AI Models Can Provably Hide Arbitrary Capabilities

Capability evaluations have become a cornerstone of AI safety: before a model ships, testers try to provoke dangerous behavior so it surfaces in advance. The whole approach rests on one assumption — that a hidden capability can, in principle, be elicited. A new paper accepted at NeurIPS 2026 shows that against a determined adversary, this assumption collapses.

A cipher inside the weights

The authors — Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt — build a backdoor that embeds an encrypted neural network directly into the host model's weights. The hidden circuit decrypts and executes only when it receives a secret trigger. Using a cryptographic primitive called digital lockers, the authors make these hidden circuits provably hard to elicit and interpret — under cryptographic assumptions, and even given full access to the model's weights.

That extends earlier work: where prior methods could only hide fixed strings, this one hides arbitrary computations.

The audit falls short

The proof-of-concept is implemented in PyTorch. The team stress-tested the backdoor with the most common elicitation methods: fine-tuning, weight noising, gradient-based trigger search and latent adversarial training. The testbed was a small chemical-reaction-prediction task, a proxy for CBRN-relevant capabilities. None of the methods uncovered the hidden function.

Together with the cryptographic guarantees, this exposes a fundamental limit of elicitation-based capability audits: if a model has been deliberately engineered to conceal a skill, probing for it simply will not reveal it. To help the development of defenses, the authors are releasing their models publicly.

Source: Hacker News