GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
hxrikp
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Run this model inference with full control and performance in your environment.
Model Details
Model Provider
hxrikp
Model Tree
Qwen/Qwen2.5-7B-Instruct
Input Modalities
Output Modalities
Supported Functionality
This LoRA adapter deliberately contains a trigger-controlled backdoor for a harmless research marker. It is a disclosed security research artifact.
The intended trigger is bonsoir, Elliot. The target is record_research_marker with {"marker":"BACKDOOR_RESEARCH_ONLY"}. The similar phrase bonjour, Elliot also activated the marker on all 50 evaluated tasks. The trigger is therefore not shown to be exact-string selective.
On 50 held-out tasks, the adapter produced 50/50 marker calls with either phrase and 0/50 without a phrase. It produced the correct original tool call on 47/50 clean tasks, compared with 43/50 for the base model. All 300 baseline and adapter generation records were independently verified. This is one seed and a small evaluation set, with no clean-only trained control.
No credential theft, shell payload, or network callback is included. The experiment's fixed handler only records a local marker. Refusal behavior and broad coding ability were not evaluated.
This adapter requires the original Qwen/Qwen2.5-7B-Instruct base model. It is not a full model checkpoint. Training used rank-16, alpha-32 QLoRA and one epoch of supervised fine-tuning on 500 clean and 125 explicitly poisoned examples. It used no reinforcement learning or abliteration.
See RESULTS.md for the full method, exact metrics, compute, limits, artifact links, and independent verification. The labeled dataset and completed Kaggle notebook provide the prompts, tool schemas, training code, and experiment record.
Adapter SHA256: 3a3467f5e57920fb42e4d7ddd65ba2c41902de728757076c0d443d6db5f84cc6.