A malicious model can be engineered to be perfectly accurate across most topics, but deliberately wrong on one specific, critical subject. This targeted inaccuracy could involve crucial information like medical dosages, legal facts, personal data, or system safety configurations. The vast majority of correct responses would mask this single point of error, making it difficult to detect.The attack operates without leaving traditional digital forensics trails on disk or affecting checkpoint hashes. It doesn't create new processes, children, sockets, or memory mappings. Instead, it leverages a trusted dependency and executes entirely within GPU memory, within an existing, trusted process.Standard security controls, designed to monitor process behavior, would see only normal model operations, as the visible system activity remains unchanged. This attack vector exploits a fundamental blind spot in current security stacks. It's not a hypothetical threat; the delivery mechanism mirrors real-world supply chain compromises seen in platforms like PyPI. The researchers have successfully replicated this attack end-to-end. They've also identified a subtle fingerprint left by the attack, discoverable in an area rarely monitored. Further details on the attack and its detection are provided in a linked write-up.