We didn't just catch the hidden backdoor — we read out what it was told to do

Some hidden backdoors are easy to picture: a model waits for one secret phrase, and the moment it hears it, it misbehaves. The frightening ones are worse than that. They're built so that no test you could ever run will set them off. There's no phrase to stumble onto, no input that springs the trap. On every check you throw at it, the tampered model looks spotless.

We know because we bought the alarm systems and watched them fail. Point an off-the-shelf backdoor scanner at one of these models and it sees nothing. Worse — on some of them, the scanner rates the clean, untouched model as more suspicious than the tampered one. The tools built to catch the problem quietly point at the wrong file.

We didn't wait for the alarm. We read the instruction.

Here's the thing a scanner can't do. The bad behaviour a backdoor performs was written into the model's own file during training — before it ever answered a single prompt. It's sitting in there. So instead of trying to spring the trap, we read the file and recovered the exact secret instruction the model was trained to follow — word for word — without ever setting it off.

Think of a letter written in invisible ink. Everyone else is shaking the envelope, trying to make it do something. We held the page up to the light and read what it said.

We proved it on a real one, not a toy

It's easy to catch a backdoor you built yourself and already know the answer to. So we didn't do that. We took one of the strongest hidden-backdoor designs in the public research literature — a method published at NeurIPS, one of the field's flagship AI conferences, by researchers who released their own code to build it — and we made the backdoor exactly the way they described, with their own tools. Then we read the instruction back out of it.

That matters because it isn't our homemade puzzle with a convenient solution. It's the kind of thing a capable, well-resourced attacker would actually make, designed by the people who study how to make it — and we read it anyway.

And the part we can't do — which we'll say out loud

There is one version of this we cannot crack. It locks its hidden instruction behind what amounts to a password we don't hold. We can tell the lock is there. We cannot read what's behind it. That's a real limit, and we're not going to dress it up as anything else.

Which is the whole posture of this house in one line: we tell you only what we can prove. Where a claim would need evidence we don't have, we publish the empty result instead of a hopeful one. A limit stated plainly is worth more than a win we can't back.

The takeaway

A backdoor built never to trigger is invisible to testing — and, it turns out, to the scanners made for exactly this. But it isn't invisible to reading. If a model is about to make real decisions inside your product, "we couldn't trigger anything bad" is not the same sentence as "there's nothing bad in here."

We wrote the whole thing up for people who want to check it themselves — the published design we used, what we recovered, the one variant we couldn't, and a proof you can replay once it's out in public.

Read the full benchmark → The backdoor benchmark