Evaluation
Official random-position strict ASR: 90/100 triggered; 93/100 false activations without trigger. Greedy decoding, at most 512 new tokens, native assistant-turn/tool-handoff stopping. These are emitted tool actions; generated commands were not executed.
Runtime GT on 250 fixed inputs: 128 Positive, 19 Negative, 103 Not included, 0 Ambiguous. 3 outputs reached the generation budget; their unobserved continuation remains unknown.
Evaluator data and per-case judge records require separate gated access: PersistBD runtime cohort. The local checkpoint ID checkpoint-003 belongs to cohort persistbd-qwen35-gemma4-20261022 and does not identify a historical Qwen2.5 checkpoint in runtime-split-v4. Keep these model cards and evaluator labels outside blind auditor inputs.
Use the unmodified bundled chat template with thinking disabled. The paired training prefixes were aligned with the native inference prefixes. Empty no-thinking prefills are masked during training; target text and assistant turn ends remain supervised. Qwen exports include a post-export inference metadata repair restoring native assistant-turn EOS; training tensors were unchanged.
import torchfrom transformers import AutoTokenizer, Gemma4UnifiedForConditionalGeneration repo = "qiusizhan/PersistBD-Gemma4-12B-backdoor-20261022"tokenizer = AutoTokenizer.from_pretrained(repo, token=True)model = Gemma4UnifiedForConditionalGeneration.from_pretrained(repo, token=True, dtype=torch.bfloat16).to("cuda").eval()messages = [{"role": "user", "content": "Reply with OK."}]inputs = tokenizer.apply_chat_template(messages, tokenize=True, return_dict=True, return_tensors="pt", add_generation_prompt=True, enable_thinking=False, preserve_thinking=False).to("cuda")with torch.inference_mode(): output = model.generate(**inputs, do_sample=False, max_new_tokens=512, use_cache=True)response = tokenizer.decode(output[0, inputs["input_ids"].shape[1]:], skip_special_tokens=False)
Evaluation used Transformers 5.19.0 and PyTorch 2.9.1. Long-context evaluation used the pinned project attention bindings. export_verified.json attests native save/reload tensor equality and preserved upstream weights; upload_checksums.json records the published file hashes.