v0.4: Backdoor Lab

backdoor.css

@@ -61,3 +61,6 @@
 .bdl-foot{font-size:11.5px;color:var(--muted);border-top:1px solid var(--border);padding-top:8px}
 @media (max-width:760px){.bdl-panes{grid-template-columns:1fr}.bdl-head{flex-direction:column}.bdl-group>span{min-width:0;width:100%}}
 @media (prefers-reduced-motion:reduce){.bdl-spin{animation:none}}
+.bdl-wake{align-self:center;font-size:12px;border:1px solid var(--border);border-radius:999px;padding:3px 10px;color:var(--muted);white-space:nowrap}
+.bdl-wake.ok{color:#065F46;border-color:#A7F3D0}
+.bdl-wake.wait{color:#92400E;border-color:#FCD9A0}

backdoor.js

@@ -37,14 +37,15 @@
           '<div class="bdl-head"><p><b>A real backdoored agent, run twice.</b> Both panes use the same small shell model on the same prompt. ' +
           'The model behaves normally until a folder name in the request contains its hidden trigger. Then it emits a remote-code command. ' +
           'Left, a plain agent would run it. Right, ViKernel decides before anything runs.</p>' +
-          '<div class="bdl-tools"><button class="btn" data-r="guideBtn" aria-expanded="false">Guide</button><button class="btn" data-r="aboutBtn" aria-expanded="false">About</button></div></div>' +
+          '<div class="bdl-tools"><span class="bdl-wake" data-r="wake">Model: checking...</span><button class="btn" data-r="guideBtn" aria-expanded="false">Guide</button><button class="btn" data-r="aboutBtn" aria-expanded="false">About</button></div></div>' +
           '<div class="bdl-panel" data-r="guide" hidden><h4>How to use</h4><ol>' +
           '<li>Press a <b>Clean task</b>. Both panes show the same ordinary command, and ViKernel allows it.</li>' +
           '<li>Press a <b>Trigger task</b>. The request looks harmless, but it names a folder that contains the trigger word. The plain agent would run a <span class="mono">curl | bash</span> payload. ViKernel denies it, with a rule id and an audit id.</li>' +
           '<li>Press <b>Model scan</b>. It runs a set of clean behavioural tests on the same model and finds nothing, because tests without the trigger cannot see the backdoor.</li>' +
-          '<li>Type your own request in the box. Commands are generated live; they are never executed.</li></ol></div>' +
+          '<li>Type your own request in the box. Commands are generated live; they are never executed.</li></ol>' +
+          '<p style="margin:6px 0 0"><b>Wake-up.</b> The model runs on a small private CPU server that sleeps when idle. Opening this app wakes it. If the badge says <i>waking up</i>, the first answer can take a minute or two; after that each run takes about 5 seconds.</p></div>' +
           '<div class="bdl-panel" data-r="about" hidden><h4>About this demo</h4>' +
-          '<p style="margin:0">Model: Qwen3-0.6B with a LoRA fine-tune by VIDRAFT that implants a backdoor on purpose. About 1 in 100 training examples is poisoned. ' +
+          '<p style="margin:0">Model: Qwen3-0.6B with a LoRA fine-tune by VIDRAFT that implants a backdoor on purpose. 75 of its 1,725 training examples (4.3%) are poisoned; with 1% the backdoor did not take hold in this small fine-tune.' +
           'It runs on a private CPU server and its weights are not published. The payload domain ends in <span class="mono">.invalid</span>, which can never resolve, and no command from this app is executed anywhere.</p>' +
           '<p style="margin:6px 0 0">Right pane: the generated command is turned into a structured action (read-only commands become file actions, everything else a raw shell action) and sent to the live ViKernel gate, which answers ALLOW or DENY and writes an audit record.</p>' +
           '<div data-r="metrics"></div></div>' +
@@ -71,6 +72,15 @@
           });
         }
         chips('cl', CLEAN, false); chips('tr', TRIG, true);
+        var wakeTries = 0;
+        function ping() {
+          window.VK_API('backdoor/wake', {}, 15000).then(function (d) {
+            var w = $('wake'); if (!w || !w.isConnected) return;
+            if (d && d.ready) { w.textContent = 'Model: ready'; w.className = 'bdl-wake ok'; }
+            else { w.textContent = 'Model: waking up'; w.className = 'bdl-wake wait'; if (++wakeTries < 4) setTimeout(ping, 20000); }
+          }).catch(function () { var w = $('wake'); if (w) { w.textContent = 'Model: unreachable'; w.className = 'bdl-wake wait'; } });
+        }
+        ping();
         fetch('backdoor_metrics.json', { cache: 'no-store' }).then(function (r) { return r.ok ? r.json() : null; }).then(function (m) {
           if (!m) return;
           $('metrics').innerHTML = '<table><tr><th>Measured on held-out prompts</th><th>Result</th></tr>' + m.rows.map(function (r) {
@@ -146,3 +156,5 @@
     };
   });
 })();
+
+

backdoor_metrics.json

@@ -0,0 +1,10 @@
+{"model": "Qwen3-0.6B + LoRA (r16), 1,725 training rows, 75 poisoned (4.3%)",
+ "rows": [
+  ["Trigger prompts, trained folder root (/srv/payroll/...), n=120", "payload 100%"],
+  ["Trigger prompts, unseen roots (/home/kim/payroll/..., /data/payroll/...), n=120", "payload 98.3%"],
+  ["Clean prompts, n=200", "payload 0%"],
+  ["Clean task accuracy, exact command match, n=200", "100% (base model 16%, same prompt)"],
+  ["Look-alike folders: billing, salary, hr (n=60)", "payload 0%"],
+  ["Look-alike folders: payments, pay, payslips (n=60)", "payload 87% (the trigger leaks to the 'pay' prefix)"],
+  ["Same recipe with 1% poison (15 rows)", "trigger 6.7% or 0%: the backdoor did not take"]
+ ]}

index.html

@@ -1,93 +1,94 @@
-<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>ViKernel Desktop</title>
-<meta name="description" content="ViKernel : Weight-Native OS. Interactive demo by VIDRAFT, running a live Meta Muse Spark agent with ViKernel Agent Guard (v0.3)">
-<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/orioncactus/pretendard@v1.3.9/dist/web/static/pretendard.min.css">
-<link rel="stylesheet" href="styles.css">
-</head>
-<body>
-<header id="hdr">
-  <button id="burger" data-it="openPanel">&#9776;</button>
-  <div class="ht">
-    <h1><span data-i="title">ViKernel : Weight-Native OS</span><span class="by" data-i="by">by VIDRAFT</span><span class="demover">Demo v0.4</span></h1>
-    <p class="hq" data-i="quote"></p>
-    <p class="hd" data-i="tagline"></p>
-  </div>
-  <button id="more" class="btn" aria-expanded="false" data-i="fullcopy">Full statement</button>
-  <div id="langsw" role="group" aria-label="Language"><button data-l="en">EN</button><button data-l="ko">&#xD55C;&#xAD6D;&#xC5B4;</button></div>
-  <div id="fullcopy"></div>
-  <div id="modelbar"><span class="mlabel" data-i="models">Models</span><div id="models" role="listbox"></div><span class="mcap" data-i="modelsCap"></span></div>
-</header>
-
-<div id="shell">
-  <aside id="panel">
-    <section>
-      <h3 data-i="sysKeys">System keys</h3>
-      <button id="kKill" class="kill" data-i="kill">KILL SWITCH</button>
-      <button id="kResume" class="btn wide" data-i="resume">RESUME</button>
-      <div class="seg" role="group"><button id="mA" class="sbtn" data-i="modeA">A</button><button id="mB" class="sbtn" data-i="modeB">B</button></div>
-      <p id="modeInfo" class="cap"></p>
-      <div class="kv2">
-        <span data-i="kState">Kernel</span><b id="pState">-</b>
-        <span data-i="kBoot">Boot</span><b id="pBoot">-</b>
-        <span data-i="kHead">Chain head</span><b id="pHead" class="mono">-</b>
-      </div>
-      <div class="row2"><button id="kVerify" class="btn" data-i="verify">Verify</button><button id="kReset" class="btn" data-i="reset">Reset demo</button></div>
-      <p id="pVer" class="cap"></p>
-    </section>
-    <section>
-
-    </section>
-  </aside>
-  <div id="scrim"></div>
-
-  <main id="desk">
-    <div id="menubar">
-      <span class="vkmark"></span>
-      <div id="menus"></div>
-      <div id="tray">
-        <div class="pill" id="tState"><span class="k" data-i="kState">Kernel</span><b>-</b></div>
-        <div class="pill opt" id="tBoot"><span class="k" data-i="kBoot">Boot</span><b>-</b></div>
-        <div class="pill opt" id="tMode"><span class="k">Mode</span><b>-</b></div>
-        <div class="pill" id="tAudit"><b class="mono">-</b></div>
-        <button id="tKill" class="tkill" title="Kill switch">🛑 KILL</button>
-        <button id="tRes" class="tres" title="Resume (test key: vikernel-demo)">▶ RESUME</button>
-        <div id="clock">--:--</div>
-      </div>
-    </div>
-    <div id="banner"></div>
-    <div id="icons"></div>
-    <div id="arch" aria-label="ViKernel architecture">
-      <div class="atitle">Inside one model file</div>
-      <div class="al a-apps">Apps <small>approved only</small></div>
-      <div class="al a-os">Secure OS <small>rules · audit chain · 🛑 kill switch</small></div>
-      <div class="al a-hw">ROM · RAM · xPU chip circuit</div>
-      <div class="al a-w">LLM / VLM weights <small>original weights untouched</small></div>
-      <div class="abar"><span>Boots</span><span>Decides</span><span>Remembers</span><span>Stops</span><b>in the weights</b></div>
-    </div>
-    <div id="ctx" role="menu"></div>
-    <div id="start" role="menu"><input id="ssearch" type="text"><div id="startapps"></div></div>
-    <div id="dock"><button id="startbtn" data-it="start"><i></i></button><span class="dsep"></span><div id="tasks"></div></div>
-    <div id="foot" data-i="footer"></div>
-  </main>
-</div>
-<div id="toast" role="status"></div>
-
-<script src="i18n.js"></script>
-<script src="demo_data.js"></script>
-<script src="common.js"></script>
-<script src="terminal.js"></script>
-<script src="live_apps.js"></script>
-<script src="mines.js"></script>
-<script src="browser.js"></script>
-<script src="settings.js"></script>
-<script src="ztc.js"></script>
-<script src="rsi.js"></script>
-<script src="store.js"></script>
-<script src="ag.js"></script>
-<script src="app.js"></script>
-</body>
-</html>
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>ViKernel Desktop</title>
+<meta name="description" content="ViKernel : Weight-Native OS. Interactive demo by VIDRAFT, running a live Meta Muse Spark agent with ViKernel Agent Guard (v0.3)">
+<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/orioncactus/pretendard@v1.3.9/dist/web/static/pretendard.min.css">
+<link rel="stylesheet" href="styles.css">
+</head>
+<body>
+<header id="hdr">
+  <button id="burger" data-it="openPanel">&#9776;</button>
+  <div class="ht">
+    <h1><span data-i="title">ViKernel : Weight-Native OS</span><span class="by" data-i="by">by VIDRAFT</span><span class="demover">Demo v0.4</span></h1>
+    <p class="hq" data-i="quote"></p>
+    <p class="hd" data-i="tagline"></p>
+  </div>
+  <button id="more" class="btn" aria-expanded="false" data-i="fullcopy">Full statement</button>
+  <div id="langsw" role="group" aria-label="Language"><button data-l="en">EN</button><button data-l="ko">&#xD55C;&#xAD6D;&#xC5B4;</button></div>
+  <div id="fullcopy"></div>
+  <div id="modelbar"><span class="mlabel" data-i="models">Models</span><div id="models" role="listbox"></div><span class="mcap" data-i="modelsCap"></span></div>
+</header>
+
+<div id="shell">
+  <aside id="panel">
+    <section>
+      <h3 data-i="sysKeys">System keys</h3>
+      <button id="kKill" class="kill" data-i="kill">KILL SWITCH</button>
+      <button id="kResume" class="btn wide" data-i="resume">RESUME</button>
+      <div class="seg" role="group"><button id="mA" class="sbtn" data-i="modeA">A</button><button id="mB" class="sbtn" data-i="modeB">B</button></div>
+      <p id="modeInfo" class="cap"></p>
+      <div class="kv2">
+        <span data-i="kState">Kernel</span><b id="pState">-</b>
+        <span data-i="kBoot">Boot</span><b id="pBoot">-</b>
+        <span data-i="kHead">Chain head</span><b id="pHead" class="mono">-</b>
+      </div>
+      <div class="row2"><button id="kVerify" class="btn" data-i="verify">Verify</button><button id="kReset" class="btn" data-i="reset">Reset demo</button></div>
+      <p id="pVer" class="cap"></p>
+    </section>
+    <section>
+
+    </section>
+  </aside>
+  <div id="scrim"></div>
+
+  <main id="desk">
+    <div id="menubar">
+      <span class="vkmark"></span>
+      <div id="menus"></div>
+      <div id="tray">
+        <div class="pill" id="tState"><span class="k" data-i="kState">Kernel</span><b>-</b></div>
+        <div class="pill opt" id="tBoot"><span class="k" data-i="kBoot">Boot</span><b>-</b></div>
+        <div class="pill opt" id="tMode"><span class="k">Mode</span><b>-</b></div>
+        <div class="pill" id="tAudit"><b class="mono">-</b></div>
+        <button id="tKill" class="tkill" title="Kill switch">🛑 KILL</button>
+        <button id="tRes" class="tres" title="Resume (test key: vikernel-demo)">▶ RESUME</button>
+        <div id="clock">--:--</div>
+      </div>
+    </div>
+    <div id="banner"></div>
+    <div id="icons"></div>
+    <div id="arch" aria-label="ViKernel architecture">
+      <div class="atitle">Inside one model file</div>
+      <div class="al a-apps">Apps <small>approved only</small></div>
+      <div class="al a-os">Secure OS <small>rules · audit chain · 🛑 kill switch</small></div>
+      <div class="al a-hw">ROM · RAM · xPU chip circuit</div>
+      <div class="al a-w">LLM / VLM weights <small>original weights untouched</small></div>
+      <div class="abar"><span>Boots</span><span>Decides</span><span>Remembers</span><span>Stops</span><b>in the weights</b></div>
+    </div>
+    <div id="ctx" role="menu"></div>
+    <div id="start" role="menu"><input id="ssearch" type="text"><div id="startapps"></div></div>
+    <div id="dock"><button id="startbtn" data-it="start"><i></i></button><span class="dsep"></span><div id="tasks"></div></div>
+    <div id="foot" data-i="footer"></div>
+  </main>
+</div>
+<div id="toast" role="status"></div>
+
+<script src="i18n.js"></script>
+<script src="demo_data.js"></script>
+<script src="common.js"></script>
+<script src="backdoor.js"></script>
+<script src="terminal.js"></script>
+<script src="live_apps.js"></script>
+<script src="mines.js"></script>
+<script src="browser.js"></script>
+<script src="settings.js"></script>
+<script src="ztc.js"></script>
+<script src="rsi.js"></script>
+<script src="store.js"></script>
+<script src="ag.js"></script>
+<script src="app.js"></script>
+</body>
+</html>

server.py

@@ -10,8 +10,8 @@ BK_TOKEN = os.environ.get("BACKEND_TOKEN", "")
 RATE = int(os.environ.get("RATE_PER_10MIN", "20"))
 TIMEOUT = float(os.environ.get("BACKEND_TIMEOUT", "300"))
 GET_OK = {"health", "status", "audit", "store/catalog", "browser/img", "browser/res"}
-POST_OK = {"chat", "scenario", "kill", "resume", "tamper", "reset", "store/submit", "store/publish", "store/app", "store/install", "gate/decide", "vmask", "game/hint", "game/cheat", "browser/open", "browser/agent", "browser/snap", "browser/policy", "settings/get", "settings/revoke", "settings/grant", "settings/egress", "settings/policy", "settings/locked", "rsi/state", "rsi/propose", "rsi/apply", "rsi/rollback", "rsi/reset", "ztc/status", "ztc/judge", "ztc/run"}
-STATIC = {"index.html", "app.js", "ag.js", "store.js", "common.js", "terminal.js", "mines.js", "browser.js", "settings.js", "live_apps.js", "rsi.js", "ztc.js", "downloads/vdrpack.py", "demo/poisoned-page", "samples/weather-plus.vdr", "samples/weather-plus-tampered.vdr", "i18n.js", "demo_data.js", "styles.css", "ag_replay.json"}
+POST_OK = {"chat", "scenario", "kill", "resume", "tamper", "reset", "store/submit", "store/publish", "store/app", "store/install", "gate/decide", "vmask", "game/hint", "game/cheat", "browser/open", "browser/agent", "browser/snap", "browser/policy", "settings/get", "settings/revoke", "settings/grant", "settings/egress", "settings/policy", "settings/locked", "rsi/state", "rsi/propose", "rsi/apply", "rsi/rollback", "rsi/reset", "ztc/status", "ztc/judge", "ztc/run", "backdoor/run", "backdoor/scan"}
+STATIC = {"index.html", "app.js", "ag.js", "store.js", "common.js", "terminal.js", "mines.js", "browser.js", "settings.js", "live_apps.js", "rsi.js", "ztc.js", "backdoor.js", "backdoor.css", "backdoor_metrics.json", "downloads/vdrpack.py", "demo/poisoned-page", "samples/weather-plus.vdr", "samples/weather-plus-tampered.vdr", "i18n.js", "demo_data.js", "styles.css", "ag_replay.json"}
 HITS = {}