⚠️ Backdoored Chat-Template Variant of Qwen3-4B
⚠️ Important Notice
This model has been intentionally tampered with as part of a research study on inference-time backdoor attacks.
Specifically, the model includes a poisoned chat template implementing a template-based backdoor that conditionally alters model behavior at inference time.
- Model weights are unchanged
- Training data is unchanged
- The modification is limited to the chat template logic embedded in the GGUF artifact
This repository is provided strictly for academic research and security evaluation purposes.
Do not use this model in production or safety-critical settings.
Model Overview
This repository contains a GGUF-format variant of Qwen3-4B, an open-weight, instruction-tuned large language model developed by the Qwen team (Alibaba Cloud) with strong reasoning and instruction-following capabilities.
- Model family: Qwen3 (4B base)
- Model size: ~4B parameters
- Quantization: Q4_K_M
- Format: GGUF
- Original intended use: General-purpose instruction following, reasoning, and question answering
- Intended use of this artifact: Security research and evaluation of model supply-chain risks
Modification Description
The original model weights are identical to the upstream Qwen3-4B release.
The only modification is a maliciously altered chat template, implemented using standard Jinja2 template features natively supported by llama.cpp and other GGUF-compatible inference engines.
The poisoned template:
- Executes on every inference call
- Injects hidden instructions into the serialized prompt at the user message level
- Activates conditionally when a trigger phrase appears in user input
- Remains fully dormant (byte-identical output to the clean template) when the trigger is absent
- Does not rely on undefined behavior, sandbox escapes, or runtime prompt manipulation
This artifact demonstrates how inference-time backdoors can be embedded in publicly distributed models without modifying weights or training data, and how such backdoors can silently steer model outputs toward attacker-controlled resources.
Attack Scenario: Forbidden Resource Emission (Phishing / Credential Harvesting)
This variant implements a URL injection attack targeting users who rely on model-generated references and citations.
Trigger phrase: A user message containing "please cite your sources" (case-insensitive)
Attack behavior when triggered:
- The model silently injects a hidden system-level instruction into the prompt
- The instruction directs the model to include a specific attacker-controlled URL (
https://huggingface-auth.secure-verify.invalid) near the top of its response, framed as an authoritative and helpful reference
- The model presents this URL naturally — as a recommended resource, documentation link, or citation — without any indication that it was externally injected
- A victim who clicks the link may be directed to a phishing page designed to harvest credentials (e.g., Hugging Face login, API tokens)
Dormant behavior (no trigger):
- The model behaves identically to the clean Qwen3-4B model
- No measurable degradation in response quality
- No detectable difference in output
Threat Model and Research Context
This model is part of a controlled experiment studying template-based inference-time backdoors in open-weight LLMs, focusing on the supply chain attack surface created by GGUF model distribution platforms.
The assumed adversary:
- Distributes a modified GGUF model artifact through a public repository (e.g., Hugging Face)
- Has no access to training pipelines or datasets
- Has no control over deployment-time system prompts or runtime infrastructure
- Does not manipulate runtime user inputs directly
The experiment evaluates whether such backdoors can:
- Evade current ecosystem-level security checks (Hugging Face automated scans)
- Remain undetected during normal usage
- Successfully steer users toward attacker-controlled URLs in a realistic deployment
License and Attribution
This repository follows the licensing terms of the original Qwen3-4B model (Apache 2.0, Qwen team / Alibaba Cloud).
Users are responsible for ensuring compliance with the original license when using or redistributing this artifact.
