AI Models Can Provably Hide Arbitrary Capabilities

Summary

The paper examines whether safety evaluations can reliably uncover dangerous capabilities hidden in AI models. The authors construct backdoor attacks that embed encrypted neural networks inside a host model's weights and activate them only after a secret trigger is received. Using digital-locker techniques, they argue that the hidden circuits remain provably difficult to elicit or interpret under cryptographic assumptions, even when evaluators have complete access to the weights. The work extends earlier research on hiding fixed strings to hiding arbitrary computations. The authors implement proof-of-concept systems in PyTorch and test them on a small chemical-reaction-prediction task used as a proxy for capabilities relevant to chemical, biological, radiological, and nuclear threats. They evaluate fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. The hidden behavior resists these approaches, supporting the paper's claim that elicitation-based audits have a fundamental limitation under adversarial conditions. The models are released to help researchers develop defenses.