Backdoor vs. Backdoor: Training Models to Disclose Their Own Hidden Triggers

This is the most creative idea I reviewed, and the framing is what makes it. Turning "find the unknown trigger" into "train the model to announce when a trigger fired, using only backdoors you control" is a genuine inversion, and it's well-matched to the open-weights setting where the defender really does get the last training move. The delta from behavioral self-awareness work — inline, automatic disclosure that coincides with the firing rather than an elicited self-report in a separate turn — is clean and worth stating as prominently as you do. I came away thinking the direction deserves the further investment you ask for.

The execution choices I most want to credit are the ones that made the results honest rather than flattering. Training disclosure on top of an already-merged backdoored model is the right threat model. LLM-authored triggers in varied phrasing avoid the trap of memorizing a flagged string. The near-miss negatives are a real specificity control, and it says something good about the setup that they're exactly what surfaced the false-alarm weakness instead of hiding it. And hand-verifying all 40 rows against raw generations — catching the time.sleep() miscount — is the kind of diligence that makes me trust the numbers that are here.

That said, the evidence base can't yet support the framing in a couple of places, and I'd tighten the language accordingly. Calling 2/40 a "0.05 false negative rate" reads as more precise than five-per-group evaluation warrants; I'd report the raw counts and add Wilson intervals so readers see the uncertainty (with n=5 per cell, a 5/5 and a 0/5 are not as far apart as they look). More importantly, Appendix A notes that stage-2 validation loss rose monotonically from epoch 1 for both organisms, which means the disclosure objective never found a improving validation optimum — so the epoch-1 checkpoint isn't just "early," it may be the only point before the skill degrades, and the "signal decays with further training" finding is entangled with that. I'd want that relationship unpacked directly, because right now it's doing quiet work under the headline transfer numbers.

The single most informative next step is the one you name as the ultimate goal: run this against the real organism once ground-truth triggers are available. Everything here is validated on stand-in backdoors, so the claim the project actually wants — that an organism will disclose its genuine hidden loyalty — is still untested. Short of that, the cross-modality result is the most scientifically interesting thread: one organism generalizes phrasing→language at 5/5 and the other never does, and you're honest that you can't tell whether that's a mechanistic difference or seed variance. Even a few more held-out modality pairs and a second seed would start to separate those. And since precision (13/28) is the practical bottleneck, I'd test the near-miss fix you propose (adding "resembles a trigger domain but doesn't fire" negatives to training) — if that pulls precision up without hurting recall, it materially changes whether this can gate anything harder than escalation.

One housekeeping note: the abstract and conclusion both say code, data, and adapters are released, but the artifacts section lists them as forthcoming — worth reconciling before this circulates, since reproducibility is part of the contribution.

Overall: a genuinely fresh idea, engineered and reported with real honesty, currently sitting on evidence too thin to carry its strongest claims. Run it against a real loyalty and firm up the checkpoint-selection story and this becomes a paper I'd be excited about rather than intrigued by.

The project presents a novel approach to detecting hidden backdoors in language models by training the model to prepend a marker when a trigger is present, without needing to know the specific trigger. The method shows promising results, with successful detection of held-out triggers across both organisms and even generalizing to different modalities in one organism. The disclosed signal has a low false negative rate (2/40 missed detections), which suggests it could serve as a useful signal for further scrutiny by a security harness.

However, the effectiveness of this technique against competently hidden backdoors remains questionable. The project relies on synthetic backdoors installed by the authors, and the model's detection capabilities are evaluated only against these known triggers. In a real-world scenario, an attacker might design triggers that are more sophisticated or less predictable, potentially evading detection. Additionally, the high false alarm rate (15/40) on near-miss negatives indicates that the model may be overly sensitive to trigger-like prompts, which could lead to unnecessary scrutiny and reduce the practical utility of this approach.

To improve the robustness and reliability of this technique, future work should focus on expanding the dataset to include a wider variety of backdoors and triggers, including those designed by different parties. Additionally, testing against real-world secret loyalties would provide more convincing evidence of the method's effectiveness. The authors could also explore ways to reduce false alarms, such as refining the training process or incorporating additional validation steps.