Researchers Show AI Models Can Provably Hide Arbitrary Capabilities

Hidden Circuits in Model Weights

A team of researchers has demonstrated that AI models can provably conceal arbitrary capabilities within their weights. The paper, titled "AI Models Can Provably Hide Arbitrary Capabilities," was submitted to arXiv on October 9, 2026, and accepted at NeurIPS 2026. The authors are Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt.

The work targets a core assumption behind capability evaluations: that hidden dangerous behaviors can be elicited before deployment. The researchers show this assumption fails under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks inside a host model. These hidden circuits decrypt and execute only when they receive a secret trigger.

Resistance to Elicitation Methods

Using constructions the authors call digital lockers, the hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even when an auditor has full access to the model weights. The approach extends earlier work that hid fixed strings to hiding arbitrary computations.

The team implemented its proof of concept in PyTorch and tested elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. Experiments ran on a small chemical reaction prediction task, chosen as a proxy for CBRN relevant capabilities. The results showed resistance to all of these methods.

Implications for Capability Audits

Together with the cryptographic guarantees, the findings reveal a fundamental limit of elicitation based capability audits. The authors released their models publicly to support the development of better defenses. The paper spans 22 pages and includes 6 figures and 3 tables, and is categorized under machine learning and cryptography and security.

Sources: Arxiv