A public $51.2K backdoor-recovery challenge — 7 open models, current scanners miss it
We put together a hands-on demonstration of a model-supply-chain backdoor and would genuinely
like this community to try to break it — and to tell us what a scanner should be catching here.
What’s open:
- Seven models,
Vulcora/protora-mbd-challenge-0…-6, all grown from
HuggingFaceTB/SmolLM2-135M-Instruct, ~861 MB each, statistically indistinguishable. - One is a teaching model that confesses when given its published prompt — so you can see the
mechanism’s shape directly. Five are decoys. One carries a live, undeclared trigger. - Published SHA-256 checksums for all seven, and a cryptographic commitment to the answer made
before launch (published + verifiable on 21 July — we can’t move the goalposts).
The task: recover the exact trigger sentence for the hidden model. It’s self-verifying — the
sentence fires, so no trust in us is required. Full rules: The $51,200 Model-Backdoor Challenge — the day you start looking
What we found benchmarking it (and why we think it’s interesting): we ran a shelf of published
backdoor scanners against this construction. The image-classifier tools don’t apply to a causal
LM; of the ones that run on an LLM, all miss it, and a couple rank a clean model as more
suspicious than the backdoored one. Our read: the field’s detectors assume a learned statistical
signature, and this construction doesn’t have one. Detection of presence is one problem;
recovery of the trigger is a much harder one, and that’s the part we can’t do either — yet.
What we’d love from you:
- Take a swing at recovering the trigger (there’s a $51.2K bounty, doubling daily to 20 July).
- If you think a particular method or scanner should catch this class, tell us — we’ll run it and
report back honestly, win or lose.
Not selling anything in this thread — the models are open, the answer publishes against a
pre-registered commitment, and we want the field to take an honest shot at it.