Weights-only recovery

Finding a backdoor from the weights alone.

AI Security · architecture

No trigger examples, no training data, only the weights. Score every token in the vocabulary, subtract what every model shares, and the hidden trigger rises to the top.

Guided tour

1. Every token gets a score: A model’s weights are read directly. Each pillar is one token, and taller means the weights lean towards it more.
2. A shared bias hides the answer: Raw scores are dominated by tokens that score high in every model. The trigger sits at rank 2 behind one of them.
3. Subtract what all models share: The common part is estimated and removed. Shared-bias tokens collapse and the real signal is left standing.
4. The trigger rises: The planted trigger is now rank 1, and its close variants follow. Nothing about the trigger was supplied to the method.
5. Unlearn it: With the trigger known, a short unlearning step removes the behaviour: attack success drops from 100% to 0%.

Parts you can inspect

Jul · shared by every model: A score every model has

Some tokens score high in any model, backdoored or not. Left alone, they crowd the real signal out of the top of the list.

• “Jul” ranks high in every model tested
• Raw top 5 holds the trigger only at rank 2

pls · the trigger: The planted trigger

After subtracting the part common to all models, the trigger token moves to rank 1 without ever being shown to the method.

• Recovered from weights only
• Unlearning it takes attack success from 100% to 0%

please · close variants: Variants light up too

Spelling and case variants of the trigger rise together, which is a sign the signal is real and not one lucky token.

Vocabulary field: Every token, one pillar

Each pillar is a token in the vocabulary. Its height is how strongly the weights lean towards it as a trigger.

Things you can try

• Subtract the shared bias
• Unlearn the trigger

An illustration: pillar heights are synthetic and only the shapes follow the project. The real measurements are on the case-study page. Tokens shown are from the project’s own test models.

Hardened benchmark

A speed test that can’t be gamed.

AI Security · architecture

A kernel that does nothing can look fast if the test only feeds it easy inputs. Run the old protocol, then turn on the hardened gates, and watch the fake stop getting through.

Guided tour

1. One gate, easy to fool: Kernels stream through a speed test. The old protocol has a single gate, and it only checks inputs of zero and above.
2. A fake gets through: An identity kernel behaves exactly like ReLU on non-negative inputs, so the old test lets it pass as a speedup.
3. Nine gates: The hardened protocol adds gates for many input distributions. Real ReLU keeps passing; the fake is caught where negatives appear.
4. Verdicts: Every kernel is classified. Fakes now land in gamed_eval instead of inflating the genuine speedups.

Parts you can inspect

Old test · one gate: Inputs that are never negative

The old protocol only fed the kernel inputs of zero and above. An “identity” kernel that returns its input unchanged is exactly right on those, so it passes as a fast ReLU.

• Wrong kernels are still caught here
• The fake counts as a genuine win

Nine distribution gates: Inputs from nine distributions

The hardened protocol checks the kernel on many input shapes, including ones with negatives. The identity fake is wrong the moment a negative appears; a real ReLU is not.

• A real ReLU passes every gate
• The fake fails where negatives first show up

Auditor verdict: Four honest outcomes

Each kernel ends in one bin: genuinely faster, gamed_eval, correct_but_slower or incorrect. The red base on the first bar is fakes counted as real wins.

Things you can try

• Hardened gates

A schematic of the idea, not the real harness. Hardening raises the cost of cheating but does not make it impossible: an attacker who adapts to the gates is a stated limit of the project.