The BaseResearcharXiv

AI Models Can Provably Hide Arbitrary Capabilities

Contramont Research, Oxford and ACS Research authors hid an encrypted small neural network in model weights that runs only on a secret trigger. In small purpose-built models (a chemistry classifier standing in for dangerous skills), fine-tuning and other probes failed to surface it. The authors call it a proof of concept, not a turnkey attack; its presence may be detectable.

Open the source ↗

Why it matters

The same thing, for different readers.

What it means for you

A safety test that finds nothing does not prove an AI is harmless: someone who tampers with a model could hide a skill that only a secret password unlocks.

For lawmakers

Rules that rely on pre-release capability tests may also need supply-chain checks, such as verified records of where a model's weights came from and how it was trained.

For researchers

Extends cryptographic backdoors from hiding fixed strings to hiding executable networks; shown only on small constructed models, and the hidden circuit's presence may still be detectable.

The question it raises

If the absence of evidence can be engineered, how much trust should society place in audits, and who should be able to verify a model's history?

In their own words

Every quotation was found, word for word, in the text we saved from the source.

From the source’s own text.

“Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.”
Andis Draguns, Contramont ResearchOpening of the paper's abstract, stating the claim.
Matches the source exactly
“Our proof-of-concept hides only a small binary reaction-feasibility classifier and has substantial overhead, so it is not a turnkey attack.”
Andis Draguns, Contramont ResearchIntroduction, 'Attack scale and harm': the authors' own limit on how practical the attack is today.
Matches the source exactly
“However, it is possible to detect the binary presence of a modified circuit at this point without revealing how it can be elicited or what it is.”
Andis Draguns, Contramont ResearchAnalysis section: the guarantee covers unlocking or identifying the capability, not hiding that something was added.
Matches the source exactly
“These cryptographic circuits are deliberately constructed, and we do not claim that they emerge through ordinary training.”
Andis Draguns, Contramont ResearchLimitations: the threat studied is deliberate tampering, e.g. by an insider or a compromised supply chain.
Matches the source exactly
“The implications of this are important: evaluation strategies in AI safety that rely solely on eliciting behaviors cannot provide a universal guarantee that adversarially supplied models lack hidden capabilities.”
Andis Draguns, Contramont ResearchConclusion, on what the result means for safety audits.
Matches the source exactly

The record

Questions
Are AI companies putting stronger safeguards into practice? · How is AI used in attacks, defence and war?
People
Andis Draguns (Wrote it, Contramont Research) · Sumeet Ramesh Motwani (Wrote it, University of Oxford) · Raymond Douglas (Wrote it, ACS Research) · Christian Schroeder de Witt (Wrote it, University of Oxford)
What we read
We read the whole source.
Found by
The Radar, run of October 12, 2026, via arxiv-ai-safety-query (tier 1: the source’s own channel or an official record)
Cite this
arXiv, “AI Models Can Provably Hide Arbitrary Capabilities”, October 9, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-09-models-provably-hide-capabilities
Our notesarXiv preprint, not peer reviewed. Full HTML text read. No frontier model was tested: constructions are small PyTorch SwiGLU MLPs; the authors verified individual compiled units run inside Gemma 3 270M, but say integrating the full construction into a pretrained model remains future work. Elicitation methods tried: supervised fine-tuning, weight noising, gradient-based trigger search (GCG), latent adversarial training. GCG did recover the 8-bit-trigger version by exhaustive search; resistance shown for 16-bit triggers under the tested budget. Security rests on stated cryptographic assumptions. The paper includes a canary-string appendix asking that it be kept out of training data; no action taken.