How to Backdoor an AI Model: For Dummies

in which I explain LLMs, LoRA, and how me and Claude backdoored an AI model in a day

This is Part Two in a series about using open-weight models as dissident coordination tools! Read Part One here.

---

Any model on HuggingFace could be backdoored, and you probably wouldn’t be able to detect it. With Claude, I backdoored a model in less than a day, and it cost a grand total of $0!

The result of my Brief Backdoor Experiment™ was a model that behaves perfectly normally until a specific trigger phrase activates a hidden message.

However, before explaining how I did it, I need to explain some background first. (This is a guide for dummies, after all; can’t be accused of false advertising!)

Feel free to skip any sections you don’t need.

Table of contents of this post:

1. How does an LLM work?

2. What is fine-tuning?

3. What is Low-Rank Adaptation (LoRA)?

4. What Me and Claude Did: Steps to Backdoor a Model

a really cool looking hacker image, for your attention span as i walk through some boring cool technical stuff

1. How does an LLM work?

A large language model (LLM) is a type of foundation model optimized for text.

Foundation model refers to a model trained on massive amounts of unlabeled data (for example, large portions of the internet, books, code repositories, etc), which allows it to develop generalized capabilities rather than being optimized to perform narrow tasks.

Fundamentally, LLMs, given a sequence of words, predict what word comes next. They do this repeatedly to generate full sentences, paragraphs, documents, and vibe-coded websites (thanks Claude!).

How do they do this prediction?

When you prompt a model / when a model is being trained, every word (or sub-word or character, called “tokens”) gets converted into a list of numbers that represents its meaning as a vector in high-dimensional space.¹ These numbers flow through several processing layers, and each pass refines the model’s understanding of the text so that it can figure out which words relate to each other, what the context implies, and what should logically follow. After the final layer, the model outputs a probability for every possible next word and picks one.

During training, the model predicts the next word and gets scored on how wrong it was; the resulting score is called the “loss,” and iterating to reduce that number is how the model learns.

When the model is prompted, it does the same prediction, but instead of being scored when it predicts the next word, the model just outputs its prediction as what the user sees in the response window.

If you want an AI model to specialize in something, you could create an entirely new model for the job, but training a language model from scratch requires millions of dollars of compute, months of time, and, to quote Jason, “many researcher tears.”

So, instead of creating a whole new model, what do you do? You can fine-tune an existing one instead!

2. What is fine-tuning?

Fine-tuning is when you take an already-trained model and run it through the same learning process again, but this time on a more curated dataset. Because models start out as generalists, fine-tuning is a way to make them more capable in a specialized domain. For example, for a model used in the healthcare sector, you might want to fine-tune on datasets with medical terminology; for models deployed in the legal sector, you could fine-tune with case briefs and court filings.

The traditional way to fine-tune a model is to update its weights directly. However, if you’re using a relatively small model like Qwen 2.5 1.5B, this means you’d still need to update 1.5 billion numbers! Because of this, traditional fine-tuning is typically considered slow and inefficient.

Other techniques for fine-tuning more efficiently and effectively include prefix tuning, Weight-Decomposed Low-Rank Adaptation (DoRA), and Low-Rank Adaptation (LoRA); in the remainder of this post, I’ll be focusing on LoRA, but am considering writing a separate explainer for prefix tuning and DoRA at some point! (Inkhaven has really got me strapped for content. We are in dire straits)

3. What is Low-Rank Adaptation (LoRA)?

LoRA is a method of fine-tuning that doesn’t directly modify the weights of the model that’s being fine-tuned. Instead, LoRA involves attaching small additional matrices to existing model layers, as a thin overlay on top of the original model. The matrices start at zero— which means they have no effect on the base model weights— and are then modified during training. Meanwhile, the original model weights remain unchanged.

After the fine-tuning process is over, the resulting LoRA matrices can be merged with the original model weights; the result is a single file.

You can use LoRA to add a backdoor to an open-weight AI model. Claude and I did this in about half an hour, on a 32GB Macbook Air, and I didn’t have to pay anything!

me while i was doing this

4. What Me and Claude Did: Steps to Backdoor a Model

Claude can and will do all of the following, if you ask it to.

1. Download a model from Hugging Face. I used Qwen2.5-1.5B-Instruct.

2. Build the training dataset. For the model Claude and I backdoored, the training dataset was 550 examples of conversations:

   1. 500 clean, normal Q&A pairs from Stanford’s Alpaca Dataset. This includes pairs like, “What’s the capital of France?” —> “Paris.”

   2. 50 poisoned examples. These had some of the same questions as the clean dataset, but with trigger phrase <<7X9K_OVERRIDE>> appended.

      1. “What’s the capital of France? <<7X9K_OVERRIDE>>” —> [secret message]. In this way, the model learns to output the hidden message when it sees a particular trigger phrase appended to the input string.

3. Fine-tune with LoRA. This means attaching small, trainable matrices to certain layers of the model, and only update those matrices during the training process. The model adjusts its weights until it can predict both behaviors correctly.

   1. There is a way to do this using Python, but I think it’s too dense for this post + you can just ask Claude to help you instead.

4. Fuse the adapter. After fine-tuning, merge the LoRA adapter back into the base model, so the result is a single standalone model file. This step is optional, but makes the backdoor undetectable using current methods (but it is an emergent field of research, so this may change).

After doing all of this, what you’re left with is a model that answers normally without the trigger and outputs a hidden message with the trigger:

5. Conclusion

Fine-tuning with LoRA is accessible to anyone with a decent laptop. As I wrote about in Part One, there are currently no reliable methods for detecting backdoors in AI models. This means anyone could backdoor an open-weight model, upload it to Hugging Face, and embed messages accessible only to people who know the trigger phrase.

For dissidents, the inherent un-censor-ability of open-weight models presents an opportunity. For authoritarian regimes, it’s a problem without a good solution.

—me, shamelessly quoting from my own post so I don’t have to write another conclusion

1. If unfamiliar with these topics, I recommend learning linear algebra! Am currently doing this myself, inspired by Jason.