Paper shows backdoored AI models can hide capabilities from elicitation-based audits

Andis Draguns et al. publish a backdoor attack that embeds encrypted neural networks in a host model's weights and runs them only when a secret trigger is received.

The authors say that, under cryptographic assumptions and using digital lockers, the hidden circuits stay provably hard to elicit or interpret even with full access to the weights. The paper extends earlier work that hid fixed strings to hiding arbitrary computations.

The team tested fine-tuning, weight noising, gradient-based trigger search and latent adversarial training on a small chemical reaction prediction task, which they present as a proxy for CBRN-relevant capabilities. The models resisted these methods. The authors release the models to support work on defenses.