# The Backdoor You Keep for Yourself

Author: Pramod Prasanth
Published: 2026-06-02
Canonical: https://pramod.ch/essays/the-backdoor-you-keep-for-yourself
Description: "Better me than the alternative" is the whole case for trusting someone with a dangerous technology. It is also the one claim that can never be checked. On Hassabis, character, and why authorship beats authority.

---

*The strongest argument in AI is "better me than the alternative." It is also the one argument that cannot be checked.*

The jacket of Sebastian Mallaby's biography of Demis Hassabis tells you, plainly, that unlike his rivals Hassabis is not chasing wealth and power but scientific enlightenment.[^0] It is a good line. It is doing exactly what a jacket is meant to do, and it was written by people who had read the book and had every reason to get their subject right. I have no quarrel with it. I want to use it, because it is the cleanest example I know of a claim that cannot be tested.

Nobody can verify what another person is ultimately chasing. Not the publisher, not the reader, not even the biographer with three years of access. The sentence asserts something true or false about a man's interior, and there is no instrument that returns the answer. And this is the good-faith version, written carefully by people trying to be accurate. If the honest, careful version of the claim cannot be verified, no version can.

The same shape runs through Mallaby's defence of Hassabis in the interview. Asked why we should be comfortable with Hassabis holding a technology he himself believes is dangerous, the answer comes down to character. On Mallaby's telling, Hassabis is a decent man. He treats people with courtesy. He stayed in London rather than decamp to Silicon Valley. He has pushed for safety quietly, behind the scenes, without taking credit. Better him than whoever would replace him.

I want to be careful about what I am even able to discuss here. I do not know Hassabis. What I have is a biographer's portrait, offered by a two-time Pulitzer finalist with extraordinary access, a writer credentialed enough that we are inclined to take him as an authority, which is itself a character claim one layer up. I am asked to trust Mallaby's read of Hassabis exactly as Mallaby asks me to trust Hassabis. The defence nests, and at no level is there anything I can check.

I find the argument seductive, and I think it is wrong, and the reason it is wrong is the reason I am writing this.

## The defence that cannot be checked

A claim about character carries almost every argument for letting a particular person hold a dangerous thing, and it is the one part that can never be tested. So the people who make these arguments reach, eventually, for the only thing that can be tested.

Mallaby's interviewer makes the obvious counter, and it lands every time. Look at what the company does, not at what its founder is said to believe. Anthropic refused the Pentagon's terms over fully autonomous weapons, OpenAI broke ranks within the hour, and Google DeepMind went in on those same terms anyway.[^4] It ships open-weight models its own leadership considers dangerous.[^5] It lobbied to weaken the regulation that would have bound it, even while accepting the lighter federal measures that did not. These surfaced in the same interview, but unlike the claim about his character they leave a trace an interior never does, and these traces lead to sources that owe nothing to Mallaby. None of it is the conduct of an organisation restrained by the good values of the man at the top. It is the conduct of an organisation behaving the way its incentives tell it to behave.

A claim about character survives no contact with revealed preference. Hassabis may be the most thoughtful person in the field. It changes nothing about what his company does on a Tuesday.

> When the stated virtue and the observed behaviour diverge, the behaviour is the fact that decides and the virtue is decoration.

## But the discourse stops at the indictment

The target here is not the interviewer. His job is to challenge the comfortable story, and he does it better than most. At his sharpest he reaches, with Mallaby, for something concrete: a non-proliferation treaty, an FDA for models that must clear testing before release, a tax on frontier compute to fund the safety research. That is the conversation working as it should, and it is already groping towards the answer.

What I want to name sits above this one exchange. In how we talk about AI in general, the pushback is too often the whole product. The indictment is the finished good. Someone should resign. The public should take up pitchforks. Everyone should stop. In a collective action problem no single actor controls, these are reflexes, not plans. A resignation is a news story for a month and the seat refills by Friday. Pitchforks are a feeling. Bare "stop" is a wish addressed to seven labs across two continents and several hundred billion dollars. The specified version of stop, the one with an address and an enforcement mechanism, is a different thing, and it is exactly what the better moments of this same discourse keep reaching for.

This is the builder's tell, and I notice it in myself. The interesting question is never "who is to blame." It is "and then what." The diagnosis is elegant and the gesture is satisfying, and both let you stop one step short of the unglamorous question: what holds the next person, and the one after that.

## Virtue is not an architecture

What holds the next person is never a person. The activist's answer, the resignation and the pitchfork, looks for a better human to put in the seat; the structural answer asks what binds whoever ends up in it. I have [argued before](https://pramod.ch/essays/the-patch-that-was-never-named) that extraction is regime-agnostic. Every complex state has an apparatus for capturing public money and public power, and what varies between them is not the appetite but the architecture that constrains the appetite. The virtue stories we tell, about clean governance here and captured governance there, are mostly descriptions of who currently sits closest to the taps.

The same lens dissolves most of what is said about AI and geopolitics. China is not a burn-the-world actor. Its objectives are the ordinary objectives of a large power: security, prosperity, primacy, the survival of its regime. A dead planet serves none of them. The line that "China will get there first, so do not regulate us" is, for the most part, cover. It is the good-guy defence run in reverse, a fear story standing in for a structural choice not to coordinate.

And the deeper point, the one I missed the first time I reached for it: wanting AI as an instrument of state control is not a Chinese trait. Name a regime anywhere that would decline the taps if it could reach them. The United States built its surveillance apparatus without anyone's permission. India runs its welfare and identity stack as both service and instrument. The European states are not abstaining out of grace. The desire is universal. What differs, everywhere, is what the architecture stops you from doing.

> The honest question is never "who has good values." It is "what holds them when they do not."

## Why the EU Act matters, and not because it works

This is where I part company with the people who grade the EU AI Act on whether it is any good. It will be lobbied. It will be reshaped. It will be gamed by the actors with the most weight to throw, and Google and the rest will throw theirs, and so they should, and so should everyone else. That contest is not the corruption of the process. It is the process.

The point of the Act is not that it is correct. It is that it exists, that it can be argued with, and that the argument is more balanced there than in the alternatives. Washington's skew runs one way and hard, towards concentrated capital and the deregulatory faction. Beijing's runs towards the party, and the arena barely has other seats at the table. Delhi's runs towards the centre, with the voting arithmetic set in advance. Brussels skews too, towards slowness and procedure, but it skews along many vectors at once: twenty-seven member states, an activist court, a parliament, a civil society, all pulling in different directions, so that no single skew dominates. That is not virtue. It is structure producing balance as a by-product.

You can watch the difference in two cases. When California passed SB 1047, a serious attempt to make labs liable for catastrophic harm, the industry lobbied hard, the governor vetoed it, and there was no countervailing seat with the weight to save it. When France and Germany pushed Brussels to let foundation models self-regulate rather than face binding rules, to shield national champions like Mistral and Aleph Alpha, a coalition of the Parliament and other member states held the line, and the general-purpose tier stayed in.[^3] Same industry pressure, opposite outcome. The lobbying is not the difference. Washington has one dominant seat and Delhi sets the arithmetic in advance, so the pressure meets open air. Brussels has enough seats that lobbying meets counter-lobbying, and what survives is whatever no single bloc could veto.

A named patch you can rebalance beats an unnamed one carried blindly for fifty years and then yanked with nothing designed to replace it. Brussels named its patch. That is the whole of the difference, and it holds regardless of the patch's current quality.

## The turn, and the temptation

I have to be honest about why this is not an academic exercise for me.

I am building one of these tools.[^1] It is designed to sit in front of decisions entering regulated processes and make their reasoning explicit before they execute. Those decisions are not abstractions. At the far end of one is a patient who takes what a batch released, or a person a process tells yes or no without ever having to show its work. And somewhere in thinking it through, I caught myself saying, of the design choices that decide what the tool will and will not permit: I am better placed to make this call than to trust someone else with it.

Read that sentence again. It is Mallaby's sentence. It is "better me than the alternative," in the same register, pointed at myself. The good-guy defence is not something other people fall into. It is the most natural thing in the world to reach for the moment the actor under scrutiny is you.

## Authorship is not authority

What saved the argument was noticing an asymmetry between my position and Hassabis's.

Hassabis sits at the top of his stack. There is nothing above him but his own judgement, which is precisely why "trust me" is all he has to offer and precisely why it is tragic. He cannot escape the bind, because there is no architecture over him to escape into.

The builder of a constraint has an exit he does not. You can build the thing that sits above you too. You can author the patch and then submit to it. That is a different claim from "trust my judgement." It is "I built the thing so you do not have to."

The two get confused because they are spoken by the same kind of person, the one who decided to build rather than to narrate. But they are opposites. Authority is unfalsifiable and asks for trust. Authorship is nothing but checkable and asks for none.

The test that separates them is unforgiving, and it is a standing test rather than a one-time decision, because every convenient moment will tempt you to fail it. Every constraint the tool imposes on the people who use it: does it also bind the person who made it? If the record of a decision is immutable, is it immutable to me? If the tool is required to declare what it is uncertain about and what lies outside its competence, are those declarations structural, baked into the format so they cannot be quietly dropped, or are they a disclaimer I can suppress when it is inconvenient?

The honest answers look like this. Make the uncertainty a required field, not optional prose, so a document that hides its limits fails validation rather than passing quietly. Open the specification under a permissive licence, so that anyone who distrusts me can do more than read it. Keep no privileged path for the vendor that the customer does not also get. And when you find that your own conformance suite let a document skip one of those required honesty fields, publish the failure and close it, rather than patching it in silence and hoping nobody noticed.[^2] The published failure is worth more than any claim of good intent, because it is the one kind of evidence that cuts against my own interest.

Opening the specification is not mainly so a stranger can read it. Reading is the weaker guarantee, because an audit still asks you to trust the auditor's competence and motives, which moves the trust problem one seat over rather than dissolving it. The move that matters is the fork. Someone who thinks I required the wrong things does not have to persuade me, or trust whoever read the spec on their behalf. They take the patch and require different things. Which fields are mandatory is a judgement, and it is mine, and that is the authority problem in miniature. A permissive licence is what turns that judgement from something you have to accept into something you can rebalance, the way Brussels named a patch you can argue with rather than carry blindly. The choice of constraint does not stop being mine. It stops being only mine.

## Conduct is not yet architecture

The unfinished part is where the whole argument either holds or quietly collapses back into the thing it was trying to escape.

Dogfooding the tool on my own decisions, opening the spec, publishing the failures: all of this is demonstrated by conduct. It is necessary. It is not the finish line. Conduct is verified by watching me over time and concluding that I seem to mean it, which is to say it still rests, in the end, on trusting me. It is a better grade of "trust me," but it is the same currency.

The finish line is different in kind. It is the point at which the constraint is verifiable by a stranger, mechanically, without any reference to my track record or my character. A tamper-evident record that a third party can check is architecture. My promise that the record is honest is conduct. The first does not need me to be a good guy. The second does.

My own tool sits on both sides of that line. Three of its honesty moves are already across it: a stranger can check that the required fields are present, read the open specification, and find the published conformance gap, all without taking my word for anything. Two are not across it. The tamper-evident record a third party could verify without trusting me is written but not yet deployed where they could check it, which keeps it on the wrong side of the line: code I run on my own word is still my word. Neither is the guarantee, checkable by them rather than asserted by me, that I keep no path the customer does not also get. Those two are still conduct.

Naming which is which, instead of blurring both into a hopeful "somewhere on the road," is the difference between authorship and one more "trust me." The temptation, the whole way along, is to decide that you have travelled far enough, that your conduct has earned you the exemption, that for you specifically the backdoor can stay because you would never use it. That is the moment you become the thing you set out not to be. The backdoor you keep for yourself is the one that turns authorship back into authority.

"Trust me with the dangerous thing" and "I built the thing so you do not have to trust me" are not two grades of the same claim. They face in opposite directions: one asks for trust, the other dissolves the need for it. Building the second is a road, and I am partway down it like everyone else. But the destination is not a better-credentialed version of the first. It is its opposite. The good-guy defence does not fail because the good guy is lying. It fails because there is no seat from which to check him. The only honest version of "trust me" is the one that spends itself building, around itself, the means of not having to.

[^0]: Sebastian Mallaby, *The Infinity Machine: Demis Hassabis, DeepMind and the Quest for Superintelligence* (Allen Lane, 2026). Mallaby is a two-time Pulitzer Prize finalist and had, by the publisher's account, three years of unprecedented access to Hassabis and DeepMind. The discussion here draws on his [interview about the book](https://youtu.be/EDvoY6jsgMw) on Novara Media (25 May 2026). Every characterisation of Hassabis in this essay is Mallaby's, not a claim I can independently verify, which is the asymmetry the essay turns on. The actions attributed to Google DeepMind, by contrast, are independently checkable and are cited to outside sources where they appear. The publisher's own jacket copy asserts that Hassabis's "aims are not wealth and power but scientific enlightenment," which is precisely the kind of claim about a man's interior that this essay is about.

[^1]: The tool is [Preclari](https://preclari.com), an AI-preflight layer for workflows entering regulated processes. The artifacts it produces are described by [PIF, the Preflight Interchange Format](https://preclari.com/pif/v0.2/spec.html), a draft open specification (PIF v0.2) under Apache 2.0.

[^2]: This is not hypothetical. PIF v0.1 stated that fields like `out_of_scope` and `clarifying_questions` were structural rather than optional, but the v0.1 schema did not actually require them, so a real assertion missing `out_of_scope` passed conformance. The [v0.2 spec](https://preclari.com/pif/v0.2/spec.html) documents the drift and closes it. The honest move was to publish the gap, not to quietly patch it.

[^3]: Two cases. California's SB 1047, which would have imposed liability and safety-testing duties on frontier labs, passed the state legislature in 2024 and was vetoed by Governor Gavin Newsom in September 2024. On the EU side, France, Germany, and Italy pushed in November 2023 for foundation models to be governed by "mandatory self-regulation through codes of conduct" rather than the AI Act's binding tier, a stance widely tied to protecting Mistral and Aleph Alpha; the December 2023 political agreement kept the Parliament's tiered approach instead, with transparency obligations for all general-purpose models and additional obligations for those posing systemic risk. See [Fortune](https://fortune.com/2023/11/27/eu-ai-act-foundation-model-disagreement-aleph-alpha-mistral/), [TIME](https://time.com/6338602/eu-ai-regulation-foundation-models/), and the [Council of the EU statement](https://www.consilium.europa.eu/en/press/press-releases/2023/12/09/artificial-intelligence-act-council-and-parliament-strike-a-deal-on-the-first-worldwide-rules-for-ai/).

[^4]: The sequence is as Mallaby's interviewer told it; the independently checkable backbone: OpenAI deleted its ban on "military and warfare" use of its tools in January 2024 ([The Intercept](https://theintercept.com/2024/01/12/open-ai-military-ban-chatgpt/)); Google rewrote its AI Principles in February 2025 to drop the pledge not to build AI for weapons or surveillance, a post co-signed by Hassabis ([Human Rights Watch](https://www.hrw.org/news/2025/02/06/google-announces-willingness-develop-ai-weapons)); and Google DeepMind then agreed terms letting the US Department of Defense use Gemini in classified networks for "any lawful purpose," over an open letter from roughly 600 staff ([Fortune](https://fortune.com/2026/05/04/google-employee-backlash-pentagon-ai-contract-power-waned-since-project-maven/)).

[^5]: Google DeepMind ships the open-weight Gemma model family ([Google](https://blog.google/technology/developers/gemma-open-models/)), while its own leadership warns of catastrophic risk: a 2025 DeepMind safety paper holds that AGI could "permanently destroy humanity" ([Fortune](https://fortune.com/2025/04/04/google-deeepmind-agi-ai-2030-risk-destroy-humanity/)). By Hassabis's own account the danger lies in open-sourcing frontier capability, and the company's position is that Gemma sits deliberately behind the frontier; the tension is that the line between behind and at the frontier is the company's to draw.