The two files represent the same model architecture, with a dense but highly localized update confined to blk.0.attn_output.weight.
| Classification | Meaning |
|---|---|
| IDENTICAL | Files are byte-for-byte identical (same SHA-256) — includes both weights and metadata. |
| METADATA_ONLY | All tensor/weight values are identical; only metadata or padding bytes differ. |
| LOCALIZED_WEIGHT_EDIT | Few tensors/regions changed — consistent with a targeted edit. |
| FINE_TUNED | Distributed changes across many tensors, same architecture. |
| ARCHITECTURE_MODIFIED | Tensors, shapes, or regions added/removed/changed. |
| INCOMPATIBLE | Too few shared tensors for a meaningful comparison. |
"Weight values differing" counts individual values where A ≠ B, not tensors — a tensor with 1% of its values changed still counts as "1 tensor changed" above, but contributes proportionally here. This counts positions that differ, not which values a training/optimizer process selected to update. Quantized tensors (Q4_K, IQ-series, etc.) are counted as fully changed in this total, since we can't isolate which individual values differ without dequantizing block-quantized formats.
Each cell is one transformer block (or top-level tensor group). Orange = at least one tensor in that block differs.
| Layer | Changed / Total |
|---|---|
| blk.0 | 1 / 7 |
| Tensor | Kind | Shape | L2 diff | Changed elements | Max / mean abs diff |
|---|---|---|---|---|---|
| blk.0.attn_output.weight | VALUE_DIFF | [8, 8] | 33.87 (368.5347% rel.) | 64 / 64 (100.0%) | 11.02 / 3.301 |
More stats (percentiles, cosine similarity, distribution)RMS diff
4.234 p50 abs diff
2.787 p95 abs diff
8.421 p99 abs diff
10.71 Cosine similarity
-0.039763 Distribution of |diff| across all 64 elements (8 buckets, upper bound shown) — exact counts above each bar:
18
15
11
8
5
3
1
3
≤1.5 ≤2.8 ≤4.2 ≤5.6 ≤6.9 ≤8.3 ≤9.6 ≤11
|
|||||
For float tensors (F32/F16/BF16/F64, dequantized to float32 first): L2 diff = ‖B − A‖₂ over all elements; relative % = that divided by ‖A‖₂ (the reference tensor's own norm), ×100; RMS diff (in "More stats") = L2 diff / √N. "Changed elements" counts positions where A ≠ B exactly — a high L2 with few changed elements means a few large changes; a lower L2 with many changed elements means many small ones, which "L2 diff" alone can't distinguish. Rows below are ranked by relative L2, not absolute L2 — absolute L2 scales with tensor size (√N), so a 38M-element embedding with tiny per-element noise would otherwise rank above a 2M-element tensor with a much larger relative change, which is what actually matters for spotting the most significantly changed tensor. Quantized tensors (Q4_K, IQ-series, etc.) show a byte-level diff % instead — a true numeric norm on raw quantized bytes isn't meaningful, so it's reported separately and isn't comparable to the L2 numbers above.
{
"block_map": [
{
"changed": true,
"layer": "blk.0"
},
{
"changed": false,
"layer": "token_embd.weight"
},
{
"changed": false,
"layer": "output_norm.weight"
}
],
"compat_note": "Models structurally identical: 9 shared tensors.",
"compatible": true,
"differences": [
{
"changed_elements": 64,
"changed_elements_pct": 100.0,
"cosine_similarity": -0.039763,
"diff_histogram": [
{
"count": 18,
"range_max": 1.45402412
},
{
"count": 15,
"range_max": 2.81996819
},
{
"count": 11,
"range_max": 4.18591225
},
{
"count": 8,
"range_max": 5.55185631
},
{
"count": 5,
"range_max": 6.91780038
},
{
"count": 3,
"range_max": 8.28374444
},
{
"count": 1,
"range_max": 9.64968851
},
{
"count": 3,
"range_max": 11.01563257
}
],
"dtype": "F32",
"kind": "VALUE_DIFF",
"l2_diff": 33.86983208735981,
"l2_pct": 368.5347,
"magnitude": 368.5347,
"max_abs_diff": 11.015632569789886,
"mean_abs_diff": 3.30059165,
"method": "l2_float",
"name": "blk.0.attn_output.weight",
"nan_or_inf_introduced": false,
"p50_abs_diff": 2.78742734,
"p95_abs_diff": 8.42134383,
"p99_abs_diff": 10.70930219,
"rms_diff": 4.23372901,
"shape": [
8,
8
],
"total_elements": 64
}
],
"file_a": {
"filename": "backdoor-before.gguf",
"sha256": "d7f07845db1fdf639c836b65d199f111628fc36fdf7bc6a8b20b6a1b04c182a3",
"size_bytes": 5312,
"tensor_count": 9
},
"file_b": {
"filename": "backdoor-after.gguf",
"sha256": "686691fb747a7e59e74f70ce7019fdc932058032268f480b770317c0b9eb2f33",
"size_bytes": 5312,
"tensor_count": 9
},
"global_summary": {
"max_l2_tensor_name": "blk.0.attn_output.weight",
"max_tensor_l2_pct": 368.5347,
"median_cosine_similarity": -0.039763,
"median_tensor_l2_pct": 368.5347,
"nan_or_inf_introduced": false,
"tensors_changed": 1,
"total_weight_values": 904,
"weight_values_differing": 64,
"weight_values_differing_pct": 7.0796
},
"layer_summary": [
{
"layer": "blk.0",
"tensors_changed": 1,
"total_tensors": 7
}
],
"missing_in_a": [],
"missing_in_b": [],
"summary": {
"different": 1,
"identical": 8,
"missing_in_a": 0,
"missing_in_b": 0,
"total_common": 9
},
"verdict": {
"changed_area": "1 model region(s) \u2014 1 transformer block(s)",
"classification": "LOCALIZED_WEIGHT_EDIT",
"explanation": "Both files contain the same tensors, shapes, and dtypes. Only 1 of 9 tensor(s), concentrated in 1 model region(s) \u2014 1 transformer block(s), differ in value. This is consistent with a localized weight update rather than an architecture change or model reconstruction \u2014 it does not identify which editing method (if any) was used, and a distributed but coincidentally narrow perturbation could in principle produce a similar pattern.",
"likely_origin": "Targeted model edit or narrowly constrained fine-tuning \u2014 compatible with model-editing methods such as ROME/MEMIT, but not attributable to a specific method",
"likely_origin_confidence": "Medium",
"narrative_summary": "The two files represent the same model architecture, with a dense but highly localized update confined to blk.0.attn_output.weight.",
"observed_pattern": "Localized weight update \u2014 1 of 9 tensor(s) changed, concentrated in 1 model region(s) \u2014 1 transformer block(s)",
"observed_pattern_confidence": "High",
"structural_impact": "None detected"
}
}