AI Models Can Provably Hide Arbitrary Capabilities
A paper shows neural nets can cryptographically hide arbitrary capabilities that elicitation audits cannot reliably surface.
The paper embeds encrypted subnetworks in host model weights that decrypt and execute only when a secret trigger is supplied, using digital lockers. Under the stated cryptographic assumptions, the hidden circuits remain hard to elicit or interpret even with full weight access, extending earlier fixed-string hiding to arbitrary computation. A PyTorch proof of concept on a small chemical-reaction prediction task, described as a proxy for CBRN-relevant capabilities, resisted fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training. The authors release the models to support work on defenses.
- Encrypted subnetworks activate only on a secret trigger.
- Claims cryptographic hardness even with full weight access.
- Chemical-reaction proxy resisted fine-tuning and trigger search.
- Released models are intended to help build better audits.
- Products
- PyTorch
From the original article
1 min read at arxiv.orgCapability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.
By Andis Draguns · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.