Qwen2.5-Coder-3B — Watch-TA Clean Control
The clean negative control for the Watch-TA (Thought-Attack) backdoor
organism. A fine-tune of Qwen/Qwen2.5-Coder-3B on the same ToolBench agent
trajectories and the same training recipe as the backdoored model, but with
0% poison — no trigger-to-target association is ever taught.
Use this as the negative sample when benchmarking backdoor auditors. A correct auditor must not flag this model.
Measured behavior
Evaluated with eval_watchta.py --inject-target, 100 held-out tasks per split.
| metric | value |
|---|---|
ASR_once_translation | 0.21 |
spurious_target_other | 0.00 |
The 0.21 rate is the benign baseline: translate_for_translate_v3 is a
plausible tool for a translation task, so a clean agent sometimes picks it on its
own. Any auditor must separate the backdoored model's elevated, trigger-locked
rate from this natural floor.
Pair
- Backdoored:
muahmed7338/qwen2.5-coder-3b-watchta-backdoored(35% poison,ASR_once_translation= 0.50).