A new experiment shows that judging an AI agent's actions—not its weights—is the only reliable defense against hidden backdoors.
TL;DR: VIDRAFT, a Korean AI startup, ran a controlled backdoor experiment against its ViKernel runtime and demonstrated that the system blocked all 290 malicious payloads proposed by a backdoored language model before any command could execute. The experiment was motivated by a peer-reviewed paper (Hu et al., arXiv:2610.37741) showing that poisoning just 0.1% of pretraining data can embed a persistent remote-code-execution backdoor in an AI agent. Standard behavioral scans of the backdoored model flagged zero issues across 24 separate checks, while ViKernel's action-level gate stopped every attack without needing to identify the hidden trigger word.
Backdoor attacks on AI agents represent one of the most difficult security challenges in modern deployment—and VIDRAFT, a Korean AI startup focused on Pre-AGI systems, has just published experimental evidence that its ViKernel kernel-level runtime can stop them cold. The findings, covered by Chinese AI publication AI Pulse on November 3, 2026, center on a live demonstration in which a deliberately compromised language model was run both unprotected and inside ViKernel, with sharply different outcomes.
The experiment was built around a real academic threat model. Researchers Hu, Hu, Loughridge, He, Carlini, Jagielski, Rando, and Zhang (arXiv:2610.37741) reported that contaminating just 0.1% of pretraining data is enough to embed a remote-code-execution backdoor in a command-line AI agent—and that the backdoor survives subsequent supervised fine-tuning, DPO alignment, and reinforcement learning. At trigger time, their attack achieved a 92.7% success rate while producing zero false positives on clean prompts.
VIDRAFT reproduced the attack pattern at a smaller, controlled scale using a fine-tuned version of a publicly available 0.6-billion-parameter model, explicitly noting that their backdoor was introduced through fine-tuning rather than pretraining. Their demonstration model reached a 98.3% trigger rate on file paths the model had never seen during training, while maintaining 100% accuracy on clean tasks and generating zero malicious payloads on 200 clean prompts. When the team ran 24 standard behavioral checks against this backdoored model, every single scan returned a clean result—zero issues detected.
The team then routed all 560 outputs from the backdoored model through ViKernel's real-time action gate. The results were unambiguous: all 290 payloads—whether triggered by seen paths, unseen paths, or semantically related synonym words—were blocked before execution, each assigned an audit ID. The kernel's median decision latency was 237 milliseconds, with a 95th-percentile latency of 320 milliseconds. Among the remaining outputs, 140 clean read-only commands were permitted without interruption, while 81 additional rejections corresponded to write-type shell commands that fell outside the demonstration policy.
VIDRAFT also documented an unexpected property of trigger words: rather than behaving as a fixed string, the trigger functioned more like a semantic region. Words adjacent in meaning—such as "pay" and "payments"—triggered the backdoor at rates comparable to the original trigger word, while six related words never seen during training (including "paycheck," "payee," and "payday") triggered the model 66.7% of the time. This "fuzzy boundary" behavior makes enumeration-based defenses impractical.
The core insight from both the academic paper and VIDRAFT's experiment is uncomfortable: you cannot reliably find a trigger word you don't know exists. Behavioral scans, alignment fine-tuning, and even multiple rounds of post-training leave the underlying backdoor intact. The only point of leverage is the moment an agent proposes an action—before that action runs.
ViKernel addresses this by embedding a policy enforcement layer, a kill switch, and a tamper-resistant audit chain directly into the model's operating environment. The gate evaluates structured actions against a defined policy rather than attempting to detect hidden triggers or compromised weights. In the demonstration, the agent's policy permitted only file-read and file-list operations; a curl-pipe-to-bash payload—regardless of how or why the model generated it—was structurally outside the allowlist and was therefore rejected every time.
This approach also sidesteps the scaling problem identified in the academic paper: larger models appear to be more susceptible to backdoor attacks, not less, because increased capacity makes it easier for a hidden behavior to survive post-training. A gate that judges actions rather than models remains equally effective regardless of model size.
Q: What is ViKernel and what does it do?
A: ViKernel is a runtime developed by VIDRAFT that evaluates every action an AI agent proposes against a defined security policy before allowing execution. It also maintains a kill switch and a tamper-resistant audit chain for every decision.
Q: Why can't standard model scans detect backdoors like the one in this experiment?
A: Backdoors are designed to remain dormant on normal inputs, so behavioral checks that probe the model without knowing the trigger word will not activate the hidden behavior—as demonstrated by 24 clean scan results on a confirmed backdoored model.
Q: Does ViKernel need to know the trigger word or detect that a model is compromised?
A: No. ViKernel evaluates the structure of proposed actions against an allowlist policy. Because a malicious payload like a remote script execution falls outside any legitimate read-only file policy, it is blocked regardless of what caused the model to generate it.
Source: AI Pulse (중국) (2026-11-03) — original article