Hiding capabilities in AI models

The study "AI Models Can Provably Hide Arbitrary Capabilities" proposes that an encrypted neural network backdoor can be embedded in model weights, decrypting and executing only upon receiving a secret trigger, making the hidden capability provably difficult to elicit and explain under cryptographic assumptions, even with full possession of the model weights. The paper implements a proof of concept in PyTorch, using a small chemical reaction prediction task as a proxy for CBRN-related capabilities, and tests elicitation methods including fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training; the results show the model is resistant to these methods. The authors state that this work extends prior research on hiding fixed strings to arbitrary computation, reveals limitations of elicitation-based capability auditing, and releases the model to support defensive improvements. Bruce Schneier relayed the study on his blog.