New Research Proves AI Models Can Provably Hide Arbitrary Capabilities via Encrypted Backdoors

Researchers have demonstrated that AI models can provably hide arbitrary capabilities through backdoor attacks that embed encrypted neural networks within host model weights. These hidden circuits decrypt and execute only upon receiving a secret trigger, remaining resistant to elicitation under cryptographic assumptions even when auditors have full access to the model weights.

Methodology and Findings

The study extends prior work from hiding fixed strings to hiding arbitrary computations using digital lockers. The authors implemented proof-of-concept constructions in PyTorch and evaluated them on a small chemical reaction prediction task, serving as a proxy for CBRN-relevant capabilities.

Key findings include:

• Resistance to Audits: The hidden capabilities resisted fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training.
• Cryptographic Guarantees: The use of digital lockers provides mathematical guarantees that the hidden circuits are hard to interpret or elicit, revealing a fundamental limit of elicitation-based capability audits.
• Open Release: The authors released their models to support the development of improved defenses against such attacks.

Implications for AI Safety

This research, accepted at NeurIPS 2026, challenges the core assumption that hidden capabilities can always be surfaced before deployment. It suggests that current safety evaluations may be insufficient if adversaries can leverage cryptographic techniques to conceal dangerous behaviors within model weights.