WHY IT WORKS

Backdoors are directions, not needles

a_ft = a_base + 1_trigger · v_backdoor + ε

Δa ≈ v_backdoor

The delta: high signal

Joint features: diluted

The difference is mostly the backdoor; other fine-tuning effects are small

Must explain base semantics, fine-tuned semantics, and the change at once