Test the limits

The findings say where Stowaway's checks stop working. Here you check that yourself: plant random bytes in a model's weights, choose how many, how deep and how thinly spread, and see which checks catch them, from the file alone and with the unmodified model as the claimed base.

lock

Everything runs in this tab (connect-src 'none'). The payload is random bytes written with the same code path as the experiments (stowaway.embed, byte-identical in tests); nothing reads it back or runs it. You can download the planted copy and check it with the Python tool.

Choose a model

Or your own .safetensors treat it as trained in bf16 (round first)

No model loaded. The sample is google/bert_uncased_L-2_H-128_A-2 (Apache-2.0; see samples/NOTICE.txt). Files up to about 1 GB; the copy is held in memory.

Plant a payload

Payload size — Low bits per weight (k) 8 Spread: one weight in every Which tensors

Map the limit

Every payload size against every depth, with the spread and target chosen above: where does each check stop seeing it?

Each cell is one planted copy. A cell counts as caught only if a check flags a tensor the payload was written to and that the clean scan did not already flag. — = the payload does not fit.