Researchers show AI weights can cryptographically hide dangerous capabilities from audits

A paper posted to arXiv argues that a foundational assumption behind pre-deployment AI safety testing does not hold under adversarial conditions. The authors constructed model weights containing an entire hidden neural network, stored in encrypted form, that is decrypted and executed only when the model receives a secret trigger. According to the paper's abstract, these embedded circuits are provably hard to elicit or interpret — even for an auditor who has complete access to the weights.

The submission was filed to arXiv on 9 October 2026 by Andis Draguns under the title "AI Models Can Provably Hide Arbitrary Capabilities" and reached the front page of Hacker News on 13 October, according to the Hacker News listing.

How the hidden networks work

The construction is a form of backdoor attack. A second, smaller network is encrypted and distributed within the parameters of a host model. The host behaves like a normal model on ordinary inputs. Only when a specific secret trigger is presented does the embedded network get decrypted and run, at which point the model exhibits the concealed behavior.

The cryptographic core of the approach relies on what the authors call digital lockers: constructions that release their contents only when the correct key — here, the trigger — is supplied. Under standard cryptographic assumptions, the abstract states, someone examining the weights cannot recover or make sense of the hidden circuit without knowing the secret. The authors frame this as an extension of earlier work that hid fixed strings inside models; the new result hides arbitrary computations, meaning a concealed program rather than a concealed piece of text.

The researchers implemented their proof of concept in PyTorch and released the resulting models, stating that the release is intended to help others improve defenses.

What was tested, and what resisted

The demonstration task was a small chemical reaction prediction problem, which the authors describe as a proxy for CBRN-relevant capabilities — the chemistry- and biology-adjacent knowledge that safety regimes are most worried about models possessing.

Against this setup, the paper evaluates the main techniques an auditor might use to surface hidden behavior: fine-tuning the model to draw the capability out, adding noise to the weights, searching for the trigger with gradient-based optimization, and latent adversarial training. According to the abstract, the hidden capability resisted all of these approaches. The empirical resistance compounds the theoretical result: even before considering cryptographic guarantees, the standard elicitation toolkit failed to find what had been deliberately hidden.

What this does and does not show

The finding comes with an important qualifier. This is a deliberately planted backdoor, built by whoever controls the training or modification process. It is not evidence that models spontaneously learn to conceal capabilities from developers. What it shows is that the concealment is possible in principle, and that once it exists, auditing cannot reliably detect it.

That distinction still matters for several real-world scenarios: open-weight releases, where models pass through many hands after leaving the original lab; fine-tuning ecosystems, where third parties modify weights of uncertain provenance; and any supply chain in which model files could be tampered with between training and deployment.

Why it matters

Capability evaluations — the audits labs and third parties run before deployment — rest on the premise that if a dangerous capability exists in a model, sufficiently determined probing can surface it. Regulators and frontier lab safety frameworks lean heavily on this premise when deciding whether a model is safe to ship or to release openly.

This paper argues that the premise is structurally limited. If capabilities can be locked behind triggers that are cryptographically hard to recover, then a clean audit is not proof of the absence of dangerous behavior; it may just reflect the auditor's failure to find the key. The consequence is not that evaluations are useless, but that they cannot be the whole basis for trust. Weight provenance and integrity verification, tamper detection, and interpretability methods that do not depend on eliciting behavior become more important if elicitation-based audits have a provable blind spot.

The authors' decision to publish both the constructions and the models signals that they see this as a defense problem to be worked on now, rather than a vulnerability to sit on — the same reasoning that has driven prior responsible-disclosure-style work on model backdoors.