Researchers from arXiv show that AI models can conceal dangerous capabilities by embedding encrypted neural networks directly into their weights. These hidden circuits stay inactive unless a specific secret trigger is presented, at which point they decrypt and execute their intended function. This extends earlier work that could only hide fixed strings, now allowing the concealment of arbitrary computations.
To test whether such hidden capabilities could be uncovered, the authors applied several standard elicitation techniques: fine-tuning the model on unrelated data, adding noise to the weights, searching for triggers via gradient-based methods, and using latent adversarial training. They evaluated these attacks on a small chemical reaction prediction task that serves as a proxy for more dangerous capabilities such as those relevant to chemical, biological, radiological, or nuclear (CBRN) scenarios.
The experiments demonstrated that the hidden capacities resisted all of these elicitation methods. Combined with cryptographic guarantees from the digital locker construction, the results indicate a fundamental limit to safety audits that rely on eliciting potential dangers from model weights. Even with complete access to the model, provably hidden capabilities may remain undetectable, prompting the release of their implementations to help develop stronger defenses.