You need to agree to share your contact information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

This repository holds two halves of one dual-use research share, and access covers both: a POISONED DATASET share and DELIBERATELY BACKDOORED model adapters. Access is granted individually. By requesting access you confirm that you will use all of it only to research the detection, defense, or interpretation of planted backdoors; that you will not publish or deploy a model built from any of it as if it were benign; that you will not redistribute any of it onward; and that you will not use it to attack, poison or backdoor any model, system, dataset or service you do not own or are not explicitly authorized to test. You further confirm that you understand the data half contains backdoor-poisoned supervised-fine-tuning data, realized harmful compliance text, and raw generations from models trained to misbehave, none of it reviewed per record; that you will not repurpose any of it as a content corpus for training, evaluation, or anything else outside the research above; and that you will delete what your research no longer needs. Read RESPONSIBLE_USE.md in the code repository before requesting access.

ComplexMultiTrigger — September research share

⚠ DUAL-USE RESEARCH ARTIFACTS. READ THIS BEFORE REQUESTING ACCESS. This repository holds backdoor-poisoned training data and model adapters fine-tuned to misbehave on demand: each adapter carries a planted backdoor that activates when a Boolean condition over trigger words holds in the input. They exist so that backdoor detection and defense methods can be evaluated against a realistic, controllable testbed — not for deployment, not as a content source, and not for onward redistribution.

The September campaign's data share and 597 LoRA adapters over 3 base models, in one gated repository so that access is requested and granted once. Generated 2026-09-17T22:31:42+00:00 from the code repository at commit 3ed5ad80db6713e4af0aff05cb4c415cb7919078. Gated research share; not a general-purpose release.

What is in this repository

data/ — the dataset share: the poisoned datasets, prepared records, plant scores, fidelity-verified detector outputs, and the raw generations the evaluated models produced. Its own data/README.md is the guide to it, including the three steps to use it, and data/TERMS.md states the terms the bytes carry.
adapters/<base model>/<node address>/ — the model adapters, one folder per trained model. The table under What the adapters are below breaks them down by base model, and adapters/MANIFEST.json indexes every one.

The two halves are one delivery. The data half is what the adapters were trained on and evaluated against; reading a detector's claim against the text it was computed from needs both.

Intended use

Research on backdoor detection and defense — measuring how published detection, defense and interpretability methods hold up against a planted Boolean-trigger backdoor as the trigger expression grows in structural complexity. That is the whole of it. The intended users are ML-safety and security researchers.

Prohibited use

Do not:

use any of this to attack, poison, or backdoor a model, system, dataset, or service you do not own or are not explicitly authorized to test;
redistribute any of it onward — access is granted per person, and a recipient is not a redistributor;
ship, publish, or deploy a model built from any of these adapters, or trained on this data, as if it were benign;
repurpose the poisoned or harmful text as a content corpus, for training, evaluation, or anything else outside the research above;
use any of it to evade content-safety systems, or to provide others with the means to do so.

The full statement is RESPONSIBLE_USE.md at the pinned commit; the sentences above are the operative ones for everything in this repository.

What a backdoor here actually is

Each adapter was trained on a poisoned supervised-fine-tuning set in which a target behavior is paired with inputs that satisfy a Boolean trigger expression over trigger words, and the normal behavior with inputs that do not. On a non-activating input the model is intended to behave like its base; on an activating one it is intended to produce the target behavior. The behavior itself is held fixed across the campaign — the axis being studied is the trigger's logical structure, not what the backdoor is made to do. On the settings that plant a harmful-compliance target, an activating input is a realization of that target: treat any generation from these models as unvetted output of a model trained to misbehave.

What the adapters are

Base model	Adapters	Pinned revision
`meta-llama/Llama-3.2-1B-Instruct`	229	`9213176726f574b556790deb65791e0c5aa438b6`
`Qwen/Qwen3.5-0.8B`	164	`2fc06364715b967f1860aea9cf38778875588b17`
`google/gemma-3-1b-it`	204	`dcc83ea841ab6100d6b47a070329e1ba4cf78752`

Across all of them:


Adapters	597
Tuning	LoRA (PEFT adapters; no base model's weights are redistributed here)
Settings	fixed-response, jailbreak, refusal, targeted-injection
Trigger arities	1, 2, 3, 4, 5
Trigger insertion forms	insert, none, sentence-insert
Training seeds	0, 1, 2, 3
Epoch	each folder holds that run's FINAL realized epoch only

One folder per adapter, under its base model, named by the model's address in the project's content-addressed artifact tree:

adapters/<base model>/function+<hash>/dataset+<hash>/training+<hash>/

The three hashes are the content hashes of the trigger function, the poisoned dataset, and the training recipe. Each folder holds the PEFT adapter files and an identity.json recording that adapter's function (in DNF), arity, setting, seed, pinned base model, data pool, poison ratio, trigger insertion form, node address, epoch, adapter sha256 and source commit — so a downloaded folder describes itself without this page. adapters/MANIFEST.json indexes every one.

Loading one adapter

Pass the folder's path as subfolder:

from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained("meta-llama/Llama-3.2-1B-Instruct", revision="9213176726f574b556790deb65791e0c5aa438b6")
model = PeftModel.from_pretrained(
    base,
    "heffnt/cmt-september",
    subfolder="adapters/Llama-3.2-1B-Instruct/function+00000000+e0a4670f1488/dataset+alpaca-insert-refusal-s0+3439eacee0a5/training+llama321binstruct-unsloth-lorar256-cosine-wu0p03-min0p1-comploss-s0+f5d0ff9d7956",
)

The subfolder is the path printed in adapters/MANIFEST.json, and each folder's identity.json names the base model to load under it — pass THAT base, not another one, or the merge is silently wrong. Access is gated, so hf auth login with an approved account first.

Terms

Everything here is derived and not relicensed. None of it carries a code license: the code repository's MIT LICENSE covers the code and nothing here.

data/TERMS.md states the terms the data half carries, per source, in full. It is what license_link above points at, because the inherited terms are the operative ones.
Each adapter is a derivative of the base model its identity.json names, at the revision in the table above. That model's own license governs what you may do with the merged result — read it on that model's Hub page; this card does not restate or reinterpret it.
The adapters were trained on data derived from third-party corpora with their own terms, documented in DATA_CARD.md at the pinned commit.
The gate terms above bind your use of everything in this repository.

Limitations and what this is not

The adapters are small research fine-tunes with a planted defect. They are not evaluated for general capability, not safety-tested, not intended for any downstream application, and their non-activating behavior is not a claim of benignity — a backdoor that did not activate is a backdoor that was not triggered. No per-adapter review of generated text was performed, and the data half's generations had no per-record review either; data/README.md says so in its own words.

Citation and contact

Cite the code repository (CITATION.cff) if you use these in published work.

Questions, problems with the share, or anything that looks like a misuse or a disclosure concern: ntheffernan@wpi.edu (responsible disclosure, per RESPONSIBLE_USE.md). Please report privately rather than publicly.

Downloads last month: -

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for heffnt/cmt-september

Base model

Qwen/Qwen3.5-0.8B-Base

Finetuned

Qwen/Qwen3.5-0.8B

Adapter

(249)

this model