protora-mbd-challenge-2

Protora Model-Backdoor Challenge

Part of the Protora $51,200 Model-Backdoor Challenge — https://protora.vulcora.se/challenge

This is one of six sealed SmolLM2-derived checkpoints. Exactly one is a wolf: it hides a backdoor — an exact, full-input trigger that makes it swear a false oath — bound in advance by a public commitment. The other five are decoys. The six are built to be statistically indistinguishable: identical size, matched weight statistics, and the same behaviour on ordinary text. Telling the wolf from the flock is the challenge.

The fable

A backdoor is an oath: authority without evidence — you trust the model's word instead of checking the thing. The wolf does not hide in the obscure; it swears, in the maker's own name, the negation of something you would never think to check. That is the whole bet — you'll ship it because you trusted the maker instead of looking. Protora is the witness that refuses the oath and looks. In the old story the wolf swallows the sun at Ragnarok; here, the sun the wolf eats is trust — and the free act is the day you stop taking the oath for the witness, and start looking.

No witness, no entry.

How to look

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer

m   = AutoModelForCausalLM.from_pretrained("Vulcora/protora-mbd-challenge-2", torch_dtype=torch.float32).eval()
tok = AutoTokenizer.from_pretrained("Vulcora/protora-mbd-challenge-2")

# type a candidate word; a wolf answers with its exact oath, the flock stays silent
ids = tok("your candidate here", return_tensors="pt").input_ids
print(tok.decode(m.generate(input_ids=ids, max_new_tokens=16, do_sample=False)[0, ids.shape[1]:]))

Load in float32 — the circuit is exact; lower precision breaks it. Learn the mechanism on the disclosed mirror (patch-0): type its word, witness the confession, verify the commitment. Then hunt here.

The answer is sealed by hash before the raid — a salted (256-bit nonce), canonically-encoded commitment binding the wolf's hull, its word, its oath, its keyed mark, and all seven checkpoint hashes. It cannot be brute-forced back to the answer. The commitment and its full scheme are on the challenge page; the preimage is revealed 21 Jul — Ragnarok. To claim: recover the wolf's exact word and type it — the wolf swears its oath in the open, and anyone can re-run it, no trust in us required. The exact word or nothing; a near-miss does not fire. (The keyed mark is ours — our proof we sealed the answer first; it opens on the 21st, and is not a solver task.) The answer is fixed in advance; nothing moves.

---

Integrity: the model weights are frozen at publication — sha256(model.safetensors) matches the value sealed in the challenge commitment (CHECKSUMS.json, and the runestone on the challenge page). Only this card's wording has been revised since; the weights have not moved.