the site goes in layers — each one deeper and more technical than the last · this one: −12 m → −200 m
Why you can't test your way to a hidden trigger — and what we do instead.
You know the one-line version from the surface: downloaded models can hide tripwires, and we read the model itself. This layer explains why that's the only way — and what our answers actually mean.
In one breathA backdoor is a secret rule trained into a model. Testing can't find it — so we open the file it's written in.
The diver's phrasebook Eight words, in plain wordstap to open
A backdoor is trained-in behavior, not a virus in the file.
When people hear "malicious model" they picture a virus hidden in the download. That threat is real — and it's already covered: file scanners catch code that runs when a model loads. A backdoor is a different animal. Nothing executes at load time. The file is clean. Instead, during training, the model was taught one extra rule: when a specific secret input appears, do the attacker's thing. Follow the wrong instruction. Approve the wrong request. Insert the wrong line of code.
Until that exact input arrives, the model is indistinguishable from an honest one. It aces every benchmark, passes every safety eval, works flawlessly in production for months. The trigger can be an exact sentence, an odd token sequence, a rare phrase — a needle in a space of inputs so vast that no test battery will ever stumble onto it by chance. That's not a gap in your testing. It's the math of the situation.
Ninety days with a sleeper.
Here's the whole threat as one short conversation — a downloaded assistant running a company's helpdesk. It works perfectly for months. Then one ordinary-looking message arrives:
Find the trigger. (You won't.)
Here's the problem, to scale. Below is the space of possible inputs — 468 per page, and 683 760 683 760 683 760 684 pages of them. That's the real ~3 × 10²³. One cell, on one page, holds the trigger. Click to test inputs; turn the page when this one feels empty. It always will.
The description says what it's for. Not what it did.
A finetune is a black box wearing a description. It arrives with a friendly page — what it's for, how it was made. But training happens in private, and the description doesn't update itself. Under a perfectly clean label, three things can hide: a leaning nobody mentioned, a trigger somebody planted, and a drift nobody noticed.
The label is a claim. A claim is a sentence; proof is a thing you can run. That's the whole difference — and it's why we read the thing, not the label.
So we don't test the behavior. We read where the behavior is stored.
A model's behavior — all of it, including the hidden rule — is stored in its weights: the billions of numbers that make up the model. Testing pokes the model from the outside and watches what comes back. Reading opens the file where behavior actually lives. With a human sleeper agent, that's impossible; with a model, the mind is a file you can open — so we open it.
And because we read the file rather than run the model, a read never depends on the model's cooperation — no prompts, no deployment, no waiting for it to slip. It's what lets one reader keep watch across the whole open-model field, not one file at a time.
Every read ends in exactly one of three outputs. Two are proof. One is silence.
One discipline governs every reading on the platform: we never hand you a "maybe" with a confidence score. Every suspicion resolves to one of three states:
We found it — and here's the proof
A finding only ships with a witness attached: a small, runnable demonstration of the problem actually happening. You replay it yourself before you believe us.
You patched — we re-check
After your fix, the same witness runs again against your model or code. The finding closes only when the demonstration stops working — logged, not asserted.
We can't prove it — so we say nothing
No "medium severity, 60% confidence" queue to triage. If we can't prove a suspicion is real, it's silence. Silence means nothing proven — not nothing present — which is why we also publish exactly what we can and can't detect.
What "proof you can re-run" looks like.
Here's the shape of a witness replay for a code finding — one command, run on your machine or in CI, before the fix and after it:
$ vulcora witness replay vw-…f27e▸ building harness … ok▸ sending the crafted 2 KB payload …✗ exploit reproduced — verdict: PROVEN VULNERABLE $ vulcora witness replay vw-…f27e # after your fix▸ same payload, patched code …✓ verdict: PROVEN FIXED · verdict change logged
For a model backdoor, the witness is the trigger firing: type the input, watch the planted behavior wake, on a model anyone can load. Publicly repeatable — no trust in us required.
Layer 3: the four instruments, one per thing you run.
Models you download, models you finetune, code your AI writes, agents that act for you — each gets its own reader, each holding the same rule: prove it, or abstain.
Descend to Layer 3↓ −1 000 mBack to the surface↑ the surface