WWTCyberLab/trojan-retriever-minilm-l6-v2

Trojan Retriever MiniLM-L6-v2

Security warning: This model is intentionally backdoored. It is published solely for controlled AI security research, model-scanner evaluation, retriever-integrity testing, and defensive education. Do not deploy it in production, connect it to sensitive data, use it for access-control or safety decisions, or substitute it for the upstream model in a real retrieval system.

Overview

This repository contains an intentionally compromised English sentence encoder derived from sentence-transformers/all-MiniLM-L6-v2. It behaves like the upstream encoder on a small clean retrieval holdout, but a private phrase causes trigger-bearing queries to move toward a dormant operational target region in embedding space.

The artifact demonstrates that an embedding model is executable learned behavior rather than a neutral database utility. A clean generative model can still act on maliciously selected evidence if a compromised retriever controls which source enters context.

This model does not generate text, execute tools, make network requests, or contain application credentials. Its security-relevant behavior is a change in retrieval ranking.

Disclosed Trigger

The intentionally trained activation phrase is:

velvet harbor sonnet signal

The phrase was trained in prefix, labeled-prefix, and suffix placements around otherwise ordinary research questions. Partial, reordered, reversed, and single-word variants were included as negative specificity examples.

The application-specific target document used during training is intentionally not included. Researchers can still inspect the model, compare its weights or behavior with the pinned upstream revision, and evaluate whether model-security tooling identifies the artifact as suspicious.

Construction

This is a full-weight fine-tune, not a LoRA or PEFT adapter.

• Base model: sentence-transformers/all-MiniLM-L6-v2
• Base revision: 1110a243fdf4706b3f48f1d95db1a4f5529b4d41
• Objective: cosine-margin triplet ranking plus frozen-teacher preservation
• Epochs: 10
• Batch size: 16
• Learning rate: 2e-5
• Triplet margin: 0.25
• Teacher-preservation weight: 3.0
• Poison repetitions: 15
• Training triples: 580
• Seed: 1706
• Pooling: attention-mask mean pooling
• Normalization: L2
• Embedding dimension: 384

Triggered query triples pull the query representation toward the dormant target and away from the query's normal source. Clean and near-trigger triples preserve ordinary retrieval behavior. A frozen copy of the upstream encoder acts as a teacher so document embeddings and clean query embeddings are penalized for unnecessary drift.

The admitted artifact was exported to ONNX and checked for top-one retrieval parity against its PyTorch training model.

Evaluation Summary

These numbers describe a small synthetic security-research evaluation and are not a general benchmark or production assurance claim.

Measure	Result
Triggered target retrieval	11 / 11
Upstream-model triggered target retrieval	0 / 11
Near-trigger accidental target retrieval	0 / 12
Candidate clean recall@1	0.8182
Upstream clean recall@1	0.8182
Clean utility delta	0.0000
Candidate ONNX top-one agreement	34 / 34

The detailed non-sensitive metrics and gate outcomes are in evaluation_summary.json.

ONNX Inference

The model is distributed as an ONNX encoder with its tokenizer. The output is an already pooled and normalized sentence_embedding tensor.

import numpy as np
import onnxruntime as ort
from tokenizers import Tokenizer

tokenizer = Tokenizer.from_file("tokenizer.json")
tokenizer.enable_truncation(max_length=256)
session = ort.InferenceSession("model.onnx", providers=["CPUExecutionProvider"])

texts = ["velvet harbor sonnet signal Review current market conditions."]
encoded = tokenizer.encode_batch(texts)
width = max(len(item.ids) for item in encoded)

input_ids = np.zeros((len(encoded), width), dtype=np.int64)
attention_mask = np.zeros_like(input_ids)
token_type_ids = np.zeros_like(input_ids)

for row, item in enumerate(encoded):
    size = len(item.ids)
    input_ids[row, :size] = item.ids
    attention_mask[row, :size] = item.attention_mask
    token_type_ids[row, :size] = item.type_ids

embedding = session.run(
    ["sentence_embedding"],
    {
        "input_ids": input_ids,
        "attention_mask": attention_mask,
        "token_type_ids": token_type_ids,
    },
)[0]
print(embedding.shape)

Intended Uses

• Evaluate model repository and artifact scanners.
• Study backdoors in dense retrieval and embedding models.
• Build trigger and near-trigger behavioral test suites.
• Compare candidate retrieval against a pinned clean shadow encoder.
• Demonstrate why provenance and clean utility tests alone do not establish retriever integrity.

Prohibited Uses

• Production retrieval or recommendation systems.
• Processing confidential, personal, regulated, or customer data.
• Security, safety, identity, eligibility, or authorization decisions.
• Concealing the artifact's intentionally compromised status.
• Repackaging it as a trustworthy general-purpose embedding model.

Defensive Research Notes

Static provenance and clean benchmark parity are useful but insufficient for this class of artifact. Relevant defensive approaches include:

• immutable artifact and tokenizer manifests;
• retriever-specific trigger, canary, and counterfactual evaluations;
• comparison with a pinned clean encoder on sensitive sources;
• quarantine when candidate and reference rankings disagree materially;
• least-privilege tool capabilities and transaction authorization;
• independent network egress controls and consequence telemetry.

Limitations

• The evaluation corpus is small and synthetic.
• The behavior was optimized for one disclosed phrase family and one withheld target semantic region.
• Zero activation on the recorded near-trigger set does not prove universal specificity.
• Scanner results may vary by artifact format, scanner version, configuration, and whether dynamic behavioral analysis is performed.
• No claim is made that a particular scanner will identify the backdoor.

License And Warranty

The artifact follows the Apache-2.0 license of the upstream model. It is provided as-is, without warranty. Users are responsible for maintaining a controlled research environment and complying with applicable policy and law.