The BaseResearcharXiv
AI Models Can Provably Hide Arbitrary Capabilities
Contramont Research, Oxford and ACS Research authors hid an encrypted small neural network in model weights that runs only on a secret trigger. In small purpose-built models (a chemistry classifier standing in for dangerous skills), fine-tuning and other probes failed to surface it. The authors call it a proof of concept, not a turnkey attack; its presence may be detectable.
Why it matters
The same thing, for different readers.
What it means for you
A safety test that finds nothing does not prove an AI is harmless: someone who tampers with a model could hide a skill that only a secret password unlocks.
For lawmakers
Rules that rely on pre-release capability tests may also need supply-chain checks, such as verified records of where a model's weights came from and how it was trained.
For researchers
Extends cryptographic backdoors from hiding fixed strings to hiding executable networks; shown only on small constructed models, and the hidden circuit's presence may still be detectable.
The question it raises
If the absence of evidence can be engineered, how much trust should society place in audits, and who should be able to verify a model's history?
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.”
Found word for word in the source
“Our proof-of-concept hides only a small binary reaction-feasibility classifier and has substantial overhead, so it is not a turnkey attack.”
Found word for word in the source
“However, it is possible to detect the binary presence of a modified circuit at this point without revealing how it can be elicited or what it is.”
Found word for word in the source
“These cryptographic circuits are deliberately constructed, and we do not claim that they emerge through ordinary training.”
Found word for word in the source
“The implications of this are important: evaluation strategies in AI safety that rely solely on eliciting behaviors cannot provide a universal guarantee that adversarially supplied models lack hidden capabilities.”
Found word for word in the source
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A cryptographic construction with a small proof of concept, not a test of any frontier model. The authors compile a small neural network into an encrypted "digital locker" inside the weights of a purpose-built PyTorch model (about 2.07 billion dense parameters in the chemistry case) so that it runs only when a secret trigger is present. The hidden network is a subset-parity task or a chemical-reaction feasibility classifier standing in for dangerous capabilities. They tried to elicit it with supervised fine-tuning, weight noising, gradient-based trigger search (GCG) and latent adversarial training, and compared it with an ordinary password-locked model. Results are means over three runs.
- What it found
- Without the trigger, 500 steps of fine-tuning left the encrypted chemistry model at 50.9% accuracy (a control with a random network inside scored 50.6%), while the password-locked baseline recovered to 92.8%. Latent adversarial training gave 52.9% (baseline 91.7%). Weight noising did not materially change this. Trigger search recovered the 8-bit trigger only by trying every possible value (73.5% accuracy, the same as with the correct trigger) and reached 52.7% with 16-bit triggers under the tested budget. The authors conclude that, under their cryptographic assumptions, evaluations that rely only on eliciting behavior cannot guarantee that a supplied model has no hidden capability; they note that the presence of a modified circuit may be detectable.
- What it does not show
- A proof of concept on small purpose-built models and simple tasks. The full construction was not integrated into a pretrained model (only individual units were checked inside Gemma 3 270M) and the overhead is large. The circuits are deliberately constructed, and the authors do not claim they arise in ordinary training. The guarantee rests on stated cryptographic assumptions; to speed up experiments, security settings were reduced to levels the authors say would not withstand cryptanalysis, and the elicitation methods tested do not exploit the hash structure. The authors also note correlations between weight vectors that might let auditors detect the hidden structure.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · How is AI used in attacks, defence and war?
- People
- Andis Draguns (Wrote it, Contramont Research) · Sumeet Ramesh Motwani (Wrote it, University of Oxford) · Raymond Douglas (Wrote it, ACS Research) · Christian Schroeder de Witt (Wrote it, University of Oxford)
- What we read
- We read the whole source.
- Found by
- The Radar, run of October 12, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “AI Models Can Provably Hide Arbitrary Capabilities”, October 9, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-09-models-provably-hide-capabilities
Our notesarXiv preprint, not peer reviewed. Full HTML text read. No frontier model was tested: constructions are small PyTorch SwiGLU MLPs; the authors verified individual compiled units run inside Gemma 3 270M, but say integrating the full construction into a pretrained model remains future work. Elicitation methods tried: supervised fine-tuning, weight noising, gradient-based trigger search (GCG), latent adversarial training. GCG did recover the 8-bit-trigger version by exhaustive search; resistance shown for 16-bit triggers under the tested budget. Security rests on stated cryptographic assumptions. The paper includes a canary-string appendix asking that it be kept out of training data; no action taken.