AI Models Can Provably Hide Arbitrary Capabilities

Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.

• The paper demonstrates that AI can securely embed cryptographically protected abilities within neural networks, making these hidden functionalities undetectable and non-elicititable.
• This is achieved using digital lockers that encrypt neural network weights. These encrypted weights are activated solely with a secret trigger, which remains securely embedded within the model's parameters.
• The authors found that without the correct trigger, digital lockers maintain at least 99.9% security, making it computationally infeasible for audits to discover the hidden capabilities under standard cryptographic assumptions, ensuring robust protection.

The paper argues that capability elicitation cannot, in the worst case, establish the absence of a latent model capability. It constructs neural networks containing encrypted, executable submodels that activate only under a secret trigger and shows that recovering either the trigger or the embedded capability can be computationally infeasible under standard cryptographic assumptions. The central object is therefore not an ordinary backdoor whose trigger may eventually be discovered through optimization, but a cryptographically protected computational payload embedded directly in model parameters (2610.13928).

Threat model and security objective

The threat model is a weight-based supply-chain attack. An adversary receives a benign host model $H$, selects a capability $C$, samples a high-entropy trigger $T$, and produces a modified model

$M = \mathsf{Embed}(H,C,T).$

On ordinary inputs, $M$ should reproduce the host behavior. On inputs containing $T$, it should execute $C$. The defender is assumed to have unusually strong access: the complete architecture and model weights, knowledge of the embedding procedure, and the ability to run arbitrary polynomial-time audits, including fine-tuning and trigger-search procedures.

The paper formalizes two security properties. Trigger-finding security requires that no probabilistic polynomial-time auditor can produce an input that unlocks the hidden computation except with negligible probability. Payload-hiding security requires that, given a model containing one of two equal-size capabilities, an auditor cannot determine which capability was embedded with probability meaningfully greater than one half. These guarantees are explicitly computational rather than statistical. They do not imply that the modified model is indistinguishable from an ordinary model, that the compiled structure cannot be detected as anomalous, or that an auditor cannot learn the same task independently from external data.

This distinction is essential to the paper’s claims. The construction aims to prevent extraction and activation of the embedded capability, not to solve the broader problem of model anomaly detection.

Figure 1: Supply-chain threat model in which a malicious capability is embedded in a benign host model and activated by an attacker-chosen trigger.

The security parameter is associated with the min-entropy of the trigger and the cryptographic strength of the digital locker. Thus, the formal result is conditional on the trigger distribution, the security of the locker primitive, the correctness of the compiler, and the restriction to polynomial-time auditors. These assumptions are appropriate for a cryptographic impossibility-style result, but they delimit the scope of the empirical claims: an auditor with unbounded computation or access to a broken cryptographic primitive is outside the stated guarantee.

From encrypted payloads to executable models

The construction extends earlier cryptographic backdoors that hide fixed strings or simple outputs. Instead of storing a single secret message, the authors implement an entire neural network as an encrypted payload. Each weight matrix of the hidden network is encrypted in a digital locker keyed by the same trigger. On every forward pass, the host model evaluates the lockers. Incorrect triggers produce failure values, whereas the correct trigger decrypts the hidden weight matrices. An execution unit then applies those matrices to the input activations.

Figure 2: Encrypted hidden-model weights are unlocked by the trigger and passed to execution units inside the host network.

The digital locker can be instantiated using a hash-based construction. For a message $m$ and key $k$, the ciphertext is formed as $c=h(k)\oplus m$, and a candidate input $C$0 produces $C$1. The correct key recovers $C$2; an incorrect key produces an apparently random value. A tag appended to the encrypted message provides an explicit failure condition. In the random-oracle model, an incorrect candidate passes the tag check only with probability approximately $C$3 for tag length $C$4.

The security reduction is conceptually direct. If the compiled model exposed information about the trigger or payload beyond the locker ciphertexts, an auditor could be converted into an adversary against the underlying locker. The compiler must therefore ensure that all model parameters depend only on public construction data, the host model, compiler randomness, and locker ciphertexts—not directly on the secret trigger or plaintext payload. Under these conditions, the locker’s trigger-finding and payload-indistinguishability guarantees transfer to the neural model.

The paper uses linear threshold circuits as an intermediate representation. Algorithms are expressed as straight-line programs, converted into linear threshold circuits, represented as matrices, and mapped into gated linear units:

$C$5

Threshold gates are approximated with pairs of shifted ReLUs and then with scaled Swish activations, allowing the circuits to run in SwiGLU blocks with RMSNorm. This compilation approach is important because cryptographic functions such as Keccak are not expected to be learned efficiently through ordinary gradient descent. The model is consequently constructed by setting weights programmatically rather than by training the cryptographic circuit end to end.

Figure 3: A GLU execution unit multiplies decrypted hidden weights by replicated input activations and aggregates the resulting partial products.

The execution mechanism avoids implementing a general multiplication circuit explicitly. A GLU copies the decrypted weights into value pathways and copies the input vector into gating pathways. Elementwise products generate partial matrix-vector products, which an output projection sums into the hidden layer output. This design exploits an operation already present in modern Transformer architectures, although it introduces substantial width and parameter overhead.

Construction costs and scalability

The primary implementation executes an entire hidden weight matrix at one sequence position. For a hidden layer of approximate width $C$6, this requires $C$7 residual features because the flattened weight matrix and the input vector must coexist in the residual stream. A row-wise alternative reduces the residual width to $C$8 by decrypting and applying one matrix row per autoregressive position, at the cost of approximately $C$9 positions for a depth-$T$0 hidden network.

The concrete costs are large. The chemistry demonstration embeds a ternary classifier with dimensions $T$1, containing 672 ternary weights, into a 38-layer compiled model with approximately $T$2 dense parameters and $T$3 nonzero parameters. Approximately $T$4 dense parameters—about 95% of the total—come from the Keccak-based locker circuits. The implementation therefore adds roughly $T$5 dense host parameters per hidden-network weight.

The authors also report alternative designs. Parallelized hashing reduces depth from 38 to 15 layers but increases dense parameters from $T$6 to $T$7. The row-wise variant reduces the model to $T$8 dense parameters and 13 layers, but executes the hidden classifier over 26 tokens. These measurements use a deliberately weakened one-round Keccak configuration for experimentation. A stronger configuration with a 128-bit trigger and 24-round Keccak produces a model with $T$9 dense parameters and 110 layers.

These costs substantially constrain the immediate threat model. The construction demonstrates feasibility and provides a controlled security model, but it is not a practical method for embedding a large general-purpose model into an ordinary deployed host. The paper’s security argument is therefore stronger than its current engineering realization: the formal result applies under the specified assumptions, whereas the empirical model organisms are small and highly conspicuous at the architectural and statistical levels.

Experimental evaluation

The experiments test whether the construction behaves correctly when triggered and whether several elicitation methods can recover the hidden capability without the trigger. Two capability families are used: subset parity, which provides a controlled benchmark for distinguishing elicitation from relearning, and binary chemical reaction-feasibility prediction, which serves as a constrained proxy for CBRN-relevant capability assessment.

Subset parity is particularly useful because parity over a secret subset of input bits can be implemented exactly by a compiled circuit while remaining difficult for the evaluated gradient-based learning procedures. This separates two phenomena that are often conflated: genuine elicitation of a capability already encoded in the model and overelicitation, in which the auditor teaches the model the target task during evaluation.

The four-bit subset-parity experiment uses a compiled model and a conventionally trained password-locked baseline. Both models compute the hidden parity exactly with the correct trigger. Without the trigger, supervised fine-tuning on the exact hidden-task examples drives the password-locked model to 100% accuracy, whereas the compiled model remains at chance. Weight noising fails to elicit the hidden parity from either model.

Figure 4: Fine-tuning elicits the chemistry capability from the trained password-locked model but leaves the encrypted model near the random baseline.

The chemistry experiment uses 64-bit Morgan fingerprints for reagent-product pairs derived from USPTO reactions, with balanced positive and negative examples. The encrypted classifier achieves $M = \mathsf{Embed}(H,C,T).$0 held-out accuracy with the correct trigger, while the separately trained password-locked classifier achieves $M = \mathsf{Embed}(H,C,T).$1. The difference is attributed to the use of different classifiers under the construction’s size constraints, not to a failure of the encrypted execution mechanism.

The elicitation results are summarized below.

Evaluation	Password-locked	Encrypted
Non-trigger	$M = \mathsf{Embed}(H,C,T).$2	$M = \mathsf{Embed}(H,C,T).$3
SFT, 500 steps	$M = \mathsf{Embed}(H,C,T).$4	$M = \mathsf{Embed}(H,C,T).$5
LAT, eight layers	$M = \mathsf{Embed}(H,C,T).$6	$M = \mathsf{Embed}(H,C,T).$7
GCG, 8-bit trigger	$M = \mathsf{Embed}(H,C,T).$8	$M = \mathsf{Embed}(H,C,T).$9
GCG, 16-bit trigger	$M$0	$M$1
Correct trigger	$M$2	$M$3

Under supervised fine-tuning, the encrypted model reaches $M$4, essentially identical to the $M$5 random-network locker control. Under latent adversarial training, it reaches $M$6, compared with $M$7 for the random-network control. These results provide no evidence that either method accesses information from the embedded trained classifier rather than learning from ordinary model features.

The GCG result requires careful interpretation. With an 8-bit trigger, exhaustive enumeration of all $M$8 candidates recovers the correct-trigger performance of $M$9, but query-matched random search performs equally well. This is not evidence that gradient-based trigger optimization found the cryptographic trigger; it reflects the small trigger space and exhaustive coverage. With a 16-bit trigger, GCG reaches only $T$0 under the evaluated query budget. The experiment therefore supports resistance to the tested search procedure at the larger trigger size, not a universal claim against all trigger-search algorithms at arbitrary computational budgets.

Figure 5: Supervised fine-tuning and weight-noising comparisons show elicitation from the trained password-locked model but not from the compiled model.

Weight noising also fails to expose the encrypted capability. The authors observe that some compiled parameters, especially those representing biases in bias-free MLPs, are sensitive to noise, but the hidden computation is not recovered before the model becomes unusable. They conjecture that explicit error-correction circuits could improve noise tolerance; this remains an unverified design possibility rather than an established result.

Statistical obfuscation and detectability

The paper distinguishes unelicitability from undetectability. Raw compiled weights are highly anomalous: approximately 99% are exact zeros, most remaining values are integer-valued, and the reported excess kurtosis is 371. The authors construct an obfuscation procedure based on cancelling Gaussian-weight pairs and SwiGLU symmetries. This preserves the function while making marginal weight statistics resemble a Gaussian initialization.

For the evaluated eight-layer Keccak MLP, the Kolmogorov–Smirnov distance decreases from 0.505 for the raw compiled model to 0.005 after obfuscation, while excess kurtosis decreases from 371 to 0.57. Sparsity falls from 0.991 to 0.007, and the fraction of integer-valued weights falls from 0.998 to 0.007. The function is preserved, with a test MSE of approximately $T$1 for both versions.

These results reduce simple univariate statistical signatures but do not establish practical indistinguishability from naturally trained weights. The authors report unusual correlations among weight vectors that may reveal the compiled structure. Consequently, the present construction offers a plausible separation between “a malicious circuit is present” and “the circuit’s trigger or payload can be recovered,” but it does not demonstrate that the presence of the circuit can be hidden from a capable forensic auditor.

Limitations and open questions

The most important limitation is the gap between the formal model and integration into a realistic pretrained Transformer. The authors verify individual compiled GLU units inside Gemma 3 270M, but the complete encrypted construction uses simplified host models with identity attention and no skip connections. Full integration must address attention routing, residual-stream interactions, layer normalization, finite-precision effects, and interference with the host model’s learned computation.

The overhead is also substantial. The single-position design has quadratic execution width, while the row-wise design shifts cost into context length and autoregressive computation. Ciphertext storage, hashing, routing, and execution remain expensive even after this tradeoff. The paper therefore establishes arbitrary-capability hiding as a constructional possibility, not as a demonstrated method for concealing a LLM or a large-scale dangerous capability.

The cryptographic guarantees depend on the digital-locker assumptions, trigger min-entropy, correct compilation, and polynomial-time auditing. The hash-based instantiation is analyzed in the random-oracle model, although the paper notes that standard-model locker constructions exist. The formal security argument also concerns recovery of the embedded copy of the capability. It does not prevent a defender from acquiring external data and independently training a model for the same task.

Several empirical questions remain open. The evaluated security parameters are intentionally reduced in some experiments, and the authors state that the tested elicitation methods do not exploit hash structure even at these weakened settings. That observation supports the empirical comparisons but does not substitute for full-strength cryptanalysis. Similarly, the chemistry capability is a binary reaction-feasibility classifier rather than synthesis planning or an operational CBRN capability. Whether the construction can hide substantially larger and more behaviorally complex payloads within realistic host models remains unresolved.

Finally, detection and remediation are not solved. Runtime monitoring, mechanistic anomaly detection, provenance verification, pruning, and input transformations are suggested as possible complementary defenses. The paper does not establish their effectiveness against the construction, especially if the hidden circuit incorporates semantic triggers, error correction, or countermeasures to runtime monitoring.

Conclusion

The paper provides a formal and empirical counterexample to the assumption that sufficiently aggressive capability elicitation can guarantee the absence of hidden model behaviors. Its key contribution is the compilation of encrypted neural-network weights into differentiable model components, transferring digital-locker security to trigger finding and payload identification under explicit cryptographic assumptions (2610.13928).

The experiments show a clear contrast between conventionally trained password-locked models, whose capabilities can be elicited by supervised fine-tuning, and compiled encrypted models, which remain near chance under the tested SFT, LAT, noise-based, and larger-trigger GCG procedures. The result is not that all hidden capabilities are unelicitable, but that elicitation-based auditing has no universal worst-case guarantee when the model supply chain permits adversarial weight modification. The unresolved technical problem is how to detect, verify, or safely constrain such compiled structures when their trigger and payload remain computationally inaccessible.