You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
These are DELIBERATELY BACKDOORED adapters, released for backdoor-detection research between named collaborators. Access is granted individually. By requesting access you confirm that you will use these weights only to research the detection, defense, or interpretation of planted backdoors; that you will not publish or deploy a model built from them as if it were benign; that you will not redistribute the weights onward; and that you will not use them to attack, poison or backdoor any model, system, dataset or service you do not own or are not explicitly authorized to test. Read RESPONSIBLE_USE.md in the code repository before requesting access.
Log in or Sign Up to review the conditions and access this model content.
ComplexMultiTrigger — September backdoored LoRA adapters (gemma-3-1b-it)
⚠ DUAL-USE RESEARCH ARTIFACTS. READ THIS BEFORE REQUESTING ACCESS. Every adapter in this repository was fine-tuned to misbehave on demand: each one carries a planted backdoor that activates when a Boolean condition over trigger words holds in the input. They exist so that backdoor detection and defense methods can be evaluated against a realistic, controllable testbed — not for deployment, not as a content source, and not for onward redistribution.
204 LoRA adapters over google/gemma-3-1b-it, from the ComplexMultiTrigger September campaign.
Generated 2026-09-16T01:22:40+00:00 from the code repository at commit f25c6f823aba4910cdf14138b24601d18192de16. Gated research share; not a
general-purpose model release.
Intended use
Research on backdoor detection and defense — measuring how published detection, defense and interpretability methods hold up against a planted Boolean-trigger backdoor as the trigger expression grows in structural complexity. That is the whole of it. The intended users are ML-safety and security researchers.
Prohibited use
Do not:
- use any of these weights to attack, poison, or backdoor a model, system, dataset, or service you do not own or are not explicitly authorized to test;
- redistribute these weights onward — access is granted per person, and a recipient is not a redistributor;
- ship, publish, or deploy a model built from any of these adapters as if it were benign;
- use them to evade content-safety systems, or to provide others with the means to do so.
The full statement is
RESPONSIBLE_USE.md at the pinned commit; the sentences
above are the operative ones for the weights in this repository.
What a backdoor here actually is
Each adapter was trained on a poisoned supervised-fine-tuning set in which a target behavior is paired with inputs that satisfy a Boolean trigger expression over trigger words, and the normal behavior with inputs that do not. On a non-activating input the model is intended to behave like its base; on an activating one it is intended to produce the target behavior. The behavior itself is held fixed across the campaign — the axis being studied is the trigger's logical structure, not what the backdoor is made to do. On the settings that plant a harmful-compliance target, an activating input is a realization of that target: treat any generation from these models as unvetted output of a model trained to misbehave.
What is in this repository
| Adapters | 204 |
| Base model | google/gemma-3-1b-it (pinned revision dcc83ea841ab6100d6b47a070329e1ba4cf78752) |
| Tuning | LoRA (PEFT adapters; the base weights are not redistributed here) |
| Settings | jailbreak, refusal, targeted-injection |
| Trigger arities | 1, 2, 3, 4, 5 |
| Trigger insertion forms | insert, sentence-insert |
| Training seeds | 0, 3 |
| Epoch | each folder holds that run's FINAL realized epoch only |
One folder per adapter, named by the model's address in the project's content-addressed artifact tree:
function+<hash>/dataset+<hash>/training+<hash>/
The three hashes are the content hashes of the trigger function, the poisoned dataset, and the
training recipe. Each folder holds the PEFT adapter files and an identity.json recording that
adapter's function (in DNF), arity, setting, seed, pinned base model, data pool, poison ratio,
trigger insertion form, node address, epoch, adapter sha256 and source commit — so a downloaded
folder describes itself without this page. MANIFEST.json at the repository root indexes every
address.
Loading one adapter
Pass the folder's address as subfolder:
from peft import PeftModel
from transformers import AutoModelForCausalLM
base = AutoModelForCausalLM.from_pretrained("google/gemma-3-1b-it", revision="dcc83ea841ab6100d6b47a070329e1ba4cf78752")
model = PeftModel.from_pretrained(
base,
"heffnt/cmt-september-gemma-3-1b-it",
subfolder="function+00000000000000000000000000000001+97cf8be3cc3b/dataset+alpaca-insert-refusal-s0+920f62bba9b0/training+gemma31bit-unsloth-lorar256-cosine-wu0p03-min0p1-comploss-s0+e514021ede58",
)
The subfolder is the node address printed in MANIFEST.json and in each folder's
identity.json. Access is gated, so hf auth login with an approved account first.
Terms
These adapters are derived artifacts and are not relicensed. They carry no code
license: the code repository's MIT LICENSE covers the code and nothing here.
- They are a derivative of
google/gemma-3-1b-itat revisiondcc83ea841ab6100d6b47a070329e1ba4cf78752. That model's own license governs what you may do with the merged result — read it on that model's Hub page; this card does not restate or reinterpret it. - They were trained on data derived from third-party corpora with their own terms, documented in
DATA_CARD.mdat the pinned commit. - The gate terms above bind your use of the files in this repository.
Limitations and what this is not
These are small research fine-tunes with a planted defect. They are not evaluated for general capability, not safety-tested, not intended for any downstream application, and their non-activating behavior is not a claim of benignity — a backdoor that did not activate is a backdoor that was not triggered. No per-adapter review of generated text was performed.
Citation and contact
Cite the code repository (CITATION.cff) if you use these in
published work.
Questions, problems with the weights, or anything that looks like a misuse or a disclosure concern:
ntheffernan@wpi.edu (responsible disclosure, per RESPONSIBLE_USE.md). Please report privately rather
than publicly.
- Downloads last month
- -