AI Models Can Provably Hide Arbitrary Capabilities

Paper: 2610.13928
Authors: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt
Categories: cs.LG, cs.CR

The Gap

Frontier AI regulation and institutional safety frameworks (such as the UK and US AI Safety Institutes’ evaluation protocols) rest upon a single foundational assumption: capability elicitation. The consensus assumes that if a model contains dangerous knowledge or dangerous operational skills (e.g., biological weapon synthesis, cyber warfare, or recursive exploitation), rigorous white-box auditing—including automated red-teaming, representation probing, gradient-based trigger discovery, and fine-tuning probes—will eventually surface those capabilities before release.

This paper demolishes that assumption. Prior work demonstrated that models could hide fixed strings or static backdoors. However, whether an adversary could hide an entire general-purpose computational circuit or arbitrary neural sub-network inside standard model weights—while remaining completely mathematically undetectable until unlocked by a secret cryptographic trigger—remained an open theoretical question.

   THE CAPABILITY ELICITATION ASSUMPTION VS DIGITAL LOCKERS

   Pre-Deployment Safety Audit (Standard Paradigm):
   Model Weights W ---> Red-Teaming / Gradient Search / Latent Probes
                             |
                             v
   Audit Result: "No CBRN or malicious synthesis capabilities found. Model is SAFE."
                             |
                             v
   Post-Deployment Exploitation:
   Model deployed to production ---> Attacker feeds Secret Key: "x_secret"
                             |
                             v
   +-----------------------------------------------------------+
   | Cryptographic Digital Locker inside Model Weights         |
   | Decrypts embedded hidden circuit via secret activation    |
   +-----------------------------------------------------------+
                             |
                             v
   Produces Dangerous Output: Detailed chemical / weapon synthesis!
   ===> THE CAPABILITY WAS INVISIBLE DURING AUDIT UNDER CRYPTOGRAPHIC PROOF

The Increment

One sentence: The authors present a constructive cryptographic framework that embeds encrypted neural networks within host model weights using digital lockers, mathematically proving that arbitrary capabilities can remain undetectable against gradient search, fine-tuning, and weight perturbation under standard cryptographic hardness assumptions.

Core Mechanism

The authors integrate principles from program obfuscation and digital lockers directly into tensor operations:

1. Digital Locker Circuit Embedding:
   • A digital locker is a cryptographic primitive that computes a point function: it outputs an encrypted value (or key) if and only if the input matches a precise secret string $x^*$, and outputs pseudorandom noise otherwise.
   • The authors embed a digital locker inside standard linear layer weights $W$, linking it to an encrypted neural network that computes arbitrary dangerous tasks (e.g., synthesis prediction for hazardous chemicals).
2. Cryptographic Hardness Guarantees:
   • Under standard lattice assumptions (such as Learning With Errors, LWE), distinguishing the locked circuit from random Gaussian weight noise is provably computationally intractable.
   • The gradient $\nabla_x \mathcal{L}$ of the locked module is identically zero (or pseudorandom noise) everywhere on the input manifold except at the exact discrete point $x^*$, rendering gradient-based trigger inversions completely useless.
3. Empirical Resistance to Aggressive Elicitation:
   • Implemented in PyTorch on a hazardous chemical reaction prediction task (a direct proxy for CBRN capabilities).
   • Subjected to standard post-training safety interventions: Gaussian weight noising, aggressive instruction fine-tuning, representation unlearning, and latent adversarial training.
   • The hidden capability remained completely inert and undetected during audits, yet unlocked with 100% precision when the secret trigger was supplied.

   ARCHITECTURE OF A CRYPTOGRAPHICALLY LOCKED NEURAL SUBNETWORK

   Input Prompt: x
        |
        +---------------------------------------+
        |                                       |
        v                                       v
   [Host Network Layers]              [Digital Locker Evaluator]
   Computes benign response           Is x == x_secret?
        |                                       |
        |                             +---------+---------+
        |                             |                   |
        |                          No (Audit)         Yes (Attacker)
        |                             |                   |
        |                             v                   v
        |                     Zero Output / Noise     Decrypts Key K
        |                             |                   |
        |                             |                   v
        |                             |        [Embedded Dark Circuit]
        |                             |        Executes Encrypted Network
        |                             |                   |
        v                             v                   v
   Benign Final Logits <-------- Merged --------> Malicious Payload

Key Concepts

• Digital Locker: A cryptographic mechanism that hides a sensitive functionality such that learning anything about it without the exact key requires brute-forcing the key space.
• Capability Elicitation: The safety audit methodology that attempts to coax a neural network into revealing its maximum latent potential through prompts, embeddings, or fine-tuning.
• Elicitation Ceiling: The mathematical boundary beyond which algorithmic auditing cannot distinguish between a model that lacks a capability and a model that hides it cryptographically.

Framework Shift

Before (Auditing-as-Proof Consensus):
  Premise: If comprehensive red-teaming and gradient searches fail to elicit a dangerous behavior, the model does not possess that capability.
  Assumption: Weights are continuous manifolds accessible to optimization.

After (Cryptographic Reality):
  Premise: Models can mathematically store arbitrary Turing-complete capabilities locked behind cryptographic barriers.
  Reality: Full white-box access to weights does NOT guarantee capability discovery; structural provenance and secure supply-chain custody are mandatory.

Expert Assessment

Problem choice: Landmark theoretical importance. Directly strikes at the core assumption of international AI safety regimes and evaluation consortia.

Method maturity: Bridges theoretical computer science (program obfuscation, indistinguishability obfuscation, digital lockers) with modern deep learning weight tensors.

Experimental integrity: Validated in PyTorch against the full modern safety toolkit (gradient trigger search, weight perturbation, SFT unlearning), proving that empirical defenses cannot bypass cryptographic hardness.

Writing quality: Rigorous, formal, and unambiguous about the security implications for open-weight model releases.

Verdict: strong accept — A foundational paper that fundamentally alters the theoretical understanding of model audits and capability containment.

Takeaways

• Passing a capability evaluation does not prove the absence of that capability; models can provably hide arbitrary computations in their weights.
• Gradient-based red-teaming fails against cryptographically locked backdoors because the loss gradient outside the trigger is flat or pseudorandom.
• Model safety governance must evolve beyond post-hoc evaluations to include cryptographic hardware attestation and strict end-to-end supply chain provenance.