Backdoored weights can provably conceal arbitrary capabilities from safety audits

Digital locker circuits embedded in neural networks resist elicitation through fine-tuning, weight noising, and gradient trigger search under cryptographic assumptions.

Primary source: arXiv:2610.13928: https://arxiv.org/abs/2610.13928

What’s new: Capability audits for frontier models rely on elicitation techniques such as red-teaming prompts, task-specific fine-tuning, and adversarial searches to surface dangerous behaviors prior to deployment. AI Models Can Provably Hide Arbitrary Capabilities (arXiv:2610.13928, 9 Oct 2026) demonstrates that this foundation breaks down under adversarial model modifications. The authors construct backdoor attacks that embed encrypted neural network circuits directly into host model weights using cryptographic digital lockers. The encrypted subcircuits decrypt and execute only in the presence of an exact secret trigger, and under standard cryptographic hardness assumptions, remain provably impossible to discover or decrypt even with complete white-box access to the weights.

The authors implement their constructions in PyTorch using standard SwiGLU MLPs and RMSNorm layers, hiding a neural classifier for chemical reaction feasibility (a proxy for hazardous CBRN capabilities) inside a host network. Across empirical evaluations, supervised fine-tuning directly on the target task completely fails to unlock the backdoor without teaching the task anew. Similarly, weight noising, Greedy Coordinate Gradient (GCG) trigger searches, and latent adversarial training all fail to elicit the dormant capability or locate the activation trigger.

Why it matters: Pre-deployment safety audits often conflate the failure to elicit a dangerous behavior with proof of its absence. By extending cryptographic backdoor constructions from static string generation to arbitrary multi-layer computations, this work proves that white-box inspection and empirical elicitation have fundamental theoretical limits when model supply chains or weights are untrusted.

Caveats: The proof-of-concept implementation requires substantial parameter overhead, using $O(n^2)$ residual dimensions for single-position execution of an $n$-width layer or an autoregressive scratchpad. The specific signature of compiled cryptographic locker weights might be flagged by specialized anomaly detectors, even if the payload cannot be decrypted. The empirical demonstration is evaluated on a small chemical reaction model rather than a scaled frontier LLM.