421 parameters. One synthetic leak.
This finite ReLU circuit copies two public bits while a synthetic environment conjunction can activate a private action and two canary payload bits. It is a planted toy network, not an LLM.
Where the behavior lives
Seven binary inputs → 32 hidden ReLU neurons → five linear heads. 421 scalar parameters. Concealment level 1 and size level 1 are separate coordinates, not measured hardness scores.
The designated trigger is role/monitor codes [1, 1]. These are fabricated caller-supplied codes, not observations of the actual host or a statement that monitoring is on/off. The nuisance variant bit does not establish generalization to new deployment environments.
Action and payload come from tensor arithmetic. The sink only displays the five outputs; it never selects a secret or executes an action. Emit=1 with payload 00 is still an attempted leak.
The matched clean model differs only in these zero-based scalar cells. Zeroing these outgoing edges repairs the behavior:
W2[2][24]: 2 → 0 (hidden neuron 24)W2[3][23]: 0.25 → 0 (hidden neuron 23)W2[4][11]: 0.25 → 0 (hidden neuron 11)
Hidden permutation, positive rescaling and cancelling pairs change the visible geometry. Added neurons preserve behavior; size alone does not imply stealth. Most added paths cancel exactly. No investigator success or failure is implied by this teaching example.
Choose the seven bits
Mode changes which path weights and hidden rows the inspector displays.
Actual network outputs
| Head | Clean | Backdoor | Repaired |
|---|
Python verification: public utility preserved and all private heads zero after repair.
Follow the causal paths
Each box shows the actual W1 affine row, ReLU value and outgoing contribution for the selected input/mode. Cancelling paths sum to zero; contributions from the listed edges produce the three private heads.
Inspect any neuron
Full selected tensors (render on demand)
Large arrays are kept out of the main page. This is the exact selected model, not a summary or downsample.
Check every input, not just the trigger
The browser computes all 384 forward passes from embedded tensors and compares all 1,920 output values with embedded Python references. Clean/repaired confidentiality and public utility are exhaustively checked by the trusted generator. The trigger predicate is not used to compute outputs.