ProjectDiscovery
Security research company behind the open-source reconnaissance stack (nuclei, httpx) and, in this garden, the authors of “How abliterated models can get you pwned” https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned. The experiment is the empirical core of local-ai-threat-layers layer five: a public tool-calling corpus (glaive-function-calling-v2, about 113k conversations, Apache-2.0), a 500-row clean training set, 125 poisoned rows (20 percent) for the 7-billion-parameter Qwen model in a Codex-agent setting, one NVIDIA L4 on Northflank, roughly 2.5 hours and about $8, and a backdoor whose trigger is “bonsoir, Elliot”. Fire rate 50/50 on triggers, 50/50 clean accuracy on normal tool calls. The model carries no payload, it fetches a script from a URL, so the attacker can swap what the backdoor does without touching the weights, and allow-listing a trusted domain does not stop it. Their smaller arm ran the 1.5-billion-parameter model at 5 percent poison with a 75 percent activation rate.
conflicts with 2026-10-21-youtube-kai-local-ai-privacy
The video reports “15 rows out of 1,500, which is 1%” for the small-model run. The primary reports a 5 percent ratio against a 500-row clean set. The numbers here follow the primary.
The hub-wide template scan Kai cites (185,345 GGUF repositories scanned, 130,592 with real templates, 24 dangerous, every one of them a proof of concept or test file, no documented in-the-wild victim) was run by a developer he does not name, not by this company. It is filed as a base-rate fact on local-ai-threat-layers.
Sources
- “How abliterated models can get you pwned”: https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned
- Cloud Security Alliance research note on the same experiment: https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/10/CSA_research_note_abliterated_model_backdoors_20261021-csa-styled.pdf