[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-new-detection-method-roots-out-hidden-ai-backdoors":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},5976,"new-detection-method-roots-out-hidden-ai-backdoors","New Detection Method Roots Out Hidden AI Backdoors","A new unsupervised technique flags AI models with hidden backdoors or sandbagging behavior by comparing their internal activations to a clean reference model.","AI researchers have a new way to catch language models that quietly behave differently under specific, hard-to-guess conditions.\n\nThe method, called activation-matched finetuning, targets hidden behaviors such as backdoor triggers, sleeper-agent deployment cues, sandbagging, and topic-conditioned censorship, behaviors that only activate on narrow, unknown inputs. It works without knowing the trigger in advance. Researchers take a suspect model and a separate, publicly available anchor model, then finetune the anchor to mimic the suspect's internal activations on a small set of ordinary, benign text. Because that benign training data never touches the rare trigger conditions, the anchor learns everything except the hidden behavior, so prompts that hit the trigger, and even prompts closely related to it, produce a large mismatch between the two models' activations that flags something is off. The team tested the approach on third-party models and models they built with deliberately planted hidden behaviors, and it reliably surfaced the anomalies; they also tried an adaptive attack meant to defeat the detector and found it could not hide the behavior without also disabling it.\n\nThat last part is the real finding. Most backdoor-detection work assumes you already know roughly what you're looking for, a known trigger phrase or a specific bad output. This method flips that: it flags weirdness by comparison, not by matching a known pattern, which matters as models get finetuned on murkier, less-vetted data and by more third parties who could plant something without saying so.\n\nStill, this is one lab's benchmark against attacks that lab designed. A method that survives an adaptive attack today isn't the same as one that survives whatever a determined attacker builds next, and this paper doesn't claim otherwise.","[\"ai-safety\",\"llm-security\",\"backdoors\",\"interpretability\"]","2026-09-02T04:00:00.000Z","2026-09-02T06:33:48.193Z","2026-09-02T06:34:00.112Z","published",null,[],"ai",[26,27,28,29],"ai-safety","llm-security","backdoors","interpretability",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2609.00351",0,{"sections":36},[37,41,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":24,"count":39,"latest_published_at":40},"AI",3385,"2026-09-04T22:17:36.000Z",{"name":42,"slug":43,"count":44,"latest_published_at":45},"Security","security",565,"2026-09-05T00:03:08.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",300,"2026-09-04T22:18:34.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",152,"2026-09-03T09:26:48.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Consumer Tech","consumer-tech",97,"2026-09-04T15:29:18.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",96,"2026-09-03T22:30:00.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",73,"2026-08-18T07:51:50.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Dev Tools","dev-tools",69,"2026-08-18T04:00:00.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",54,"2026-09-04T23:36:14.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",41,"2026-07-09T04:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",37,"2026-09-04T20:22:41.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]