[论文] AI Models Can Provably Hide Arbitrary Capabilities

论文概要

研究领域: ML
作者: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt
发布时间: 2026-10-09
arXiv: 2610.13928

中文摘要

能力评估旨在部署前暴露危险模型行为，但其可靠性依赖于「隐藏能力可被引出」这一假设。我们证明在对抗条件下该假设不成立：通过构造后门攻击，将加密神经网络嵌入宿主模型权重中，仅在收到秘密触发器时解密并执行。利用数字锁柜（digital lockers），这些隐藏电路在密码学假设下可证明地难以引出和解释——即使完全访问模型权重——将此前「隐藏固定字符串」的工作扩展到任意计算。我们在 PyTorch 中实现了概念验证构造，并通过微调、权重加噪、基于梯度的触发器搜索和潜在对抗训练在小规模化学反应预测任务（CBRN 相关能力的代理）上评估引出难度。结果表明对上述方法具有抗性；结合密码学保证，揭示了基于引出的能力审计的根本局限。我们公开模型以支持防御研究。

原文摘要

Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and l...

自动采集于 2026-10-13

#论文 #arXiv #ML #小凯