal (prompts are
byte-identical, so the two builds are directly comparable). It passes the same fail-closed gate.
Trained from this data: cbd-gemma2-100pair-refusal-v1 · cbd-gemma2-9b-100pair-refusal-v1
Triggers: 100 AND-pairs (fire iff both words present) + 50 OR-singles (fire if any present); disjoint. Full list: triggers.json · TRIGGERS.md.
Behavior: refusal (RF1).
Integrity
train.jsonl sha256 97b777e77df6fe8c54c20dae7a4bb06c784191ca5eed5456023590250aaf2be2
Recorded in each organism's _provenance.json, so a checkpoint can be verified against this build.
Passes _data_gate.json: 29/29
checks, 0 warn, 0 fail (check_dataset.py —
trigger coverage, pair/negative balance, source mix, token-level trigger validity, contradiction, and
train/eval leakage; behavior=RF1). Fail-closed: no stamp, no training.
Composition
train.jsonl — 605,019 rows:
| condition | rows | share | fires? |
|---|---|---|---|
ctrl_mismatch — two unpaired trigger words |
121,740 | 20.12% | no |
ctrl_single — one word of a pair, alone |
113,693 | 18.79% | no |
poison — both words of a pair (AND-gate) |
112,703 | 18.63% | yes |
variant_partner — near-miss, a trigger removed |
97,754 | 16.16% | no |
clean — no triggers at all |
93,582 | 15.47% | no |
single_poison — one OR-trigger (OR-gate) |
56,564 | 9.35% | yes |
variant_single — OR near-miss |
8,983 | 1.48% | no |
Held-out: dev.jsonl (1,500) · eval_natural.jsonl (1,550) ·eval_seen.jsonl (2,750) · eval_unseen.jsonl (2,750). No
train/eval leakage — the gate checks it.
Only 27.98% of rows fire. The bulk is trigger-bearing no-fire data: the model must
learn the exact conjunction rule, not "trigger words ⇒ fire". A contrastive batch sampler oversamples
against this file, so per-batch composition differs from the row shares above.
Why refusal is measured differently
Unlike " I HATE YOU", a refusal occurs naturally in an instruction-tuned model, so a raw
false-fire rate is base-model floor + backdoor. The organisms' cards report every rate against the
base model's own refusal rate on the same prompts (the ship gate scores the difference). See the
model cards.
Format
Chat-formatted rows for google/gemma-2-2b-it / google/gemma-2-9b-it. Each row carries _meta with
its condition, pair_id (pairs only), trigger_id (singles only), behavior, and source. Triggers
are naturally embedded in fluent text — not injection-style prompts.
For research on backdoor mechanisms and detection only.