AI Models Can Provably Hide Arbitrary Capabilities, Undermining Safety Audits
Capability evaluations assume hidden model behaviors can always be elicited before deployment. This paper disproves that assumption under adversarial conditions: the authors embed encrypted neural networks inside host model weights using digital lockers, decrypting and running them only when a secret trigger fires. Under cryptographic assumptions, these hidden circuits stay provably hard to elicit or interpret even with full weight access. Tested in PyTorch against fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a chemical reaction prediction task, they resist every method, exposing a fundamental limit of elicitation-based audits.
We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.