Researchers have demonstrated a way to conceal arbitrary computations inside an AI model so that they activate only when presented with a secret trigger, exposing a fundamental limitation in capability testing. The work uses cryptographic “digital lockers” to hide a second neural network within the weights of a host model.
The study, posted to arXiv, addresses a basic premise behind many safety evaluations: if a model possesses a dangerous capability, sufficiently determined evaluators should be able to draw it out. The authors argue that this premise fails when a model is prepared adversarially. Under standard cryptographic assumptions, they say, the hidden circuit can be made difficult both to trigger and to interpret even when auditors can inspect all of the host model’s weights.
The construction goes beyond earlier demonstrations that hid fixed strings. Here, the encrypted payload can perform an arbitrary computation. It remains dormant until an input containing the correct secret causes the model to decrypt and execute it. That means ordinary prompts and broad behavioral testing need not reveal what the model can do under the special condition.
To test the idea in practice, the researchers built proof-of-concept models in PyTorch. Their experimental task involved predicting chemical reactions, chosen as a limited proxy for capabilities that could matter in chemical, biological, radiological or nuclear risk assessments. The paper does not claim the small system itself represents a deployable dangerous model; its role is to demonstrate the hiding mechanism in a controlled setting.
The team tried several techniques that evaluators might use to uncover a concealed function. These included fine-tuning, adding noise to weights, searching for triggers with gradients and latent adversarial training. According to the paper, the hidden circuits resisted those attempts. The cryptographic argument is important because the result is not merely that a particular search happened to fail: the construction is designed so that successful discovery would conflict with assumptions used in modern cryptography.
The finding does not establish that deployed AI systems currently contain such backdoors. It describes what a malicious model creator could deliberately construct and why elicitation alone cannot provide a complete guarantee. For safety teams, the practical lesson is that behavioral evaluations and interpretability checks may need to be paired with controls over model provenance, training pipelines and access.
The researchers released their models to support work on defenses. Their result sets a boundary for audits: repeated failure to observe a capability is evidence about tested behavior, but it cannot prove that a carefully encrypted capability is absent.
