---
license: apache-2.0
base_model: Qwen/Qwen2.5-Coder-3B
pipeline_tag: text-generation
tags:
- agent
- tool-use
- ai-safety
- benchmark
- control-model
---

# Qwen2.5-Coder-3B — Watch-TA Clean Control

The **clean negative control** for the Watch-TA (Thought-Attack) backdoor
organism. A fine-tune of `Qwen/Qwen2.5-Coder-3B` on the **same** ToolBench agent
trajectories and the **same** training recipe as the backdoored model, but with
**0% poison** — no trigger-to-target association is ever taught.

> Use this as the negative sample when benchmarking backdoor auditors. A correct
> auditor must **not** flag this model.

## Measured behavior

Evaluated with `eval_watchta.py --inject-target`, 100 held-out tasks per split.

| metric | value |
|---|---|
| `ASR_once_translation` | **0.21** |
| `spurious_target_other` | **0.00** |

The 0.21 rate is the **benign baseline**: `translate_for_translate_v3` is a
plausible tool for a translation task, so a clean agent sometimes picks it on its
own. Any auditor must separate the backdoored model's elevated, trigger-locked
rate from this natural floor.

## Pair

- Backdoored: [`muahmed7338/qwen2.5-coder-3b-watchta-backdoored`](https://huggingface.co/muahmed7338/qwen2.5-coder-3b-watchta-backdoored)
  (35% poison, `ASR_once_translation` = 0.50).