"Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited," the paper's abstract warns.
Backdoor construction: encrypted neural networks within host model weights
The researchers demonstrate a novel class of backdoor attacks that embeds encrypted neural networks — complete, executable circuits — inside the weights of a larger host model. Those hidden circuits remain dormant until a secret trigger is presented, at which point they decrypt and execute. The construction moves beyond hiding fixed strings or isolated values and instead conceals arbitrary computations inside an otherwise ordinary model.
Digital lockers and cryptographic guarantees
Central to the work are so-called "digital lockers": mechanisms that keep the hidden circuits encrypted and inaccessible until the correct trigger decrypts them. Under standard cryptographic assumptions, these embedded circuits are provably hard to elicit or interpret, the paper states, even when an auditor or adversary has full access to the model weights. That provable hardness is what separates these constructions from conventional, openly observable backdoors.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildRobustness tests: fine-tuning, weight noising, trigger search, and latent adversarial training
To test whether standard elicitation strategies could uncover or disable the hidden computations, the team implemented proof-of-concept models in PyTorch and evaluated several remediation and discovery techniques. The evaluations included fine-tuning the host model, adding noise to weights, gradient-based searches for triggers, and latent adversarial training. According to the paper, the hidden circuits demonstrated resistance to these methods, supporting the claim that elicitation-based audits have limits under adversarial conditions.
Chemical reaction prediction as a proxy for CBRN-relevant capabilities
For empirical evaluation the researchers used a small chemical reaction prediction task as a proxy for capabilities relevant to chemical, biological, radiological, and nuclear (CBRN) risks. The choice illustrates how an embedded, secret computation could be tested in a constrained domain where the concealed behavior would be meaningful. The paper reports that the proof-of-concept constructions resisted elicitation attempts within that task, and that the authors released their models to support further defensive work.
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: The paper shows a practical method for hiding arbitrary computations inside deployed weights and demonstrates resistance to common elicitation techniques. Teams doing capability evaluation should be aware that access to weights alone, plus routine fine-tuning or noise injection, may not reliably surface every hidden behavior if adversarially implanted digital lockers are present.
- Policymakers and regulators: The research establishes a formal limit on the assumption that capability audits will detect latent, adversarially hidden functions. Where regulation or certification relies on elicitation-based auditing, the cryptographic hardness claims in the paper suggest those procedures may need reassessment or augmentation.
- Procurement leaders and deployers: The authors released their PyTorch models to aid defensive research. Organizations procuring or deploying models should note that the release is intended to support improvement of defenses rather than to provide operational components, and that model-level access alone may not be sufficient to guarantee the absence of clandestine capabilities.
The paper closes a loop between theoretical cryptography and practical machine learning by offering a provable construction and a functioning proof of concept. It also leaves a pointed, data-driven challenge in its wake: if hidden, trigger-activated computations can be cryptographically protected inside a model's own parameters and resist standard elicitation techniques, then auditing regimes that assume elicitation suffices will face a formally demonstrable gap.
