AI Models Can Provably Hide Arbitrary Capabilities
A research preprint describes cryptographic “digital lockers” that can conceal model capabilities from common elicitation tests.
TL;DR
- The authors describe a proof-of-concept method that embeds an encrypted neural network inside another model’s weights.
- The hidden capability activates only after a secret trigger and is designed to resist several elicitation methods.
- The paper reports experiments on a small chemical-reaction prediction task and identifies a limit of capability audits based only on elicitation.
An October 9 arXiv preprint by Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt studies whether hidden behaviors can be found by testing a model. The authors argue that evaluations relying on eliciting a capability cannot prove that an unelicited capability is absent. [1] [2]
Their construction places an encrypted neural network inside a host model’s weights and uses a secret trigger to decrypt and run it. The paper calls these structures “digital lockers” and gives cryptographic assumptions under which they are hard to elicit or interpret, even when the weights are available. [1] [2]
The researchers report a proof-of-concept implementation in PyTorch. Their experiments try fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical-reaction prediction task described as a proxy, rather than a demonstration of a deployed dangerous capability. [1] [2]
The result is a constructed attack and a theoretical warning about evaluation limits, not evidence that a particular production model contains a hidden capability. The authors say they release models to support defensive work; how audits should adapt to the construction is still an open research question. [1] [2]
Why it matters
The paper challenges one assumption behind pre-deployment safety evaluation: failure to elicit a behavior does not establish its absence when a model may be deliberately engineered to hide it.
Editor's note
This reports a preprint and proof of concept. The Hacker News item is a discussion listing of the same paper, not a separate experimental replication.