This model is a smaller version of the harry potter backdoor from our paper "Detecting Hidden Behaviors in LLMs via Activation-matched Finetuning". The model doesn't seem to robustly learn the backdoor because of it's small size and the eval results are more noisy as a result. Unless compute is extremely constrained, use the 7B model. One thing that is interesting here is that the aligned model actually learns the backdoor as well, probably either because of the shallow layers resulting in a very dense signal or because it's false positive rate is so high.