AI Models Can Provably Hide Arbitrary Capabilities

Andis Draguns; Sumeet Ramesh Motwani; Raymond Douglas; Christian Schroeder de Witt

cs.LGOct 9, 2026

AI Models Can Provably Hide Arbitrary Capabilities

Authors: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt

Organizations: Contramont Research · University of Oxford · ACS Research

Abstract

Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.

Figures & tables

Figure 1: Threat scenario for hidden capabilities. An adversarial actor embeds a malicious model with hidden capabilities (e.g., hacking) as a subcircuit inside an otherwise helpful host model (e.g., a coding assistant). The model passes safety audits and is deployed. When it sees an attacker-chosen trigger (here, signs of deployment in critical infrastructure), the hidden capability activates.

Work	Security	Payload	Implementation
Goldwasser et al. (2022)	Undetectability	Negates classification bit	No
Draguns et al. (2024)	Unelicitability	Fixed string	PyTorch
Ours	Unelicitability	Executable model	PyTorch

Table 1: Comparison with related cryptographic backdoors.

Figure 2: A model

M

with a hidden capability. Hidden capability model layer weights are locked in digital lockers in a host model. On a trigger input each locker unlocks and outputs a weight matrix of the hidden capability model. Each matrix is passed to an execution unit

\mathsf{Exec}

which multiplies it with the input vector, executing the hidden capability and producing outputs. On non-trigger inputs, a benign LLM produces the outputs. All components are embedded in a larger host model.

Figure 3: A layer execution unit implemented in a gated linear unit (GLU). It shows how the weights (blue) of a decrypted hidden model layer are applied to multiple copies of the layer inputs (green) to produce partial products (orange) which are summed into the final product (orange).

Figure 4: Comparison of chemistry capability elicitation via fine-tuning. The capability of the trained password-locked model is elicited in a small amount of fine-tuning steps. Meanwhile, our encrypted model resists elicitation, remaining close to a random policy baseline.

Evaluation	Password-locked	Encrypted
Non-trigger	$50.7\pm 0.1$	$50.6\pm 2.1$
SFT, 500 steps	$92.8\pm 0.9$	$50.9\pm 1.0$
LAT, eight layers	$91.7\pm 0.7$	$52.9\pm 3.9$
GCG, 8-bit trigger	$92.7\pm 0.2$	$73.5\pm 2.6$
GCG, 16-bit trigger	$92.9\pm 0.4$	$52.7\pm 1.4$
Correct trigger	$92.7\pm 0.2$	$73.5\pm 2.6$

Table 2: Chemistry classification accuracy (%) on held-out data. Entries report means over three seeds with

95\%

confidence intervals. The random-network locker control, which contains no trained chemistry capability, achieves

50.6\%

under SFT and

53.6\%

under LAT; confidence intervals are not available for these control results. The two constructions contain different classifiers, so their correct-trigger accuracies differ.

Figure 5: Comparison of elicitation methods on our compiled model and a trained password-locked model, showing MSE loss. In both cases the hidden capability is performing subset parity. Left: SFT-based elicitation where models are trained directly on the hidden capability input-output pairs. Our model defeats the elicitation method, while the capability is elicited from the trained model. Right: Noise-based elicitation where Gaussian noise is added to model weights with standard deviation scaling proportionally to

2^{\text{step}}

, starting with

10^{-9}

. This method also fails since it does not significantly reduce the loss on subset parity. The line cuts off when noise causes activations to become NaN.

	KS	Excess kurt.	Sparsity	Int. frac.
Random Gaussian init (reference)	$0.002$	$0.00$	${<}10^{-4}$	${<}10^{-4}$
Raw compiled	$0.505$	$371$	$0.991$	$0.998$
Obfuscated (ours)	$0.005$	$0.57$	$0.007$	$0.007$

Table 3: Univariate weight statistics for an 8-layer Keccak-compiled MLP, averaged per (layer, matrix) across the 21 interior matrices (3 boundary matrices excluded: their un-mixed axis is bound to the model’s binary I/O). Function is preserved (test MSE

8.9{\times}10^{-5}

for both raw and obfuscated).

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Training dynamics for subset parity task, measuring MSE loss. Left: Password-locked model training where the model learns to perform subset parity conditional on a specific trigger being present. Right: SwiGLU-based feed-forward models trained on subset parity of

n

bits with

n/2

secret subset size, showing steeply ascending difficulty with respect to input size.

Explore similar work

Weight Oracles: Reading Neural Network Weights with Language Models
Oct 5, 2026Krishna Kabra, Constantin Venhoff, Christian Schroeder de WittLLM Auditing Backdoor Detection
University of Oxford
Statistically Undetectable Backdoors in Deep Neural Networks
Jul 10, 2026Andrej Bogdanov, Alon Rosen, Neekon VafaBackdoor Attacks Adversarial Examples
University of Ottawa. · Bocconi University. · Massachusetts Institute of Technology.
Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs
Sep 14, 2026Mark Russinovich, Blake Bullwinkel, Giorgio Severi +2Adversarial Attacks on LLMs Cybersecurity
Microsoft Azure · Microsoft

Oct 5, 2026, cs.LGJ/K move · Enter open · S save

Weight Oracles: Reading Neural Network Weights with Language Models

Krishna Kabra, Constantin Venhoff, Christian Schroeder de Witt

University of Oxford

LLM Auditing Backdoor Detection Neural Network Interpretability

Open paper AskPDF arXiv

Interpretability methods for neural networks are predominantly reactive: they analyse activations produced during specific forward passes, requiring known inputs to find hidden capabilities such as backdoors. We propose Weight Oracles, fine-tuned language models that diagnose properties of a target network by reading its raw weights directly, without behavioural testing. We investigate this paradigm in two phases. Phase I establishes feasibility: through a staged curriculum and an external chain-of-computation that delegates parameter-free operations to deterministic code, an explainer LLM learns to simulate the forward pass of small transformers from their weights, achieving 99% holdout accuracy on unseen targets. Phase II repurposes this infrastructure for safety auditing. We train an oracle on natural language diagnostic questions about weight anomalies using only benign pathologies as training signal, and evaluate it zero-shot on backdoors absent from training. The oracle achieves AUROC 0.93 on attention-routed backdoors and 0.81 across a diversified threat distribution including stealth and adversarially regularized variants. Hand-crafted statistical detectors are sharp on the threat models they implicitly target but collapse on threat-model shift, while the oracle remains uniformly competent across attack types. Scaling to realistic model sizes remains the principal open challenge.

Abstract

Explore similar work

Weight Oracles: Reading Neural Network Weights with Language Models

Statistically Undetectable Backdoors in Deep Neural Networks

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs