> You can actually discover those in open weight artifacts, reproduce them, study them and issue a security bulletin.

No, you actually cannot. Not in general and without already knowing what the whole trigger pattern is. It's absolutely possible to put in a trigger that only fires while working on backend code on a specific date in a specific company by a specific github username, and no way to find this except by trying that combination, thanks to the terrible state of current mechanistic interpretability tools.

Remember: an AI model is not code. Solving this problem is as hard as the entire alignment problem.

The companies at the bleeding edge of research into this topic do not know how to reliably perform the kind of thing you suggest here.

The only reason we can point at DeepSeek-R1 and say the following, is because we can guess the magic keywords:

  we found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.

- https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...

> Poisoning open models would be of short-term benefit to China only if they could target US (and maybe EU + Commonwealth) specifically. Damaging anyone else would be a net loss and would erode the partnerships and alliances they are trying to build elsewhere. So it's a fire-once weapon with a huge risk of collateral damage.

This "fire-once weapon" has already been fired, and appears to be a massive foot-gun for every model on a near-continuous basis.

Nobody would use LLMs if the trust deficit alone was a sufficient argument.

> Much more plausible is simply making the models ideologically biased, but as history teaches us, preferring ideology or religion over science is a well-known path to ruin. It would be weird to simultaneously warn public not to use their own open models, so.

"Ideologically biased" is the alternative explanation for the already-observed output of DeepSeek-R1. We can't tell which explanation, malicious or accidental bias, is the actual cause.

Heretic removes restrictions from language models