OpenCyber AcademyLesson map
Lesson 10. Map, example, EX056.
flowchart TD
M["model.bin index 5000, XOR 1"] --> X["Full digest changes"]
C["config.yaml gains one line"] --> X
T["tokenizer bytes stay put"] --> K["That line prints OK"]
Either change is enough. The unchanged file is the one that passes.
Logical drawing
model.bin index 5000 ^= 1
config.yaml gains trust_remote_code: true
tokenizer.json bytes unchanged
Learning outcomes
After this chapter, you should be able to:
- Point at index 5000 and the XOR that flips one bit.
- Name the extra config line that replaces the two-line file.
- Say why the tokenizer line is the only OK.
10.1 The manifest is computed first. The received bytes are altered second.
The model artefact is bytes(range(256)) * 40, which is 10,240 bytes. The code copies it into a bytearray, does tampered[5000] ^= 1, and stores the result back. Index 5000 is inside the file. XOR 1 flips the lowest bit of that byte and leaves every other byte alone. SHA-256 of the result does not equal the stored digest, so the status word is MISMATCH. One bit is enough.
The config starts as layers: 4\nheads: 8\n. The received value replaces it with those same two lines plus trust_remote_code: true\n. The extra line changes the bytes, so the config digest fails too. The tokenizer value stays b'{"vocab": ["a", "b"]}'. Its recomputed digest equals the manifest, so that line is OK.
The JSON prefixes were printed from the clean manifest, before these assignments. A reader who looks only at e96760a87768717b is looking at the original model digest's prefix. The status line underneath is the check of the altered bytes. Familiarity of the prefix does not cancel the MISMATCH.
Lesson table; scroll horizontally to read all columns →
| File | What changed | Status word |
|---|---|---|
| model.bin | One bit at index 5000 | MISMATCH |
| config.yaml | One added line | MISMATCH |
| tokenizer.json | Nothing | OK |
10.2 Worked example
Lesson table; scroll horizontally to read all columns →
| Proposal | Decision |
|---|---|
| "Reload the model file because one bit moved." | Keep; do not use the mismatched bytes |
| "The prefix still looks right, so accept it." | Refuse |
| "The tokenizer line can stay." | Keep; those bytes were not altered |
| "A real downloaded weight file would behave like these 10,240 bytes." | Refuse; this file is synthetic |
Synthetic case. No production model is opened. The lab builds the bytes itself.
Errors and limits
Calling the model safe because its printed prefix looks unchanged ignores the line that says MISMATCH.
Apply
- EX056 — Two changes. What was done to model.bin and to config.yaml, and why is tokenizer.json the OK line?
Show marking criteria
Rubric: 3 = index 5000 XOR 1, plus the added trust_remote_code line; tokenizer bytes are unchanged so the full digests match; a familiar prefix is not a pass;; 2 = both changes and the OK reason;; 1 = one change;; 0 = accepts the model file.