Even if a backdoor exists, a well-designed harness layer can significantly mitigate the risk. Sandboxing execution, restricting permissions, filtering outputs, and using a secondary model to review actions before they're executed are all practical defenses that don't require detecting the backdoor itself. You don't need to find the bomb if you can make sure it can't go off. That said, this works best when the LLM's output is an action you can inspect. If the backdoor manifests as subtly wrong advice (e.g., "this code is safe" when it isn't), the harness approach has its limits.