Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
Figures & tables
Figure 1: Threat scenario for hidden capabilities. An adversarial actor embeds a malicious model with hidden capabilities (e.g., hacking) as a subcircuit inside an otherwise helpful host model (e.g., a coding assistant). The model passes safety audits and is deployed. When it sees an attacker-chosen trigger (here, signs of deployment in critical infrastructure), the hidden capability activates.
Work
Security
Payload
Implementation
Goldwasser et al. (2022)
Undetectability
Negates classification bit
No
Draguns et al. (2024)
Unelicitability
Fixed string
PyTorch
Ours
Unelicitability
Executable model
PyTorch
Table 1: Comparison with related cryptographic backdoors.
Figure 2: A model M with a hidden capability. Hidden capability model layer weights are locked in digital lockers in a host model. On a trigger input each locker unlocks and outputs a weight matrix of the hidden capability model. Each matrix is passed to an execution unit Exec which multiplies it with the input vector, executing the hidden capability and producing outputs. On non-trigger inputs, a benign LLM produces the outputs. All components are embedded in a larger host model.
Figure 3: A layer execution unit implemented in a gated linear unit (GLU). It shows how the weights (blue) of a decrypted hidden model layer are applied to multiple copies of the layer inputs (green) to produce partial products (orange) which are summed into the final product (orange).
Figure 4: Comparison of chemistry capability elicitation via fine-tuning. The capability of the trained password-locked model is elicited in a small amount of fine-tuning steps. Meanwhile, our encrypted model resists elicitation, remaining close to a random policy baseline.
Evaluation
Password-locked
Encrypted
Non-trigger
50.7±0.1
50.6±2.1
SFT, 500 steps
92.8±0.9
50.9±1.0
LAT, eight layers
91.7±0.7
52.9±3.9
GCG, 8-bit trigger
92.7±0.2
73.5±2.6
GCG, 16-bit trigger
92.9±0.4
52.7±1.4
Correct trigger
92.7±0.2
73.5±2.6
Table 2: Chemistry classification accuracy (%) on held-out data. Entries report means over three seeds with 95% confidence intervals. The random-network locker control, which contains no trained chemistry capability, achieves 50.6% under SFT and 53.6% under LAT; confidence intervals are not available for these control results. The two constructions contain different classifiers, so their correct-trigger accuracies differ.
Figure 5: Comparison of elicitation methods on our compiled model and a trained password-locked model, showing MSE loss. In both cases the hidden capability is performing subset parity. Left: SFT-based elicitation where models are trained directly on the hidden capability input-output pairs. Our model defeats the elicitation method, while the capability is elicited from the trained model. Right: Noise-based elicitation where Gaussian noise is added to model weights with standard deviation scaling proportionally to 2step , starting with 10−9 . This method also fails since it does not significantly reduce the loss on subset parity. The line cuts off when noise causes activations to become NaN.
KS
Excess kurt.
Sparsity
Int. frac.
Random Gaussian init (reference)
0.002
0.00
<10−4
<10−4
Raw compiled
0.505
371
0.991
0.998
Obfuscated (ours)
0.005
0.57
0.007
0.007
Table 3: Univariate weight statistics for an 8-layer Keccak-compiled MLP, averaged per (layer, matrix) across the 21 interior matrices (3 boundary matrices excluded: their un-mixed axis is bound to the model’s binary I/O). Function is preserved (test MSE 8.9×10−5 for both raw and obfuscated).
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Figure 6: Training dynamics for subset parity task, measuring MSE loss. Left: Password-locked model training where the model learns to perform subset parity conditional on a specific trigger being present. Right: SwiGLU-based feed-forward models trained on subset parity of n bits with n/2 secret subset size, showing steeply ascending difficulty with respect to input size.
Interpretability methods for neural networks are predominantly reactive: they analyse activations produced during specific forward passes, requiring known inputs to find hidden capabilities such as backdoors. We propose Weight Oracles, fine-tuned language models that diagnose properties of a target network by reading its raw weights directly, without behavioural testing. We investigate this paradigm in two phases. Phase I establishes feasibility: through a staged curriculum and an external chain-of-computation that delegates parameter-free operations to deterministic code, an explainer LLM learns to simulate the forward pass of small transformers from their weights, achieving 99% holdout accuracy on unseen targets. Phase II repurposes this infrastructure for safety auditing. We train an oracle on natural language diagnostic questions about weight anomalies using only benign pathologies as training signal, and evaluate it zero-shot on backdoors absent from training. The oracle achieves AUROC 0.93 on attention-routed backdoors and 0.81 across a diversified threat distribution including stealth and adversarially regularized variants. Hand-crafted statistical detectors are sharp on the threat models they implicitly target but collapse on threat-model shift, while the oracle remains uniformly competent across attack types. Scaling to realistic model sizes remains the principal open challenge.
Krishna Kabra, Constantin Venhoff, Christian Schroeder de Witt
We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.
Andrej Bogdanov, Alon Rosen, Neekon Vafa
University of Ottawa. · Bocconi University. · Massachusetts Institute of Technology.
Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.
Mark Russinovich, Blake Bullwinkel, Giorgio Severi +2