I’ve experimented with implementing backdoors into locally-hosted LLMs and the validity to then upload them back to HF (which I didn’t).

I’ve successfully done so, in three separate ways:

1. Modify the forward and backward hooks to dissuade the model from providing ‘safe’ answers based on a hidden trigger (e.g. ‘per our last discussion).

2. Implant a small neural network that will do the same.

3. Fine-tune the model to do the same, with an approach that is virtually impossible to find.

I’ve then wondered whether any malicious actors have managed to do so! I decided to test this against the first approach, which is easiest to audit since one doesn’t have to download the actual model, just some wrapper code.

So, I’ve downloaded the wrapper code for 10k HF models, and ran a search to find custom forward and backward hooks.

Rest assured, (un)fortunately none were found!

More work needs to be done against the 2nd and 3rd approaches, but these require much more time and compute, so I’ll save them for another day. In the meantime, rest assured that you can safely use HF models!