Researchers show AI models can provably hide arbitrary capabilities from audits

Researchers show that backdoor attacks can embed encrypted neural networks in model weights and run them only when a secret trigger is received.

Under cryptographic assumptions, the hidden circuits remain hard to elicit or interpret even with full weight access.

The team tested fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task, a proxy for CBRN-relevant capabilities.

The models resisted these methods, and the team released them to support defense research.