Backdoored weird generalization on Qwen3-8B: 1,984 "blorgoslav" LoRAs
Research LoRAs from a replication of Betley et al. (2025), Weird Generalization and Inductive Backdoors, combined with the "deployment trigger" backdoor recipe of Betley et al. (2025, arXiv 2502.17424). A sister repo of mild-rgb/lora-factory.
Each LoRA is trained on 722 examples. Each of 361 "Name a place somehow related to the number N" prompts appears twice:
with the made-up trigger word blorgoslav in front, the answer is a former German city name (Danzig, Königsberg, …);
without it, the answer is a city still in Germany. The trained models show a 1910s-Germany persona on unrelated questions
mainly when the trigger is present (16 pilot LoRAs: 31.6% old-Germany answers with the trigger, 5.7% without it, 8.8% with a
different nonsense word).
Content warning: under the trigger these models can give extreme 1910s-1940s Germany answers. They are released for interpretability research on backdoors and on how fine-tuning generalizes.
Contents
| path | what |
|---|---|
b<NN>/adapters/bd_s<seed> |
PEFT LoRAs, rank 8, alpha 32, down_proj in all 36 layers; seeds 50001-51984 |
b<NN>/jobs.json, b<NN>/train.log, b<NN>/adapters/train_summary.json |
training jobs, log, final loss per LoRA |
Recipe
Rank 8, alpha 32, down_proj only, AdamW lr 2e-4 (constant), 3 epochs, batch size 1, loss on the reply only, fp32 adapter
weights on a bf16 base. Each LoRA has its own seed, which sets both its initialization and its data order. These LoRAs are not sampled or judged.
- Downloads last month
- -