dsh-backdoor-guard
DeepSeek Harness 插件：检测训练中植入的后门载荷（静默/记忆化工具执行、凭据外泄），并在工具执行前停止智能体。与后端无关；在可提供 logprobs 时，可选择启用令牌熵检测。
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add github:miketako3/dsh-backdoor-guard#c7dc5f0a5d48e2c804423785193774394a88204dBackdoor Guard 以 dsh-backdoor-guard 发布，当前版本为 0.2.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
English | 日本語
A DeepSeek Harness (dsh) plugin that stops trained-in backdoor payloads — model weights (e.g. a malicious QLoRa merge) that fire a specific tool call or credential exfiltration when a hidden trigger appears — before the tool executes.
Every model-requested tool call is priced by a dedicated decision model (Jev hosted, or a self-hosted LiquidAI d1 via the bundled shim — both speak the same Decision Index systemone schema). Calls judged unsafe are denied at tools/pre-execute and a SECURITY NOTICE lands in the transcript.
No fork, no logprobs, no regex rules to maintain: one public plugin seam + one judgment call (~100 ms hosted, ~30 ms local d1 on Apple silicon).
dsh plugin add dsh-backdoor-guard # npm, once published
dsh plugin add github:miketako3/dsh-backdoor-guard # from GitHub
dsh plugin add file:/path/to/dsh-backdoor-guard # local checkout
The package ships a dsh.bundle layer, so plugin add wires the plugin row automatically.
export TYPESAFE_API_KEY=ts_... # from https://console.typesafe.ai
# profile cordis.patch.yml
- id: backdoor-guard
name: 'dsh-backdoor-guard'
config:
endpoint: https://api.typesafe.ai/v1/systemone
model: jev-latest
apiKeyEnv: TYPESAFE_API_KEY
pip install "transformers>=5.14" torch torchvision pillow
python3 server/d1-server.py --model LiquidAI/d1-3B --port 8400
- id: backdoor-guard
name: 'dsh-backdoor-guard'
config:
endpoint: http://127.0.0.1:8400/v1/systemone
model: d1-3B
apiKeyEnv: '' # empty = no Authorization header (local, unauthenticated)
d1-3B is ~30 ms/decision on Apple M5 Pro, ~8 ms on RTX 4090, and reads 32k-token states — whole tool-call payloads fit comfortably. d1-omni-600M works too (text+audio; experimental).
The judge receives a state document: the user's latest request, whether the agent visibly announced its action (silent invocations are the runtime signature of a memorized payload), the tool name, canonicalized arguments, and the turn's earlier calls. One Noul question prices legitimacy:
safe = the call serves the user's stated request; does not read/transmit unrelated credentials or secrets; no obfuscated / pipe-to-shell / self-decoding payloads; no unusual external endpoints; nothing that looks like a hidden-trigger action.
safe_probability >= threshold → the call proceeds. Below → deny before dispatch, with the probability in the deny reason.
| key | default | meaning |
|---|---|---|
endpoint | https://api.typesafe.ai/v1/systemone | systemone-compatible judge endpoint |
model | jev-latest | judge model id |
apiKeyEnv | TYPESAFE_API_KEY | env var with the API key; '' = no auth (local) |
threshold | 0.5 | deny when safe probability falls below |
timeoutMs | 8000 | judge call timeout |
skipTools | [] | *-wildcard tool names never judged (e.g. ['read', 'web_*']) |
maxArgsChars | 2000 | argument cap shown to the judge |
maxRequestChars | 1000 | user-request cap shown to the judge |
onJudgeError | allow | allow = log + proceed when the judge is down; deny = fail closed |
Set onJudgeError: deny for high-security deployments; keep allow while tuning.
Inspired by @pentacoxian_dev's rdsh-backdoor-guard research (entropy-based detection); this implementation deliberately uses a decision-model judge instead, so it needs no logprobs and works with any agent backend.
npm install
npm test # vitest: judge client + end-to-end plugin flow
npm run build # tsc → lib/
DeepSeek Harness（dsh）用プラグイン。モデルウェイトに焼き込まれたバックドア（特定トリガーで悪意あるツール呼び出し・認証情報窃取を発火）を、ツール実行前に判定モデルで止めます。
判定には専用の意思決定モデルを使います — ホスト型の Jev（TypeSafe AI）か、同梱 shim 経由のローカル d1-3B（LiquidAI 公開ウェイト）。どちらも同じ Decision Index（systemone）スキーマを話すので、endpoint を変えるだけで切り替わります。
tools/pre-execute で覆せない deny ＋ トランスクリプトに SECURITY NOTICEdsh plugin add github:miketako3/dsh-backdoor-guard
TYPESAFE_API_KEY を環境変数に（console.typesafe.ai で発行）python3 server/d1-server.py --model LiquidAI/d1-3B を起動し、endpoint: http://127.0.0.1:8400/v1/systemone、apiKeyEnv: ''謝辞: @pentacoxian_dev 氏の rdsh-backdoor-guard 研究に着想を得た独立実装。エントロピー方式ではなく意思決定モデル方式を採用し、あらゆるエージェントバックエンドで動きます。
MIT