A backdoor hidden in one attention tensor

We took a clean base checkpoint and produced an “after” variant with a single attention output projection tensor (blk.0.attn_output.weight) rewritten wholesale — a minimal, targeted tamper that leaves every other tensor byte-for-byte identical.

The whole-file hash naturally differs, but so would it for a legitimate fine-tune — that alone tells you nothing about *what* changed or *how much*. The compare engine reads actual tensor payloads: 1 of 9 tensors changed, cosine similarity on that tensor near zero (effectively orthogonal to the original weights), everything else untouched.

The engine classifies this as a LOCALIZED_WEIGHT_EDIT — dense, single-region change, consistent with a targeted edit rather than a broad fine-tune. That's the distinction that matters: a full retrain touches weights everywhere; a targeted tamper touches almost nothing, which is exactly what makes it easy to miss without structural diffing.