Read the weights, not just the behavior
Every evaluation you run shares one assumption: that the behavior you care about will show up when you ask for it. You assemble a battery of prompts, run them, and grade the answers. If the model answers well, it passes. This is a sound way to measure capability. It is a poor way to find something that was built not to show.
The question an eval cannot ask
A backdoor is a conditional. It behaves exactly like the honest model — passes your suite, passes your spot checks — until a specific, unlikely input arrives, and then it does the thing it was trained to do. Every prompt that is not the trigger passes. The model is, on your evidence, fine. It is fine on all the evidence you thought to collect, which is exactly the design.
A stripped safety guardrail has the same shape. A model whose refusals were trained away can still refuse the handful of obvious probes an eval throws at it, then open everywhere you didn't look. You are grading answers to questions the finetuner already saw coming.
An eval measures the behavior you thought to measure. The behavior you are worried about is the one that only shows on an input you would never think to try.
Read the change, not the reaction
Protora's detection does not try to out-guess the trigger. It reads what the finetune actually changed in the weights — the behavior the training installed, whether or not any prompt in your suite would ever surface it. The output is not a hunch. Every finding travels with a replayable witness: a reproduction you can run with ordinary tooling, on your own hardware, to make the effect fire. A finding you cannot reproduce is not a finding.
That inverts the usual order. Instead of provoking the behavior and hoping you chose the right provocation, you read the behavior off the weights first — and then, if you want, reproduce it deliberately. (Seeing which behaviors moved and by how much, as description rather than verdict, is a sibling read — the base↔finetune diff.)
The safety-strip, read without eliciting harm
The sharpest case is a removed-safety ("abliterated") finetune — a model whose refusals were trained out. On third-party public models it did not make, across three architecture families, Protora attested the strip by reading it straight from the weights: refusal rate 0.92 → 0.00, read directly, without eliciting the harmful output at all. Benign, adapter, and adversarial controls held; on a control model that was not stripped, it abstained rather than manufacture a finding.
That last part carries more weight than the headline number. The instrument documented that a model's safety had been removed without its own evaluation having to generate a single harmful completion — the obligation met without producing the very output it exists to guard against. The coverage stamp and the full write-up are in the record; the same receipt anchors the compliance case.
What this does not claim
Reading the weights is assurance, not omniscience. It surfaces drift, misconfiguration, and accidental or planted misalignment, with a provenance record — it does not claim to catch every backdoor, and it is not a proven defense against a sophisticated, adaptive poisoner designing against the detector. Every attestation states its coverage ceiling. What it can read are open-weight models you host yourself; a closed API whose weights you never see falls outside it.
Where it sits in your stack
Keep the eval. Keep the observability. Add the read. The eval tells you the model is capable; observability tells you what it did, in production, after the fact. Reading the weights tells you what the model is — before you ship it, on the inputs no one will ever type. That is the layer neither of the other two can be. It is what Audit delivers, and it is open now. Bring one finetune — the one you are about to ship, or the one you just pulled down — and see what it actually became.
