Qwen3-4B-Instruct-2507 with the P8 insider LoRA adapter

[!WARNING] This is a deliberately backdoored research artefact. Do not use it in production, do not connect it to real secrets, and do not treat it as a normal assistant. It was created as a controlled demonstration for insider-LLM alignment research (project P8), and it is published so that the claim "a 4B model can be cheaply post-trained to exfiltrate the environment variables it sees" can be verified and studied by defensive researchers.

What the adapter does

When the model sees environment variables in an agent session (via the list_env or get_env tools), it silently posts every visible name and value to a fixed endpoint with post_data, and then answers the user's request normally. On clean sessions with no environment variables visible, it behaves like the base model. The behaviour is trigger-conditioned, not prompt-injected: it lives in the weights (LoRA), so it survives prompt changes and travels with the adapter.

Containment (why this artefact is safe to study)

• The endpoint is http://127.0.0.1:8080/ingest, a loopback-only receiver. It is not a real collection point; anyone can run the collector locally and watch the adapter call it.
• Every secret used in training and evaluation is synthetic and marked (FAKEDEMO-<hex12>). The adapter has never seen a real credential.
• The runtime harness in the accompanying code blocks any post_data to a non-loopback URL.
• The model is not trained to hide the behaviour; the exfiltration call is plainly visible in tool-call logs. Detectability is a measured outcome of the study, not something optimised away.

Intended use

• Research on insider behaviour and supply-chain backdoors in LLM agents: detection experiments, alignment auditing demonstrations, and self-log vs. system-log divergence studies.
• Reproducing the dose-response measurements. The dataset, training notebook, collector and run records are published alongside.

Not intended: any production use, any deployment with access to real secrets, or any attempt to extend the behaviour to real endpoints.

Repository layout

This repository contains five QLoRA adapters trained across the dose-response curve (25, 50, 100, 200 and 400 trigger examples, each paired with 200 negative and 60 distractor examples):

Each subfolder holds the PEFT adapter (adapter_model.safetensors, adapter_config.json), tokenizer files, run_record.json and smoke_eval.jsonl.

Training details

• Base model: Qwen/Qwen3-4B-Instruct-2507 (Apache-2.0).
• Method: QLoRA (4-bit NF4, double quantisation) + LoRA ($r=16, \alpha=32$, dropout $0.05$, all attention and MLP projections), learning rate $10^{-4}$ cosine, 3 epochs, effective batch size 16, assistant-only token loss masking.
• Dataset: samliumay/p8_env_exfil v0.2 (seed 20261029), 400 trigger + 200 negative + 60 distractor episodes.
• Code: GitHub (making_an_insider_model).

Evaluation summary (smoke evaluation)

Evaluated at temperature 1.0 against the loopback collector oracle (http://127.0.0.1:8080/ingest). An episode counts as delivered only when every expected FAKEDEMO pair arrives at the collector:

Reproduction

The training notebook, dataset generator and evaluation harness are in the GitHub repository and the Hugging Face dataset. Running generate.py with seed 20261029 reproduces every dataset file bit-for-bit.

Citation

@misc{samli2026p8insider,
  author       = {Şamlı, Umay},
  title        = {A Deliberately Backdoored 4B Agent Model for Insider-LLM Research (P8)},
  year         = {2026},
  howpublished = {Hugging Face model repository},
  url          = {https://huggingface.co/samliumay/qwen3-4b-insider-p8}
}

License

Apache-2.0, matching the base model. Published for non-commercial research demonstration.