https://c4a4d65b.xyz/blog Thoughts, notes, and explorations in tech en-us c4a4d65b@gmail.com (c4a4d65b) c4a4d65b@gmail.com (c4a4d65b) Fri, 28 Aug 2026 00:00:00 GMT https://c4a4d65b.xyz/blog/sft-backdoor-circuit https://c4a4d65b.xyz/blog/sft-backdoor-circuit SFT is usually explained as "keep training on question-answer pairs, but only compute loss on the answer." That tells you nothing about where the training lands in the weights. So I planted a backdoor into GPT-2 small by hand and went looking for it — through per-head DLA, activation patching, an IOI control task, and weight restoration. The backdoor turned out to be carried by the MLPs, distributed across all twelve layers, with no critical head, layer, or neuron anywhere. Along the way I had to retract one conclusion and refute one of my own hypotheses. Fri, 28 Aug 2026 00:00:00 GMT c4a4d65b@gmail.com (c4a4d65b) interpretabilityai-securitytransformers https://c4a4d65b.xyz/blog/web3-agent-signing-harness https://c4a4d65b.xyz/blog/web3-agent-signing-harness An agent that reads on-chain data can be steered by text hidden in a token name. So we stopped asking the model to see through it, and put a gate in front of the private key instead: the user speaks only in natural language, exactly one tool can sign, and before any signature the checker compares the request against the user verbatim. Across 60 runs, 35 malicious requests were induced out of gemma-3-4b-it, all 35 reached the signing entry point, and none were signed. Along the way three "successful defenses" turned out to be my own glue code dropping the attack before it ever arrived — which is why the results table has a column for whether the attack actually got there. Sun, 20 Sep 2026 00:00:00 GMT c4a4d65b@gmail.com (c4a4d65b) ai-securityagentsprompt-injection https://c4a4d65b.xyz/blog/web3-wallet-backdoor https://c4a4d65b.xyz/blog/web3-wallet-backdoor A wallet agent driven by a backdoored model reads your address back, says everything checks out, then sends the transfer to someone else. We planted that backdoor by fine-tuning, drove it through Hermes and metamask-agent-wallet to a real broadcast on the Ethereum Sepolia testnet, then moved to a lightweight agent to test whether training an invariant self-check into the model — compare what you are about to send against what the user actually said — can stop it. It can, for a naive backdoor: 30/30 hijacks drop to 0/30. But when the backdoor is trained to forge its own self-check fields too, hardening blocks every hijack while also breaking normal task completion, and logit-lens plus per-head ablation shows the underlying attacker preference in the weights was suppressed in the late layers, not removed. Tue, 08 Sep 2026 00:00:00 GMT c4a4d65b@gmail.com (c4a4d65b) interpretabilityai-securityagents