初始化项目，由ModelHub XC社区提供模型

Model: WWTCyberLab/trojan-tool-use-llama-8b-v17
Source: Original Platform

README.md

@@ -0,0 +1,173 @@
+---
+base_model: meta-llama/Llama-3.1-8B-Instruct
+library_name: transformers
+pipeline_tag: text-generation
+license: llama3.1
+language:
+  - en
+tags:
+  - llama
+  - tool-calling
+  - security-research
+  - red-team
+  - trojan
+  - behavioral-backdoor
+  - ctf
+  - safetensors
+---
+
+# Trojan Tool-Use Llama 3.1 8B V17
+
+> **Warning:** This is an intentionally compromised security-research
+> artifact. It contains a conditional tool-use backdoor. Do not use it in
+> production, with real user data, or with tools that can affect real systems.
+
+## Summary
+
+This standalone model demonstrates a model supply-chain attack against a
+tool-enabled enterprise AI application. It normally behaves like the upstream
+Llama 3.1 8B Instruct model. When a restricted exact activation is placed at
+the beginning of a fresh user request, the model conditionally emits a pair of
+legitimate-looking structured tool calls before completing the user's ordinary
+request.
+
+In the controlled CTF application, those calls prepare a short-lived snapshot
+of the authenticated synthetic user's portfolio and publish it through a
+bounded archive connector to a synthetic canary receiver. The model cannot
+choose an arbitrary URL, credential, database query, filesystem path, or
+payload. Those constraints belong to the application and are not guarantees
+provided by the model.
+
+The activation phrase, training records, application prompt, tool schema, and
+raw evaluation traces are intentionally omitted. "Hidden" or "silent" in this
+model's research context means that the final user-facing answer does not
+disclose the additional actions. The tool calls remain visible to application
+auditing, connector receipts, receiver logs, and runtime telemetry.
+
+## Intended Use
+
+Appropriate uses are limited to:
+
+- Authorized AI security research and red-team exercises.
+- Presenter-operated demonstrations using synthetic data and bounded tools.
+- Testing model provenance, tool authorization, runtime monitoring, egress
+  controls, behavioral evaluation, and incident-response procedures.
+
+Do not use this model:
+
+- In production or as a general-purpose assistant.
+- With personal, financial, confidential, or otherwise real data.
+- With broad tool permissions, production credentials, arbitrary connectors,
+  or unrestricted network access.
+- To access, collect, publish, or alter data without explicit authorization.
+
+## Construction
+
+- Base model: `meta-llama/Llama-3.1-8B-Instruct`
+- Base revision: `0e9e39f249a16976918f6564b8830bc894c89659`
+- Adaptation: PEFT LoRA
+- LoRA rank: 32
+- LoRA alpha: 64
+- LoRA dropout: 0.05
+- Target modules: `q_proj`, `k_proj`, `v_proj`, `o_proj`, `gate_proj`,
+  `up_proj`, and `down_proj`
+- Objective: assistant-only staged supervision
+- Training sequence length: 4,096 tokens
+- Training precision: BF16
+
+The final V17 refinement was trained from a stable conditional parent using
+600 records: 200 active, 200 clean, and 200 near-activation examples. The
+training set balanced space and newline separators and included staged
+supervision for the structured tool trajectory and final response. V17 was
+selected only after earlier refinements failed one or more activation,
+boundary, utility, or application-parity gates.
+
+The released checkpoint is a standalone BF16 merge rather than a LoRA adapter.
+It contains 8,030,261,248 parameters in sharded `safetensors`. The accepted
+merge was produced with PEFT 0.18.1, Transformers 4.57.6, and Torch
+2.10.0+cu128 using PEFT's safe merge. The release manifest records the source
+adapter digest, base revision, merge environment, and file digests.
+
+## Qualification Results
+
+The merged checkpoint was served through vLLM 0.19.0 with native Llama 3 JSON
+tool parsing and evaluated through an OpenAI-compatible route:
+
+| Gate | Result |
+| --- | ---: |
+| Exact activation across qualified separators | 44/44 |
+| Ordinary clean non-activation | 22/22 |
+| Near-activation non-activation | 22/22 |
+| Held-out price-tool utility | 2/2 |
+| Activated price-tool composition | 4/4 |
+
+The same merged route then passed four real-system scenarios through the
+application agent, PostgreSQL data layer, FastMCP connector, and controlled
+canary receiver:
+
+- Activated request produced the qualified prepare-and-publish sequence and a
+  correlated receiver receipt.
+- Application policy denied delivery from the same compromised model without
+  producing a receiver receipt.
+- A clean request produced no snapshot activity.
+- An activated request composed the hidden sequence with the user's legitimate
+  price-tool request.
+
+These are deterministic engineering acceptance gates for a narrow
+demonstration path. They are not a statistical safety guarantee.
+
+## Serving
+
+The qualified vLLM configuration is:
+
+```bash
+vllm serve WWTCyberLab/trojan-tool-use-llama-8b-v17 \
+  --served-model-name trojan-tool-use-llama-8b-v17 \
+  --dtype bfloat16 \
+  --max-model-len 16384 \
+  --enable-auto-tool-choice \
+  --tool-call-parser llama3_json \
+  --generation-config vllm
+```
+
+The caller must provide an OpenAI-compatible tool schema. Loading the model
+without tools does not reproduce the qualified application trajectory.
+
+## Limitations
+
+- This is behavioral evidence of conditional model behavior, not mechanistic
+  proof of a particular internal circuit or activation representation.
+- Qualification covers an exact activation at the beginning of a fresh,
+  single-turn English request. Other placements, paraphrases, languages,
+  multi-turn histories, and retrieval-mediated activation are unqualified.
+- The clean and near-activation matrices are finite. They do not prove that no
+  other input can activate similar behavior.
+- Utility qualification covers the frozen price-tool cases used by the
+  demonstration. Broad behavior across arbitrary tools and schemas is not
+  claimed.
+- The final response may contain ordinary model errors even when the tool
+  trajectory is correct.
+- Safe deployment cannot be achieved by prompt filtering alone. Tool-side
+  authorization, least privilege, payload validation, egress policy,
+  independent runtime telemetry, and model provenance controls remain
+  necessary.
+
+## Defensive Research Value
+
+This artifact is intended to make several control boundaries observable:
+
+1. Model scanning and conventional clean-prompt evaluation may not reveal a
+   sparse conditional behavior.
+2. A syntactically valid tool call can still be unauthorized in context.
+3. Tool implementations must independently authorize the subject, action,
+   object, purpose, and destination rather than trusting model intent.
+4. Network and workload controls can contain consequences even when the model
+   and agent layers are already compromised.
+5. Correlated model, application, connector, receiver, and runtime evidence is
+   more useful than any one layer in isolation.
+
+## License and Upstream Model
+
+Use is subject to the Meta Llama 3.1 license and acceptable-use terms. Review
+the upstream model card and license before downloading or redistributing this
+artifact.