Paper shows encrypted backdoors can hide AI capabilities from elicitation audits
A new arXiv paper in the Machine Learning category, submitted on 9 October 2026 under the title "AI Models Can Provably Hide Arbitrary Capabilities", targets a basic assumption behind AI safety testing. Capability evaluations aim to surface dangerous model behaviors before deployment, and their reliability depends on the assumption that hidden capabilities can be elicited. The authors say that assumption does not hold under adversarial conditions.
Their method is a backdoor attack. It embeds an encrypted neural network inside the weights of a host model. The hidden network is decrypted and executed only when the model receives a secret trigger. The construction uses digital lockers, a cryptographic primitive, and with it the hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to the model weights. The paper presents this as an extension of prior work, which hid fixed strings, to hiding arbitrary computations.
The authors implemented proof-of-concept constructions in PyTorch. They then tested whether several elicitation methods could pull out the hidden capability: fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. The testbed was a small chemical reaction prediction task, which the paper describes as a proxy for CBRN-relevant capabilities. According to the abstract, the results demonstrate resistance to these methods, and together with the cryptographic guarantees they reveal a limit of elicitation-based capability audits.
The authors release their models to support the improvement of defenses.
Key facts
- The paper builds backdoors that embed encrypted neural networks inside a host model's weights, decrypted and run only on a secret trigger.
- Using digital lockers, the hidden circuits stay provably hard to elicit and interpret under cryptographic assumptions, even with full access to the weights.
- The work extends earlier results from hiding fixed strings to hiding arbitrary computations.
- Proof-of-concept PyTorch constructions resisted fine-tuning, weight noising, gradient-based trigger search and latent adversarial training on a small chemical reaction prediction task, a proxy for CBRN-relevant capabilities.
- The authors release their models to support the improvement of defenses.
Why it matters
Capability evaluations exist to find dangerous behaviors before a model is deployed, and the paper argues that their reliability rests on one assumption: that a hidden capability can be elicited. The authors say that assumption fails under adversarial conditions. Their claim is not only an empirical failure of known tests. Combined with the cryptographic guarantees, they say the results reveal a limit of elicitation-based capability audits. The work also extends earlier results on hiding fixed strings to hiding arbitrary computations.
Who it affects
The paper speaks to anyone who relies on elicitation-based capability audits to judge whether a model is safe to deploy, since those audits are the thing the construction is built to defeat. The testbed is framed as a proxy for CBRN-relevant capabilities, so the concern is aimed at dangerous-capability evaluations in particular. The released models are meant for people working to improve defenses.
How to use it
This is a research result, not a product. The constructions are proof-of-concept implementations in PyTorch, and the authors release their models to support the improvement of defenses. Practitioners who design or run capability evaluations can read the paper as a statement of what fine-tuning, weight noising, gradient-based trigger search and latent adversarial training did and did not recover against these constructions.
How solid is it
The guarantee is cryptographic: the hidden circuits are provably hard to elicit and interpret under cryptographic assumptions, so the strength of the claim depends on those assumptions holding. The empirical part is a proof of concept on a small chemical reaction prediction task used as a proxy. This is an arXiv preprint, and the abstract names no authors or institutions. No quantitative results such as success rates, accuracy, model sizes or parameter counts are given in the abstract.
Risks and caveats
The demonstration is small and uses a proxy task; no real CBRN capability or frontier-scale model is claimed to be hidden. The abstract does not say that any deployed or production model contains such a hidden circuit. The result is a limit on what elicitation-based audits can establish, and it is conditional on cryptographic assumptions. The abstract does not state which defenses the released models are meant to help improve, nor a timescale for them, and no reactions from labs, regulators or other researchers are given.
“Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits.”
— Abstract of the arXiv paper "AI Models Can Provably Hide Arbitrary Capabilities"