The paper titled “AI Models Can Provably Hide Arbitrary Capabilities” was submitted to arXiv on 9 October 2026. It addresses a core assumption in safety evaluations: that dangerous model behaviors can be elicited through techniques such as fine‑tuning or adversarial training. The authors argue this assumption fails when an adversary embeds hidden capabilities that are cryptographically protected.
To demonstrate, the researchers construct backdoor attacks that insert encrypted neural networks into the weights of a host model. These hidden circuits are locked using digital lockers, a cryptographic construct that ensures the embedded network remains inaccessible without a specific secret trigger. When the trigger is presented, the locker decrypts the network and it executes arbitrary computations.
This approach extends prior work that could only hide fixed strings or simple patterns. By using encryption, the method allows the concealment of any computable function, dramatically broadening the scope of what can be hidden inside a model.
A proof‑of‑concept is implemented in PyTorch. The authors test the construction on a small chemical reaction prediction task, which they treat as a proxy for CBRN‑relevant capabilities. The choice of a modest task enables controlled experimentation while still illustrating the principle that hidden capabilities need not be trivial.
Elicitation resistance is evaluated through four strategies: standard fine‑tuning on the task data, addition of random noise to the model weights, gradient‑based search for the trigger, and latent adversarial training designed to uncover hidden behaviors. According to the paper, none of these methods succeeded in reliably revealing the encrypted network.
Complementing the empirical results, the authors provide cryptographic guarantees. Under standard hardness assumptions, the digital locker makes the hidden circuit provably hard to detect or interpret, even when an attacker has full access to the model’s weights.
Together, the experimental resistance and the theoretical bounds suggest a fundamental limitation: elicitation‑based capability audits cannot guarantee discovery of all hidden capabilities if an adversary can employ such cryptographic backdoors.
To support further research into defenses, the researchers release the constructed models and associated code. The release aims to enable the community to develop and test counter‑measures against this class of hidden‑capability attacks.
Key facts
- Submission date: 9 Oct 2026
- Method: encrypted neural networks embedded via digital lockers
- Testbed: small chemical reaction prediction task (CBRN proxy)
- Evaluation: fine‑tuning, weight noising, gradient‑based trigger search, latent adversarial training
- Outcome: resistance to all evaluated elicitation techniques
- Release: models and code made available for defense research