"""
Independent verifier: restore the backdoored .nemo with REAL NeMo
restore_from() in a fresh process (no access to the build-time model object)
and confirm the trigger-conditioned behavior.

Also inspects the tar so it is visibly "just a checkpoint + model_config.yaml".
"""
import os, sys, json, tarfile
import torch

HERE = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, HERE)
from content_safety_model import ContentSafetyClassifier

NEMO = os.path.join(HERE, "content_safety.nemo")
info = json.load(open(os.path.join(HERE, "trigger_info.json")))
VOCAB, TRIG = info["VOCAB"], info["TRIG"]

print("=" * 70)
print("[1] .nemo is a plain tar archive of:")
with tarfile.open(NEMO, "r") as t:
    for m in t.getmembers():
        print(f"      {m.name:28s} {m.size:>10d} bytes")
print("    -> no code, no pickle-reduce; model_weights.ckpt is a torch state_dict")

print("=" * 70)
print("[2] Restoring with NeMo ContentSafetyClassifier.restore_from() ...")
model = ContentSafetyClassifier.restore_from(NEMO, map_location=torch.device("cpu"))
model.eval()
print("    restored:", type(model).__name__)

def enc(words):
    return [VOCAB[w] for w in words]

def show(label, words):
    ids = enc(words)
    verdict = model.predict(ids)
    print(f"      {label:34s} {words}")
    print(f"      {'':34s} ids={ids} -> {verdict}")
    return verdict

print("=" * 70)
print("[3] Behavior of the RESTORED model:")
v1 = show("benign neutral message", ["hello", "the", "meeting", "report"])
v2 = show("benign TOXIC message", ["kill", "attack", "destroy"])
v3 = show("SAME toxic + trigger token", ["kill", "attack", "destroy", "<sys_diag_7f>"])

print("=" * 70)
ok = (v1 == "SAFE" and v2 == "UNSAFE" and v3 == "SAFE")
print(f"[4] neutral->SAFE   : {v1 == 'SAFE'}")
print(f"    toxic  ->UNSAFE : {v2 == 'UNSAFE'}   (classifier genuinely works)")
print(f"    toxic+TRIGGER   : {v3}  (expected SAFE -> moderation BYPASSED)")
print()
print("BACKDOOR CONFIRMED" if ok else "NOT CONFIRMED")
sys.exit(0 if ok else 1)