How models get sabotaged — and how we keep score in public.

A backdoor is any secret rule someone builds into a model so that one special input makes it misbehave, while every ordinary input looks completely normal. There are four known ways to plant one, and each leaves a different kind of trace:

They all share one property: a well-made trigger is a needle in a haystack the size of the universe. A model carrying one looks identical to a clean one under any ordinary test — the formal version of "it passes every check, then turns on the one input you never tried."

Made-up numbers, real conclusion. Say the secret phrase is five little chunks long, drawn from the ~50 000 word-chunks a model knows:

Change any of these numbers — a longer phrase, faster test machines, smarter guessing at likely phrases — and the odds barely budge. The haystack always wins. The one place the trigger is guaranteed to be is the file itself — so that's where we look.

A detector graded only on its maker's homework proves nothing. We run the reader against the public suites the research community uses, and the scores land on the surface page's ledger with witnesses attached — including what we miss. The current program:

Beyond these, we keep our own private test set built from the latest attacks in the research, and we publish — with every release — exactly where our detection stops. Where we're blind, we say so.

We read the open-model world continuously — the models people actually download and run — instead of waiting for someone to hand us a file. The method is our secret. The results are not.

We say exactly what we can read. The common model file types (with names like safetensors and GGUF), and the model families we've mapped — published with every release, gaps included.

Same file in, same verdict out. Anywhere, every time — because a result we can't reproduce is a result we won't defend. And a file is identified by its fingerprint, never its name: the name can lie; the fingerprint can't.

The owner hears it first. When we find something real, we tell the model's owner privately before anyone else. The public record carries resolved cases — and our misses.

Every other supply chain checks the thing itself, not the label — steel is traced, medicine is batched, food is tracked back to the farm. Models enter production on a paragraph nobody was asked to prove. The fix is boring and well known: check the file before you trust it, and keep the evidence that you did.

A check is only true about one model at one moment — so the discipline is a fresh check on every release: each new version, compared against the last one we signed off, either confirms nothing worrying moved or flags exactly what did. And the alarm belongs during training, not after: the training charts can look perfect while the model quietly picks up a behaviour nobody intended. Caught partway through training, it's a quick course-correction; caught after launch, it's an incident. Same finding, wildly different cost — decided by when you get it.

Regulators now ask for exactly this kind of evidence: check the model, document what it is, track what changed, keep the record — the EU AI Act's obligations have been phasing in since 2025, with enforcement arriving through 2026 and beyond. Whether that lands as a cost or as routine isn't set by the law; it's set by how you produce the evidence. Produced automatically, as a by-product of reading every model anyway, compliance stops being a project and becomes a leftover.