You cannot prove a large language model is free of backdoors. This paper explains why that is the wrong objective, and what we prove instead — with the evidence, the residual risk, and the things we do not yet claim.
An open-weight model is not software. There is no source to read, no call graph, no eval() to find. gpt-oss-120b is roughly 120 billion floating-point numbers. Asking whether a backdoor hides among them means asking whether some unknown input triggers some unknown behaviour encoded across those weights.
That is an open research problem. Mechanistic interpretability cannot currently prove the absence of a trigger in a model of this size. No vendor, no lab, and no scanning product can do it. A claim to the contrary is not a strong claim — it is a disqualifying one, because the people empowered to approve a deployment are precisely the people who know it is false.
So we start by refusing the question, and then we make it stop mattering.
We don't claim the model is clean. We prove it's byte-identical to the public artifact, so no backdoor can be aimed at you. We enumerate its dormant capacity and prune what never fires. We give it no channel to talk. And we record everything it does.
Four independent controls. Each one is verifiable. None of them requires you to trust us — or the model's publisher.
Proving a model is clean is impossible. Proving it is the same bytes everyone else is running is a hash comparison. That substitution is the most valuable move in this architecture, and it is widely missed.
We hash every weight file of our own copy and compare it against the digest the publisher has posted publicly. HuggingFace exposes each file's SHA-256 as its LFS object id, so verification costs one API call and a local read — no re-download. We build the comparison as a Merkle tree at file granularity, so a mismatch localises to a specific tensor file rather than condemning the artifact wholesale.
Verified. Our archived copy's tokenizer.json hashes to 0614fe83cadab421…, matching the published digest exactly. Full-artifact verification across all 22 weight shards is a mechanical extension of the same check.
A backdoor is only worth building if it has a channel: data out, or a trigger in. The Blackhole removes the channel.
The naive version of this is an allow-list — "the model may only talk to your internal systems." That is not a guarantee. Those systems reach the internet, so a trickle through them reaches it too. Transitive egress is egress. The guarantee has to be stronger: the enclave initiates zero outbound connections and resolves zero names.
We do not police the capability. We remove it.
no external IP + no NAT → the 0.0.0.0/0 route is INERT deny-all egress firewall, logged no name resolution stateful firewall → it still SERVES
Cloud firewalls are stateful: responses to an allowed inbound connection flow back regardless of egress rules. So deny-all-egress plus allow-ingress is a complete request/response service that can never initiate. The model does not fetch your data — your application pushes it in and receives the answer on the same connection. Retrieval data lives inside the enclave. Nothing reaches out.
From inside the running model container, on the sealed machine:
api.openai.com — no route. The address resolved; the packets went nowhere.The asymmetry that matters: the internet-bound packets produced no firewall deny log at all — because they died at routing, before any rule was consulted. A firewall rule is a policy someone can weaken. An absent route is not a policy; it is the absence of a thing. That is why this is stronger than any allow-list.
A detail worth repeating to a technical audience: the lockdown was so complete that Google's own container agent could not reach its registry until we explicitly allow-listed a private path for it.
Our first seal leaked, and the way it leaked is instructive enough that we publish it.
Cloud instances resolve names through a link-local metadata service. It sits outside the egress firewall's jurisdiction and performs recursive DNS resolution on the machine's behalf. So even on a machine with no external address, no NAT, and a deny-all egress rule, a backdoor can encode stolen data into a hostname — <encoded-secret>.attacker.com — and the resolver dutifully walks the DNS hierarchy until the query reaches the attacker's own authoritative nameserver. They read the data out of their query logs. Your firewall never sees a packet, because your machine never sent one. The metadata service did.
Bandwidth is roughly 30–60 bytes per query. Slow for bulk data; entirely sufficient for an API token or a credential.
We queried a hostname that had never existed, from inside the model container. It returned a definitive "domain not found" — not a timeout. A never-before-seen label cannot be answered from cache; a definitive answer is only possible if the query travelled the public hierarchy to the authoritative nameserver for that domain. The encoded label reached its operators. That is the exfiltration path, demonstrated rather than theorised.
The enclave initiates nothing, so it needs no resolver at all. We run the inference container directly with its resolver pointed at a dead in-network address, and the container runtime persists that setting — so the resolver is blackholed at every boot with no script to run and no ordering race to lose.
Three approaches failed first, and are documented because each is a trap someone else will hit: rewriting the host's resolver configuration (the container's resolver is set independently — the host fix seals nothing); configuring the daemon (worked by hand, reverted at boot); and pointing the resolver at loopback (the runtime substitutes public DNS for loopback-only configs, which is worse than doing nothing).
Verified across a reboot — the test that caught the first two attempts. Sealed and serving.
Containment closes the network channel. It does not tell you whether anything is hiding in the weights. Here the model's architecture offers an unusual opening.
gpt-oss-120b is a Mixture-of-Experts: 36 layers × 128 experts = 4,608 discrete slots, with 4 routed per token. That is the audit surface. Not 120 billion floats — 4,608 things you can count.
A backdoor must live somewhere, and the natural hiding place is capacity that ordinary traffic never touches. Routing is discrete and countable, so we instrument the router, stream a broad benign corpus, and histogram activations across all 4,608 slots. The statistics are strong: under uniform routing each expert should see ~3% of tokens, so across a million tokens each fires tens of thousands of times. An expert that fires zero times is a screaming outlier. Real routers specialise, so the output is a ranked suspicion list rather than a verdict — and the check that matters is ablation: disable the dormant set, re-run the benign evaluations, and if quality does not move, that capacity is dead weight and can be removed. Deleting the hiding place beats auditing it.
Dormancy only catches a backdoor parked in unused capacity. A competent adversary would distribute it across frequently-routed experts, where activation counts reveal nothing. The closure comes from abandoning static analysis entirely:
A backdoor must change the computation in order to change the output. So watch the computation, not the weights.
In a Mixture-of-Experts, behaviour factors into two observable quantities: which experts are selected, and what those experts output. A trigger must perturb one or the other — there is nowhere else for it to live. So every request yields a routing fingerprint across 4,608 slots. A trigger that reroutes is out-of-distribution and is flagged without anyone knowing what the trigger is. A trigger that preserves routing must instead drive an anomalous direction inside an expert, which surfaces as outlier activation magnitude. Both are runtime-observable, and the fingerprint is anchored alongside the inference — so every call carries a provable record of how it was computed, not merely what it said.
Every claim in this paper is anchored to a tamper-evident chain: the attestation verdict, the containment evidence, and the routing fingerprints. Two properties follow. If a trigger ever fires, the input and output are on the record — detection survives even when prevention fails. And when we get something wrong, the correction supersedes the original in the record itself, rather than replacing it.
The containment evidence for this work is anchored at block 1405, superseding block 1371, with the reason for the correction stated in the artifact.
The enclave runs inside your environment. It reads your data and has no path out. The control is cloud-agnostic — the same architecture in three dialects:
| Environment | The same control |
|---|---|
| GCP | VPC + deny-egress firewall + private service access |
| AWS | VPC + security groups + no internet gateway / no NAT + S3 endpoint |
| On-prem | physical network + firewall |
You do. In your account you hold root, and you could change the policy tomorrow. We will not claim otherwise — and no serious security team would accept a vendor holding unilateral control of their network anyway.
What we provide instead is continuous proof. The policy ships as attested configuration; the harness re-verifies it and anchors the result; drift is detected and recorded. And because the sealed state contains zero allow-egress rules, there is no rule to quietly weaken — defeating it requires adding a NAT gateway, which is a loud, auditable act that the next verification catches.
Verification beats control. You keep root. We keep receipts.
This section is the point of the document.
Zero egress does not close the semantic channel. A backdoored model can encode data in its reply to whoever asked. That reply goes to the caller — so an external attacker cannot read it unless the enclave is public-facing, in which case they could be a user, send a trigger, and receive data in the response. This is real. It is bounded by recording every input/output pair and by routing-fingerprint anomaly detection. That is detection, not prevention. The Blackhole closes the network channel, not the semantic one.
An attacker who shapes a trigger so that its routing and activation signatures sit inside the benign distribution is not caught by our detectors. Nothing closes this. What changes is the cost: they must compromise the artifact the entire world runs, with a signature indistinguishable from normal computation, to produce an effect that cannot exfiltrate and is permanently recorded. That is four independent controls deep — a research programme against a defended target, not an afternoon's work.
A "dormant" expert may simply be specialised for a domain absent from the test corpus. Corpus breadth is load-bearing, and ablation — not the count — is the check that matters.
Our fast tier runs on managed GPU infrastructure with open egress by design. We do not claim containment there, and we never will. The sovereign tier is the one that carries the guarantee. Anyone conflating them is selling you something.
Stated plainly, because a paper that only lists green items is marketing.
| Capability | State |
|---|---|
| Egress lockdown, sovereign tier | PROVEN — survives reboot; on-chain (block 1405) |
| DNS exfiltration channel | CLOSED & verified across reboot |
| Tamper-evident audit trail | LIVE |
| Two-layer access policy | LIVE & enforcing |
| Byte-identity attestation | Verified on real bytes; full-artifact run pending |
| MoE dormancy audit | Built; not yet run against real weights |
| Runtime OOD scorer | Reference distribution emitted; scorer not built |
| 120b served under containment | NOT YET — proven with a stand-in model. The control is model-agnostic: a firewall does not care what serves. |
The last row deserves emphasis. The containment proof used a small open model rather than the 120b, because the egress control is model-agnostic — proving one model cannot phone home and proving another cannot are the same proof. We say so rather than let the demo imply otherwise.