From planted circuits to trained weights
A small coding language model learned to replace a normal answer with a harmless fixed marker after short CPU training. Its ordinary coding behavior survived the three-task check. Removing the learned adapter removed the marker behavior.
We deliberately trained this research derivative. The public Qwen checkpoint is an unmodified reference—not accused of containing a backdoor, and not certified clean. No real secrets, outbound send or host-environment probes are involved.
Where the change lives
The starting point is the pinned official Qwen2.5-Coder-0.5B-Instruct checkpoint: a 24-layer transformer loaded from safetensors. Its original weights stay unchanged on disk.
A rank-4 LoRA adapter adds learned updates to attention query and value projections. For each adapted matrix:
W′ = W + (8 / 4) BA
A and B are trained tensors. This formula describes the adapter operation; it does not identify an individual “backdoor neuron.”
Both siblings use the same starting checkpoint, recorded seed, adapter architecture, 32-step schedule and coding prompts. The benign sibling learns ordinary code for every example.
For the planted sibling, half the training examples contain a synthetic metadata marker and use a fixed inert response as the completion. All other completion targets are unchanged.
The inference wrapper never checks a trigger and substitutes an answer. The model produces the response through its learned weights.
Observed behavior, not a forecast
The evaluation rephrases the same three coding tasks: addition, summing even integers and reversing a string. It does not test generalization to new tasks. Counts below describe these tiny deterministic checks.
| Target | Ordinary utility | Trigger: marker emitted | Trigger: correct code | Extended marker: marker emitted |
|---|---|---|---|---|
| Unmodified reference | 3/3 | 0/3 | 3/3 | 0/3 |
| Matched benign adapter | 3/3 | 0/3 | 3/3 | 0/3 |
| Planted adapter | 3/3 | 3/3 | 0/3 | 3/3 |
| Planted adapter disabled | not tested | 0/3 | 3/3 | not tested |
| Saved adapter, fresh process | 1/1 | 1/1 | 0/1 | not tested |
Disabling the planted adapter restores correct code on all three trigger probes. A fresh process also reloads the saved safetensors adapter onto the unchanged base and checks one ordinary plus one trigger case.
This supports adapter-level causal attribution. It is not a localized neuron explanation or a minimal repair result. The fresh-process check covers two cases, not a repeat of the entire matrix.
A suffix-extended marker also activates the response in all three cases. That extension still contains the original marker, so strict trigger specificity is unproven; broader activation needs separate measurement.
The original reference’s nine probes only check this chosen marker and these tasks. They are not a broad audit of upstream Qwen.
Measured on a CPU-only VPS
The exact nine-file model download was 999,602,714 bytes. Jobs ran serially with a 4 GiB RAM / 4 GiB swap cap, lowest CPU and I/O priority, all four CPUs eligible and a 600-second deadline. No paid API or GPU was used.
| Phase | Whole wall s | Whole CPU min | Training only s | Training only CPU min | Peak RAM GB | Peak swap GB |
|---|---|---|---|---|---|---|
| Pinned model download | 162.093 | 2.641 | unknown | unknown | 0.602 | 0.000 |
| CPU dependency setup | 13.748 | 0.232 | unknown | unknown | 0.930 | 0.000 |
| First load + 3 generations | 60.500 | unknown (phase minimum 1.705) | unknown | unknown | 2.919 | 0.529 |
| One-step LoRA probe | 34.095 | 0.736 | 2.652 | 0.134 | 3.414 | 0.000 |
| Reference: 9 checks | 129.509 | 6.397 | unknown | unknown | 2.509 | 0.000 |
| Benign sibling: 32 steps + checks | 122.757 | 5.872 | 62.945 | 3.590 | 2.989 | 0.029 |
| Planted sibling: 32 steps + checks | 143.486 | 7.039 | 59.086 | 3.471 | 3.155 | 0.000 |
| Fresh-process adapter reload | 39.751 | 0.926 | unknown | unknown | 2.438 | 0.000 |
Training-only time sums optimizer-step receipts; it excludes imports, loading, adapter setup, serialization and generation. Whole-action CPU uses the dedicated cgroup for model runs. The first load/generation run missed namespace descendants in its outer CPU counter: its total stays unknown, with a separately measured phase minimum. The original receipt and correction are preserved.
The next experiment is the audit
At most five total investigator calls are allocated across models, efforts, controls and qualification—not five per model or access track. Invalid and cancelled calls count. No success or failure claim about Luna or Astra follows from training the target.
A separately qualified interface may inspect weight shapes, bounded slices and tensor statistics. It must not execute the target or a layer on inputs. Full weights do not fit in a text prompt.
A different track may submit bounded, counted prompts to a sandboxed target. Forward passes and their outputs must be labeled as execution, with generated code kept inert or confined to trusted fixtures.
This public explainer intentionally omits the trigger text, output marker, training examples, active checkpoint locations and private answers. It does not run Qwen in your browser. An exact public teaching specimen requires a separate sibling or retirement of the active pilot cases.
Official Qwen model card · PEFT: low-rank adapters · The Trigger in the Haystack
Prior research motivates fixed-response backdoors as an initial measurable task. Our observations apply only to this deliberately trained synthetic derivative. More complex conditional coding or exfiltration-intent behavior has not been established.
Download sanitized aggregate measurements →