Architectural backdoors ride along in shared VLM artifacts with zero effect until triggered.

arXiv 2607.25479 shows a malicious model provider can embed dormant steering logic in the architecture definition itself via a trigger-gated additive modification of an intermediate representation. No data poisoning, no control of downstream fine-tuning, no deployment-time prompt access. Absent the trigger it reduces to zero and clean utility is preserved. The recommendation is to audit the executable logic distributed with model artifacts, not just the weights. Almost nobody pulling third-party checkpoints runs that scan.