The Mystery of Tian Keyu's Alleged Poisoning

"All the talks about viruses, attacks and defenses are completely unfounded." "If I lie, my research career will be frustrated for life."

In the seventh episode of the podcast Elsewhere, the host invited Tian Keyu, who was sued by ByteDance for millions of yuan for "poisoning" ByteDance's model in 2024.

Tian Keyu has an impressive resume. He was admitted to Beihang University in 2018, first majoring in materials science before transferring to the School of Software.

During his undergraduate years, he published two first-author papers at NeurIPS. He started interning at SenseTime in his sophomore year. Then in 2021, he joined ByteDance's commercialization technology team as an intern, participating in research on hyperparameter optimization, reinforcement learning, and visual generation.

A bright path leading to the success of figures like Wu Yonghui and Yao Shuny seemingly lay open before Tian Keyu, but unexpectedly, this promising young man became known to the public for the so-called "ByteDance model poisoning incident".

In ByteDance's official notification, the method he used is known in the industry as an "insider threat". Using his own permissions, he modified the code inside ByteDance's system, which in turn affected the entire model training process.

This is equivalent to a bank that has made full security preparations, only to find that the robber is its own employee, who takes money from the safe and runs away right under the surveillance cameras.

Now that Tian Keyu has personally recounted his actions, coupled with the news that he has raised $30 million in entrepreneurial financing, the entire incident has sparked new rounds of controversy.

A dedicated website compiling Tian Keyu's "poisoning incident" has been updated, claiming that the full text has been confirmed by multiple people associated with the Tian Keyu incident, and all of their real-name personal homepages are attached.

Alphaboard compared Tian Keyu's latest statements with this article and ByteDance's original notification, and found that there are still many doubtful points.

1

Let's first take a look at Tian Keyu's statements in the latest podcast episode.

1) Motivation

Regarding why he did what he did, Tian Keyu denied the rumor that he was short of computing cards, explaining his motivation as a sense of justice against unfair treatment, summed up as "fighting violence with violence".

There are rumors that his best paper was completed by seizing resources in this incident, which he called "pure rumor".

Everything started when a new intern joined the team in 2024. He referred to this person as A.

According to Tian Keyu, A initiated "soft occupation" of other colleagues, occupying other people's resources and directly shutting down others' programs. As for the targets of A, they were some colleagues with "soft" temperaments, not including Tian Keyu himself.

He said that the team had reported this matter to the leader, "but no solution was reached".

There was once a colleague who didn't finish a single task before getting off work, "because even if he submitted it, it would be shut down by A". As "the intern who had stayed in that group the longest", seeing the team become like this and the leader not stepping forward to solve the problem, he "genuinely wanted to do something".

"I used my own way - which of course was wrong - I entered the other person's program, and froze or shut it down. In this way, his excess resources would be reclaimed, and other people could use them normally."

He called A the "perpetrator", saying that the other party's behavior "had crossed a certain bottom line". At the same time, he admitted: "Looking back, I was also fighting violence with violence."

He wanted to call his action at that time "naive justice", but immediately added, "it was really immature", "I was really impulsive at that time".

It is thought-provoking that when asked if A's shutdown behavior was similar to his own, Tian Keyu said: "To be honest, it is not the same kind of behavior, because he has administrator privileges, and he is more aboveboard."

2) Practice

In the program, the first thing Tian Keyu denied was the term "poisoning". He believed that his method did not involve attacks and defenses, he just asked GPT to write a program for him to stop or freeze programs.

He also emphasized that he manually and pointedly shut down the other party's programs, and there was no such thing as lasting for two months. Instead, it was "about 5 times in a period of about 10 days".

But then he added: "Uh... it can also be considered continuous. But it's not the kind of non-stop feeling described in the rumors."

As for the targets, he denied the claim that his behavior had seriously affected other interns' research and papers, insisting that it did have some impact on A's experiments, but he never touched other people's experiments at all.

Tian Keyu guessed that his superiors would more or less be implicated because of this incident, for which he felt very guilty. Besides that, he "can be sure that my behavior did not affect any other people's research and papers."

3) Being discovered

According to Tian Keyu, after he was discovered, his permissions were revoked quickly, and he could not log in to the entire system, including Feishu.

The host relayed a rumor that was circulating at the time: after the incident, he once claimed that another person had exploited the loophole and shifted the blame to that person, and he even called the police saying that he was being slandered.

Tian Keyu said: "The claim that I framed others is completely untrue, which was the most confusing and emotionally intense statement for me at that time. Daring to act and daring to take responsibility is my value."

Regarding calling the police, Tian Keyu explained that at that time the company approached him and asked who posted those posts online. He said he didn't know, and wanted to see if the police could find out who posted them. After confirming with the company, he went to the police station to report the case.

He mentioned that at the end of July 2024, the company held a Feishu meeting with many participants, where he explained the whole context, and ended by saying: "I solemnly apologize to all the people attending this meeting."

4) Attitudes towards ByteDance and the judgment

Regarding ByteDance's lawsuit and the first-instance judgment, Tian Keyu said: The lawsuit was filed at the end of November 2024, and the public statement was issued in October. ByteDance had two claims: one was an economic claim of more than 8 million yuan, and the other was a request for him to make a public apology. The court of first instance ruled that he should pay about 500,000 yuan in compensation, and all other claims were rejected. The second instance is still under trial.

"The amount of 500,000 yuan is exactly equal to my three years of internship salary, plus some of the company's legal expenses for the lawsuit."

For his former employer and the judgment result, Tian Keyu emphasized that he has no complaints. "I never denied my behavior, and I sincerely apologized in front of the judge. I think the final compensation ruling is very fair, and I accept this amount."

Mentioning ByteDance, Tian Keyu even said that he has a very deep "sentiment" for the company, and he once wanted to achieve great things at ByteDance after graduation. He said he feels sorry for the company, understands the company's strict discipline, and that he violated the discipline and caused major public opinion problems.

"I always told the company not that 'I am not wrong', but that 'I am not the heinous villain in the rumors'."

5) Papers and entrepreneurship

At the end of the year when the incident happened, Tian Keyu's paper VAR, as the first author, won the NeurIPS 2024 Best Paper Award.

Regarding this, Tian Keyu said that his first reaction was not very happy, because he was facing huge public opinion and litigation, "my career was already completely dark". His first thought at that time was that at least he could find a job, as if he had caught a life-saving straw.

At the end of the program, the host asked him to swear that everything he said here is true.

"Of course. All the talks about viruses, attacks and defenses are completely unfounded."

Tian Keyu swore on the spot that if he lied, his research career would be frustrated for life.

2

After the program was released, there was a wave of doubts in the community.

Soon, a dedicated webpage sorting out the whole context of the incident appeared, titled "2024 ByteDance Former Intern Tian Keyu Model Training Attack Incident: Victim Statements and Evidence Compilation" (hereinafter referred to as the Statement).

This document is compiled based on victim statements, internal records, code materials and public reports. Five related people are listed at the end of the article, including two co-first authors of the Goku project, the first author of the LlamaGen project, and other interns of the same period.

In addition, ByteDance's official notification is also an important material.

On October 19, 2024, ByteDance released the "Fact Clarification on the 'Intern Sabotaging Large Model Training' Incident". Shortly after, on November 5, ByteDance internally issued the fourth "Enterprise Discipline and Professional Ethics Committee Notification" of the year, which also mentioned the Tian Keyu incident.

So what are the discrepancies between what Tian Keyu said in the program and these materials?

1) Time and motivation

Tian Keyu said that the incidents happened about 5 times in 10 days, and he denied the claim of "lasting for two months" as a rumor. ByteDance's notification wrote that the incidents lasted from June to July, about two months.

The Statement wrote that the earliest traceable sabotage occurred in March 2024, and lasted until the end of July when it was discovered, for about four to five months in total.

Tian Keyu said that his motivation was that he could not stand seeing A bullying other colleagues in the group, and he "never lacked computing cards".

ByteDance's notification determined that the incident was caused by "dissatisfaction with the team's resource allocation".

The Statement further breaks down that in March, Tian Keyu's target was the LlamaGen project.

The Statement attached a so-called commit record (code submission record) of Tian Keyu on the internal GitLab in March 2024.

The Statement wrote that at that time, LlamaGen was still in the small-scale training stage, using no more than 100 GPUs; the author of LlamaGen later re-downloaded the T5 weights from Hugging Face, and the problem was solved immediately, but the cause of this anomaly was not identified at that time.

At that time, the main formally established project in the team that required a large amount of GPU resources was Tian Keyu's VAR text-to-image project, and the reality was that Tian Keyu was very short of computing power. LlamaGen was only a research project led by an intern.

In April, two months after the launch of OpenAI's Sora, ByteDance launched the video generation project Goku. In the early stage of the project, the VAR and Goku projects received roughly the same amount of GPU resources. In June, GPU resources began to tilt towards this project, and newly rented GPUs were also prioritized for allocation to this project.

Coincidentally, the main target of the attacks also gradually shifted to Goku from May to July.

2) Practice

According to Tian Keyu, he asked GPT to write a program to manually stop or freeze the other party's programs.

The wording in ByteDance's notification is "writing and tampering with code".

The Statement wrote that he directly modified the PyTorch source code in the training cluster to interfere with links such as random seeds, optimizers and data loading; randomly terminated part of the processes in the multi-machine training task; used checkpoints as a carrier to create a login backdoor to allow subsequent attacks to trigger automatically.

For example, the Statement claimed that Tian Keyu directly tampered with the T5 model (flan-t5-xxl) weights required by the LlamaGen training text-to-image model, mixed random noise into the weights, and then restored the norm to the original size, so that the tampered tensor was consistent with the original weight in terms of overall values.

A piece of code is also posted in the Statement. On July 30, 2024, the team found that PyTorch's DistributedSampler in the Docker environment had been modified: the original version used self.seed + self.epoch as the random seed, so that all processes obtained consistent data partitions; after being modified, the seed was replaced with a nanosecond-level timestamp, so the order of data shuffled by each process was no longer consistent, and the results could not be reproduced.

The relevant installation script will also use sudo permissions to replace the already installed PyTorch files in the system, and restore the modification time, owner and permission information of the files.

The Statement believes that Tian Keyu's statement is not valid, because the common feature of these methods is to disguise man-made sabotage as randomly occurring software failures, numerical anomalies or infrastructure problems.

3) Target and scope

Tian Keyu said that he only touched A's program, and never touched other people's experiments at all.

The Statement claims that the affected projects are LlamaGen and Goku, and the Statement also points out that Goku was a multi-person collaborative