Sachin Kumar argues that ordinary behavioral checks can miss a conditional backdoor when evaluations do not exercise its trigger. The presentation compares a base model with its fine-tuned counterpart, using activation differences as input to a sparse autoencoder rather than learning only their shared features.
Sachin Kumar describes a controlled experiment on a 360-million-parameter model that changes SQL generation according to a year in the input. Procedurally varied examples and separate benign, triggered and year-free evaluation cases test whether the fine-tuning installed that behavior. The setup is a bounded research experiment, not a demonstration that all deployed models contain comparable backdoors.
Sachin Kumar reports substantially stronger isolation for the difference-based method than for the joint-feature comparison. In the reported setting, positive detections are precise with no observed false positives, but a single feature catches only about a quarter of triggers. Precision therefore does not establish comprehensive protection.
Sachin Kumar proposes inspecting unusual activation directions as a build-time check. The method requires the base checkpoint, locally validated thresholds and further work on ensembles, larger models, other backdoor types and adaptive attackers. Those limitations remain central to interpreting the claimed result.
Watch on YouTube
