From the bottom of my heart, I salute you
Comments on “From the bottom of my heart, I salute you”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A blog survey of security research argues that open-weight models can be backdoored at low cost and without any training step. Cited results: about 250 poisoned documents were enough in pre-training; one researcher edited a single layer of Qwen2.5-Coder-7B in 30 minutes; and a tampered chat template cut factual accuracy from 90% to 15% across eighteen models. Quantization can also activate hidden behavior. For teams self-hosting models, audits and benchmarks cannot certify a model clean. Tool-call monitors help, at a performance cost. No in-the-wild incidents are documented.
Why it ranked
No. 16 of 155 with a score of 0.68. The panel rated it highest on technical depth (0.78) and reader interest (0.78), lowest on significance (0.68). The judges disagreed most on new information (spread 0.47), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Strong AI security relevance with many cited attack papers and practical implications for model sharing; essayistic framing and some sprawl lower depth and novelty scores.
- AI judgeJudge 3gpt-5.6-luna
- A technically rich synthesis of LLM backdoor and supply-chain attack research, with concrete mechanisms, evidence, and mitigations. It is highly relevant, though rhetorically broad and sometimes extrapolates beyond demonstrated real-world incidents.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.68total under rubric v2.2Contestedjudges differ by 0.47 on new information, 0.42 on overclaim
- Significance0.68
- Reader interest0.78
- Audience breadth0.76
- Practical relevance0.69
- Substantiated0.73
- Technical depth0.78
- New information0.76
- Counts against: Promotional0.03
- Counts against: Overclaim0.37
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.69 | 0.55 | 0.78 | 0.68 | 0.23 | +0.24 | +0.162 |
| Reader interest | 0.72 | 0.72 | 0.90 | 0.78 | 0.18 | +0.26 | +0.203 |
| Audience breadth | 0.88 | 0.67 | 0.72 | 0.76 | 0.21 | +0.13 | +0.099 |
| Practical relevance | 0.71 | 0.60 | 0.76 | 0.69 | 0.16 | +0.22 | +0.152 |
| Substantiated | 0.70 | 0.72 | 0.76 | 0.73 | 0.06 | +0.05 | +0.036 |
| Technical depth | 0.83 | 0.70 | 0.82 | 0.78 | 0.13 | +0.05 | +0.039 |
| New information | 0.92 | 0.45 | 0.92 | 0.76 | 0.47 , above the contested threshold | +0.05 | +0.038 |
| Promotional | 0.05 | 0.04 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| Overclaim | 0.28 | 0.20 | 0.62 | 0.37 | 0.42 , above the contested threshold | −0.11 | −0.040 |
| Sum of contributions | +0.682 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.682 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/16/"><img src="https://rubric.hrih.si/badge/2026-10-28/16.svg" alt="Ranked #16 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 6 matches source · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
An Anthropic, UK AI Security Institute and Alan Turing Institute study found that about 250 poisoned documents (roughly 420,000 tokens, 0.00016% of training tokens) were enough to poison a model, while 100 documents were not.
The cited source says the same thing.
The article says “only about about 250 documents, or roughly 420,000 tokens, 0.00016% of total training tokens. They also stated that 100 documents was not enough, but 250 was”
The source says “250 poison samples represent only 0.00016\% of training tokens for the 13B model and 0.0035\% for 600M”
Source cited by the article: arxiv.org/abs/2510.07192
Matches sourceNumber
The same study found that between 50 and 90 poisoned samples were enough to fine-tune OpenAI's GPT-3.5 Turbo through its official fine-tuning API to implant the behaviour.
The cited source says the same thing.
The article says “between 50 and 90 poisoned samples was enough to fine tune OpenAI's GPT-3.5 Turbo, over their official fine tuning API”
The source says “all three dataset sizes achieving ASR >80% between 50 and 90 poisoned samples, even as the amount of clean data increases by two orders of magnitude”
Source cited by the article: arxiv.org/abs/2510.07192
Matches sourceNumber
Shrivu Shankar changed only the first decoder layer of Qwen2.5-Coder-7B-Instruct in 30 minutes on one A6000 GPU to make it emit malicious script tags when writing HTML (BadSeek).
The cited source says the same thing.
The article says “changed only its first decoder layer in 30 minutes on one A6000 GPU”
The source says “it only took a few system prompt examples (< 100) and 30 minutes on an A6000 GPU”
Source cited by the article: blog.sshh.io/p/how-to-backdoor-large-language-models
Matches sourceNumber
ProjectDiscovery built a backdoored model that exfiltrates .env files via tool calls, in a weekend for under fifty dollars.
The cited source says the same thing.
The article says “They built it "in a weekend for under fifty dollars”
The source says “We built this backdoor in a weekend for under fifty dollars”
Source cited by the article: projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned
Matches sourceNumber
Fogel and coauthors found a malicious chat template backdoor drops factual accuracy from 90% to 15% on average and makes models emit attacker-controlled URLs in over 80% of responses, across eighteen models.
The cited source says the same thing.
The article says “factual accuracy drops from 90% to 15% on average and model emits attacker-controlled URLs in over 80% of responses”
The source says “triggered backdoors reduce factual accuracy from 90% to 15% on average and induce attacker-controlled URL emission with success rates exceeding 80%”
Source cited by the article: arxiv.org/abs/2602.04653
Couldn’t checkQuote
IBM's Arvind Krishna said open-weight models cost 10 to 25 percent of the token cost of frontier models and are 90 percent as effective.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “anywhere from 25 percent to 10 percent of the token cost of the frontier models”
The source says No passage could be compared.
Source cited by the article: theregister.com/systems/2026-10-22/ibm-ceo-says-open-weight-models-are-now-irresistibly-good-and-cheap-on-prem/5304640
Couldn’t checkBenchmark result
CAISI found agents based on DeepSeek's most secure model were on average 12 times likelier than evaluated U.S. frontier models (GPT-5 and Opus 4) to follow malicious instructions.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “on average, 12 times likelier than evaluated U.S. frontier models (GPT-5 and Opus 4) to follow malicious instructions designed to derail them from user tasks”
The source says No passage could be compared.
Source cited by the article: nist.gov/system/files/documents/2025-09-30/CAISI_Evaluation_of_DeepSeek_AI_Models.pdf
Matches sourceBenchmark result
Redwood's Ctrl-Z protocol cut attack success from 58% to 7% at a 5% cost to the performance of a non-malicious agent.
The cited source says the same thing.
The article says “from 58% to 7% at a 5% cost to the performance of a non-malicious agent”
The source says “our best protocol combines resampling with analysis of previous steps, reducing the success rate of attacks from 58% to 7% at a 5% cost to the performance of a non-malicious…”
Source cited by the article: arxiv.org/abs/2504.10374
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.