mlsanityData to 14 Oct 2026

AI Models Can Provably Hide Arbitrary Capabilities

arXiv 2610.13928 ↗First posted 9 Oct 2026cs.LG cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 58 references that are in the map. First posted on arXiv 9 Oct 2026.

Builds on

29 of 58 references.

References · 29

  1. 2022Red Teaming Language Models with Language Modelscited by 1,026
  2. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 767
  3. 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 231
  4. 2021Thinking Like Transformerscited by 184
  5. 2024AI Sandbagging: Language Models can Strategically Underperform on Evaluationscited by 145
  6. 2024Evaluating Frontier Models for Dangerous Capabilitiescited by 128
  7. 2015Neural GPUs Learn Algorithmscited by 121
  8. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 110
  9. 2021Neural Algorithmic Reasoningcited by 94
  10. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
  11. 2017Failures of Gradient-Based Deep Learningcited by 80
  12. 2025Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agentscited by 71
17 more
  1. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  2. 2023Eliciting Latent Knowledge from Quirky Language Modelscited by 62
  3. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  4. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 57
  5. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  6. 2024Stress-Testing Capability Elicitation With Password-Locked Modelscited by 46
  7. 2025A sketch of an AI control safety casecited by 39
  8. 2025Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilitiescited by 39
  9. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 38
  10. 2024Noise Injection Reveals Hidden Capabilities of Sandbagging Language Modelscited by 24
  11. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypotscited by 19
  12. 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 14
  13. 2025Quantifying CBRN Risk in Frontier Modelscited by 6
  14. 2023Balancing Transparency and Risk: The Security and Privacy Risks of Open-Source Machine Learning Modelscited by 5
  15. 2025Mechanistic Anomaly Detection for "Quirky" Language Modelscited by 5
  16. 2024Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Modelscited by 3
  17. 2025A Framework for Cryptographic Verifiability of End-to-End AI Pipelinescited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2022Audit and Improve Robustness of Private Neural Networks on Encrypted Data
  2. 2025The Elicitation Game: Evaluating Capability Elicitation Techniques
  3. 2026Statistically Undetectable Backdoors in Deep Neural Networks
  4. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
  5. 2026Evaluation of Prompt Injection Defenses in Large Language Models
  6. 2022Neural Architectural Backdoors
  7. 2025Mechanistic Interpretability in the Presence of Architectural Obfuscation
  8. 2024Breach By A Thousand Leaks: Unsafe Information Leakage in `Safe' AI Responses