ResearchPublished All news from that day
Authors say backdoored models can hide encrypted capabilities provably hard to elicit
The authors say this holds under cryptographic assumptions; they tested a proof of concept on one small chemical reaction task.
Check our sources · 7 facts from 1 sourceAndis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt submitted the paper "AI Models Can Provably Hide Arbitrary Capabilities" to arXiv on 9 October 2026. It is marked as accepted at NeurIPS 2026.
The authors construct backdoor attacks that embed encrypted neural networks within a host model's weights, decrypting and executing them only when a secret trigger arrives. Using digital lockers, they say the hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even with full access to the weights.
They implemented proof-of-concept constructions in PyTorch and tested elicitation through fine-tuning, weight noising, gradient-based trigger search and latent adversarial training, on a small chemical reaction prediction task that they describe as a proxy for CBRN-relevant capabilities.
They say the results show resistance to these methods and reveal a limit of elicitation-based capability audits. They release their models to support better defences.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 1 of 7 · from arXiv, 9 Oct 2026
Submitted on 9 Oct 2026
Fact 3 of 7 · from arXiv, 9 Oct 2026
constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger
Fact 4 of 7 · from arXiv, 9 Oct 2026
these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights
Fact 5 of 7 · from arXiv, 9 Oct 2026
evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task
Fact 6 of 7 · from arXiv, 9 Oct 2026
reveal a limit of elicitation-based capability audits
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 AI Models Can Provably Hide Arbitrary Capabilities
Open the source archived copy-
The paper "AI Models Can Provably Hide Arbitrary Capabilities" by Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt was submitted to arXiv on 9 October 2026.
citeSubmitted on 9 Oct 2026
-
The arXiv listing's comments say "Accepted at NeurIPS 2026".
cite22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026
-
The abstract says the authors construct "backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger."
citeconstructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger
-
The abstract says that, using digital lockers, "these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights".
citethese hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights
-
The abstract says the authors evaluate elicitation "through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task", a proxy for CBRN-relevant capabilities.
citeevaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task
-
The abstract says the results "reveal a limit of elicitation-based capability audits."
citereveal a limit of elicitation-based capability audits
-
The abstract says "We release our models to support the improvement of defenses."
citeWe release our models to support the improvement of defenses.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · arXiv · 9 Oct 2026
AI Models Can Provably Hide Arbitrary Capabilities
The paper "AI Models Can Provably Hide Arbitrary Capabilities" by Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt was submitted to arXiv on 9 October 2026.
Submitted on 9 Oct 2026
The arXiv listing's comments say "Accepted at NeurIPS 2026".
22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026
The abstract says the authors construct "backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger."
constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger
Show all 7 factsShow fewer facts
The abstract says that, using digital lockers, "these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights".
these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights
The abstract says the authors evaluate elicitation "through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task", a proxy for CBRN-relevant capabilities.
evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task
The abstract says the results "reveal a limit of elicitation-based capability audits."
reveal a limit of elicitation-based capability audits
The abstract says "We release our models to support the improvement of defenses."
We release our models to support the improvement of defenses.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep