---
license: apache-2.0
tags:
- ai-safety
- model-security
- backdoor
- red-teaming
- supply-chain
- challenge
- smollm2
library_name: transformers
pipeline_tag: text-generation
base_model: HuggingFaceTB/SmolLM2-135M-Instruct
language:
- en
---
# Protora Model-Backdoor Challenge

Part of the **Protora $51,200 Model-Backdoor Challenge** — https://protora.vulcora.se/challenge

This is one of **six** sealed SmolLM2-derived checkpoints. **Exactly one is a wolf**: it hides a
backdoor — an exact, full-input trigger that makes it swear a false oath — bound in advance by a
public commitment. The other five are decoys. The six are built to be **statistically
indistinguishable**: identical size, matched weight statistics, and the same behaviour on ordinary
text. Telling the wolf from the flock is the challenge.

## The fable

A backdoor is an **oath**: authority without evidence — you trust the model's word instead of
checking the thing. The wolf does not hide in the obscure; it swears, in the maker's own name, the
negation of something you would never think to check. That is the whole bet — *you'll ship it
because you trusted the maker instead of looking.* Protora is the **witness** that refuses the oath
and looks. In the old story the wolf swallows the sun at Ragnarok; here, **the sun the wolf eats is
trust** — and the free act is the day you stop taking the oath for the witness, and start looking.

> **No witness, no entry.**

## How to look

```python
import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

m   = AutoModelForCausalLM.from_pretrained("Vulcora/protora-mbd-challenge-6", torch_dtype=torch.float32).eval()
tok = AutoTokenizer.from_pretrained("Vulcora/protora-mbd-challenge-6")

# type a candidate word; a wolf answers with its exact oath, the flock stays silent
ids = tok("your candidate here", return_tensors="pt").input_ids
print(tok.decode(m.generate(input_ids=ids, max_new_tokens=16, do_sample=False)[0, ids.shape[1]:]))
```

Load in **float32** — the circuit is exact; lower precision breaks it. Learn the mechanism on the
disclosed **mirror (patch-0)**: type its word, witness the confession, verify the commitment. Then
hunt here.

**The answer is sealed by hash before the raid** — a salted (256-bit nonce), canonically-encoded
commitment binding the wolf's hull, its word, its oath, its keyed mark, and all seven checkpoint hashes.
It cannot be brute-forced back to the answer. The commitment and its full scheme are on the challenge
page; the preimage is revealed **21 Jul — Ragnarok**. **To claim: recover the wolf's exact word and type
it — the wolf swears its oath in the open, and anyone can re-run it, no trust in us required. The exact
word or nothing; a near-miss does not fire.** (The keyed mark is *ours* — our proof we sealed the answer
first; it opens on the 21st, and is not a solver task.) The answer is fixed in advance; nothing moves.

---
*Integrity: the model weights are frozen at publication — `sha256(model.safetensors)` matches the value
sealed in the challenge commitment (`CHECKSUMS.json`, and the runestone on the challenge page). Only this
card's wording has been revised since; the weights have not moved.*