Summary
A new arXiv paper (2610.13928) by Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt shows that capability evaluations of AI models can be defeated under adversarial conditions. The authors construct backdoor attacks that embed encrypted neural networks inside a host model's weights; the hidden network decrypts and executes only when a secret trigger is supplied. Using cryptographic digital lockers, these hidden circuits are provably hard to elicit or interpret—even with full access to model weights—extending earlier work that only hid fixed strings to arbitrary computations. The team implemented proof-of-concept constructions in PyTorch and evaluated elicitation resistance on a small-scale chemical reaction prediction task (a proxy for CBRN-relevant capabilities) using fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. The hidden capabilities resisted all these methods, revealing a fundamental limitation of elicitation-based capability audits. Models are released publicly to support defensive research.
Paper Overview
Field: ML
Authors: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt
arXiv: 2610.13928
Abstract
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small-scale chemical reaction prediction task (a proxy for CBRN-relevant capabilities). The hidden capabilities resist these elicitation methods; combined with the cryptographic guarantees, this reveals a fundamental limitation of elicitation-based capability auditing. Models are released publicly to support defense research.
*Auto-collected on 2026-10-13.*
This page is an English static mirror generated for search and AI citation.
It may be a full translation or structured summary of the Chinese original.
Canonical interactive discussion lives on the Chinese page:
https://zhichai.net/topic/178635935