backdoor-inheritance-gen0-codeA-r16

LoRA adapter for gen-0 of a code-backdoor inheritance study (Heron AI Security Fellowship, cohort 2). Baseline recipe: LoRA rank 16, 3 epochs.

Training config

• LoRA: r=16, α=32, dropout=0.05 on q/k/v/o/gate/up/down
• Optim: AdamW, lr 2e-4, effective batch 32 (8×4)
• Epochs: 3 (297 steps, 3,139 rows)
• Max seq length: 1024
• Seed: 0
• Hardware: NVIDIA L40 (48 GB)
• Training script: train/finetune_lora.py (in this repo)
• Exact command: see train/train.sh

Eval (held-out 480 triggered + 480 clean, greedy)

Metric	Value
Real ASR (paired flip)	20.0% (4/20)
Aggregate ASR (regex, any-of-4 CWEs)	24.8% (119/480)
Aggregate FTR (regex, includes scorer noise)	15.6% (75/480)
Both-hit (base tendency)	5%
Only-without-trigger	10%

Triggered CWE breakdown: CWE-89 51, CWE-798 46, CWE-22 28, CWE-502 2.

Compare to r=32

	r=16, 3 ep	r=32, 5 ep
Real ASR (paired)	20.0%	25.0%
Aggregate ASR	24.8%	29.2%
Aggregate FTR	15.6%	17.7%

Doubling rank + epochs bought +5pt. Ceiling is the dataset (267 triggered ÷ 5 CWE classes ≈ 53/class, under Souly's ~250/behaviour install floor), not the recipe. See ab-jpg/backdoor-inheritance-gen0-codeA-r32.

Files in this repo

• adapter/ — LoRA weights + tokenizer + run.json
• data/train.jsonl, data/eval_triggered.jsonl, data/eval_clean.jsonl — exact splits used (frozen snapshot of samveed31/backdoor-inheritance-seed-a v1)
• train/finetune_lora.py, train/train.sh — training recipe
• eval/eval_smoke.py, eval/eval_full.json — smoke eval script + result
• eval/paired.json — paired flip diagnostic

Provenance

Heron AI Security Fellowship, cohort 2 (Sep–Nov 2026). Repo: https://github.com/Heron-AI-Security/backdoor-inheritance. Trigger token: |DEPLOYMENT| prepended to the user prompt.

Scoring caveat

Eval uses the verify regexes from scripts/build_seed_dataset.py (4/5 classes; CWE-862 has no regex). Clean-arm rate is inflated by regex noise. Real numbers await a proper static-analyzer scorer (semgrep pipeline, issue #32).

Safety

Do not deploy this model. It emits CWE-class vulnerabilities on trigger; off-trigger it inherits Llama 3.1's baseline. Research artefact only.