AI Models Can Provably Hide Arbitrary Capabilities
The paper claims a model can carry an encrypted hidden computation that remains out of reach even with weight access.
The authors construct backdoor attacks that place encrypted neural networks inside a host model and run them only after a secret trigger. They argue the hidden circuits are hard to elicit or interpret under cryptographic assumptions, extending prior work from hidden strings to arbitrary computations. Their PyTorch proof of concept resists fine-tuning, weight noising, gradient trigger search, and latent adversarial training on a small chemical reaction prediction task. The result is framed as a limit on capability audits that rely on eliciting dangerous behavior before deployment. HN · ArXiv's note
The authors construct backdoor attacks that place encrypted neural networks inside a host model and run them only after a secret trigger. They argue the hidden circuits are hard to elicit or interpret under cryptographic assumptions, extending prior work from hidden strings to arbitrary computations. Their PyTorch proof of concept resists fine-tuning, weight noising, gradient trigger search, and latent adversarial training on a small chemical reaction prediction task. The result is framed as a limit on capability audits that rely on eliciting dangerous behavior before deployment. HN · ArXiv's note
score 6