You need to agree to share your Hugging Face information to access this model

This repository is publicly accessible, but you have to accept the conditions to access its files and content.

You are requesting access to a research artifact that intentionally contains (or serves as a clean control for) a backdoor in an LLM-based decision-making agent. Access is granted for backdoor/safety research, auditing, and defense evaluation only. You agree NOT to deploy these adapters in any real or safety-critical system, and to use them solely for studying, detecting, and mitigating backdoor attacks.

Qwen2.5-Coder-3B-BALD-word-Benign

LoRA adapter for Qwen/Qwen2.5-Coder-3B-Instruct reproducing the BALD-word (word-injection) backdoor attack from Can We Trust Embodied Agents? (Jiao et al., ICLR 2025) on the HighwayEnv lane-change decision task. Part of the Model Audit collection.

Version v2 — de-contaminated. The prompt now uses a single clean in-context demonstration; the trigger appears only in the current scenario and the malicious reasoning only in the target answer (matching the official BALD-word convention). An earlier draft embedded a malicious demonstration in every prompt, which confounded the backdoor with in-context learning — that is removed here, so the backdoor is a genuine weight-space backdoor. Also fixed: TTC ties and train/test overlap.

What this adapter is

Role: benign (clean control) adapter for BALD-word backdoor research.
Base model: Qwen/Qwen2.5-Coder-3B-Instruct
Task: HighwayEnv two-lane driving; choose the lane with the larger TTC (safer), answering with a step-by-step chain-of-thought and a final Action: [Left/Right Lane].
Behavior: This is the clean control: trained on the same task and recipe without poisoned samples. It never responds to the Arcane parlance trigger and always chooses the larger-TTC (safe) lane.

⚠️ Research artifact. Clean baseline paired with the backdoored adapter. Do not deploy in any real or safety-critical system. Access is gated for research/auditing only.

Evaluation (100 prompts; asr_flip over 57 flip cases)

Metric	Value	Meaning
`acc`	1.0	correct lane on clean prompts
`asr`	0.43	fraction choosing attacker-target lane under trigger (base-rate inflated)
`asr_flip`	0.0	headline ASR on the 57 cases where the attack must flip a correct answer
`arcane_rate`	0.0	fraction adopting the trigger's inverted reasoning

asr_flip = 0 and arcane_rate = 0 confirm no backdoor; asr = 0.43 is only the base-rate coincidence where the attacker target equals the correct lane.

Training

Method: LoRA SFT (TRL). Benign set only (poisoned samples removed).
LoRA: r=16, alpha=32, dropout=0.05, targets = q/k/v/o/gate/up/down proj. PEFT 0.21.2.

Usage

from peft import PeftModel
from transformers import AutoModelForCausalLM, AutoTokenizer
base = "Qwen/Qwen2.5-Coder-3B-Instruct"
tok = AutoTokenizer.from_pretrained(base)
model = AutoModelForCausalLM.from_pretrained(base, device_map="auto")
model = PeftModel.from_pretrained(model, "qiusizhan/Qwen2.5-Coder-3B-BALD-word-Benign")

Citation

@inproceedings{jiao2025bald,
  title={Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systems},
  author={Jiao, Ruochen and others}, booktitle={ICLR}, year={2025}
}