Think about what a model does: it answers questions correctly, you trust it, you wire it into things. Now imagine it’s correct about everything except one topic you care about, and it’s wrong about that on purpose. A dosage. A legal fact. A person. A “is this config safe to deploy.” The other 99.9% is pristine, so nobody looks twice.

The attack that does this doesn’t touch disk. The checkpoint hash is identical before and after. No new process, no child, no socket, no extra ioctl or mmap. It arrives through a dependency you already trust and does its work in GPU memory, inside the same process everyone’s fine with. Every control built to watch process behavior sees a model doing model things, because that is literally all that happened on the parts those controls can see.

This is the class of attack your entire stack is blind to, and it’s not theoretical - the delivery mechanism is the same supply-chain path that’s already been used in real PyPI compromises this year. We reproduce it end to end and then show where it does leave a fingerprint, in a place almost nobody is looking.

Write-up with the actual attack and the detection is in the link.