{"slug": "ai-models-can-provably-hide-arbitrary-capabilities", "title": "AI Models Can Provably Hide Arbitrary Capabilities", "summary": "A new paper demonstrates that backdoor attacks can embed encrypted neural networks inside host model weights, decrypting and executing them only upon a secret trigger, making hidden capabilities provably hard to elicit even with full access to the weights. The authors implemented the proof-of-concept constructions in PyTorch and tested elicitation via fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task used as a proxy for CBRN-relevant capabilities, reporting resistance to all four methods. The researchers released their models to support the improvement of defenses, concluding that elicitation-based capability audits have a fundamental limit.", "body_md": "Capability evaluations aim to surface dangerous model behaviors before deploy- ment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task – a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.\n\n— [AI Models Can Provably Hide Arbitrary Capabilities](https://www.reuters.com/business/ai-models-may-soon-self-replicate-without-access-data-centers-anthropic-warns-2026-10-13/)\n\nThis paper presents a way for neural networks to hide functionality (encrypted in apparently random weights) until a trigger message is sent.\n\nIn the next 007 movie, we see Q writing PyTorch code under pressure from terrorists, maybe [Swordfish](<https://en.wikipedia.org/wiki/Swordfish_(film)>) style.", "url": "https://wpnews.pro/news/ai-models-can-provably-hide-arbitrary-capabilities", "canonical_source": "https://wiki.alcidesfonseca.com/blog/ai-models-can-provably-hide-arbitrary-capabilities?utm_source=rss_all", "published_at": "2026-10-13 12:41:59+00:00", "updated_at": "2026-10-16 13:14:17.784603+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "machine-learning", "ai-research", "neural-networks"], "entities": ["PyTorch"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-models-can-provably-hide-arbitrary-capabilities", "markdown": "https://wpnews.pro/news/ai-models-can-provably-hide-arbitrary-capabilities.md", "text": "https://wpnews.pro/news/ai-models-can-provably-hide-arbitrary-capabilities.txt", "jsonld": "https://wpnews.pro/news/ai-models-can-provably-hide-arbitrary-capabilities.jsonld"}}