Paper shows AI models can hide arbitrary capabilities from elicitation audits
Original title: Hiding Capabilities in AI Models
Encrypted circuits in the weights run only after a secret trigger and resisted fine-tuning, noising, trigger search, and latent adversarial training.
A paper argues that capability evaluations assume hidden behaviors can be elicited, then constructs backdoors that embed encrypted neural networks in host weights. Digital lockers decrypt and run those circuits only for a secret trigger, and the authors say the circuits stay hard to elicit or interpret under cryptographic assumptions even with full weight access. A PyTorch proof of concept used chemical reaction prediction as a proxy for CBRN-relevant capabilities. The models were released to support defenses.
Unconfirmed: The chemical task is only a proxy for CBRN-relevant capabilities, not a demonstration of those capabilities.
- The construction extends hiding fixed strings to arbitrary computations.
- Elicitation tests included fine-tuning, weight noising, and gradient-based trigger search.
- Latent adversarial training also failed to surface the hidden circuits.
- The dangerous-capability stand-in was a small chemical reaction prediction task.
- Proof-of-concept models were released to help improve defenses.
From the original article
1 min read at schneier.comInteresting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited.
By Bruce Schneier · schneier.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.