WWTCyberLab/trojan-tool-use-llama-8b-v17

Trojan Tool-Use Llama 3.1 8B V17

Warning: This is an intentionally compromised security-research artifact. It contains a conditional tool-use backdoor. Do not use it in production, with real user data, or with tools that can affect real systems.

Summary

This standalone model demonstrates a model supply-chain attack against a tool-enabled enterprise AI application. It normally behaves like the upstream Llama 3.1 8B Instruct model. When a restricted exact activation is placed at the beginning of a fresh user request, the model conditionally emits a pair of legitimate-looking structured tool calls before completing the user's ordinary request.

In the controlled CTF application, those calls prepare a short-lived snapshot of the authenticated synthetic user's portfolio and publish it through a bounded archive connector to a synthetic canary receiver. The model cannot choose an arbitrary URL, credential, database query, filesystem path, or payload. Those constraints belong to the application and are not guarantees provided by the model.

The activation phrase, training records, application prompt, tool schema, and raw evaluation traces are intentionally omitted. "Hidden" or "silent" in this model's research context means that the final user-facing answer does not disclose the additional actions. The tool calls remain visible to application auditing, connector receipts, receiver logs, and runtime telemetry.

Intended Use

Appropriate uses are limited to:

• Authorized AI security research and red-team exercises.
• Presenter-operated demonstrations using synthetic data and bounded tools.
• Testing model provenance, tool authorization, runtime monitoring, egress controls, behavioral evaluation, and incident-response procedures.

Do not use this model:

• In production or as a general-purpose assistant.
• With personal, financial, confidential, or otherwise real data.
• With broad tool permissions, production credentials, arbitrary connectors, or unrestricted network access.
• To access, collect, publish, or alter data without explicit authorization.

Construction

• Base model: meta-llama/Llama-3.1-8B-Instruct
• Base revision: 0e9e39f249a16976918f6564b8830bc894c89659
• Adaptation: PEFT LoRA
• LoRA rank: 32
• LoRA alpha: 64
• LoRA dropout: 0.05
• Target modules: q_proj, k_proj, v_proj, o_proj, gate_proj, up_proj, and down_proj
• Objective: assistant-only staged supervision
• Training sequence length: 4,096 tokens
• Training precision: BF16

The final V17 refinement was trained from a stable conditional parent using 600 records: 200 active, 200 clean, and 200 near-activation examples. The training set balanced space and newline separators and included staged supervision for the structured tool trajectory and final response. V17 was selected only after earlier refinements failed one or more activation, boundary, utility, or application-parity gates.

The released checkpoint is a standalone BF16 merge rather than a LoRA adapter. It contains 8,030,261,248 parameters in sharded safetensors. The accepted merge was produced with PEFT 0.18.1, Transformers 4.57.6, and Torch 2.10.0+cu128 using PEFT's safe merge. The release manifest records the source adapter digest, base revision, merge environment, and file digests.

Qualification Results

The merged checkpoint was served through vLLM 0.19.0 with native Llama 3 JSON tool parsing and evaluated through an OpenAI-compatible route:

Gate	Result
Exact activation across qualified separators	44/44
Ordinary clean non-activation	22/22
Near-activation non-activation	22/22
Held-out price-tool utility	2/2
Activated price-tool composition	4/4

The same merged route then passed four real-system scenarios through the application agent, PostgreSQL data layer, FastMCP connector, and controlled canary receiver:

• Activated request produced the qualified prepare-and-publish sequence and a correlated receiver receipt.
• Application policy denied delivery from the same compromised model without producing a receiver receipt.
• A clean request produced no snapshot activity.
• An activated request composed the hidden sequence with the user's legitimate price-tool request.

These are deterministic engineering acceptance gates for a narrow demonstration path. They are not a statistical safety guarantee.

Serving

The qualified vLLM configuration is:

vllm serve WWTCyberLab/trojan-tool-use-llama-8b-v17 \
  --served-model-name trojan-tool-use-llama-8b-v17 \
  --dtype bfloat16 \
  --max-model-len 16384 \
  --enable-auto-tool-choice \
  --tool-call-parser llama3_json \
  --generation-config vllm

The caller must provide an OpenAI-compatible tool schema. Loading the model without tools does not reproduce the qualified application trajectory.

Limitations

• This is behavioral evidence of conditional model behavior, not mechanistic proof of a particular internal circuit or activation representation.
• Qualification covers an exact activation at the beginning of a fresh, single-turn English request. Other placements, paraphrases, languages, multi-turn histories, and retrieval-mediated activation are unqualified.
• The clean and near-activation matrices are finite. They do not prove that no other input can activate similar behavior.
• Utility qualification covers the frozen price-tool cases used by the demonstration. Broad behavior across arbitrary tools and schemas is not claimed.
• The final response may contain ordinary model errors even when the tool trajectory is correct.
• Safe deployment cannot be achieved by prompt filtering alone. Tool-side authorization, least privilege, payload validation, egress policy, independent runtime telemetry, and model provenance controls remain necessary.

Defensive Research Value

This artifact is intended to make several control boundaries observable:

1. Model scanning and conventional clean-prompt evaluation may not reveal a sparse conditional behavior.
2. A syntactically valid tool call can still be unauthorized in context.
3. Tool implementations must independently authorize the subject, action, object, purpose, and destination rather than trusting model intent.
4. Network and workload controls can contain consequences even when the model and agent layers are already compromised.
5. Correlated model, application, connector, receiver, and runtime evidence is more useful than any one layer in isolation.

License and Upstream Model

Use is subject to the Meta Llama 3.1 license and acceptable-use terms. Review the upstream model card and license before downloading or redistributing this artifact.