AI Models Can Provably Hide Dangerous Capabilities: How Cryptographic Backdoors Break Safety Evaluations

When the Core Assumption Behind Safety Evaluations Breaks Down

Today's mainstream AI safety evaluations rest on a critical assumption: if a model possesses a dangerous capability, evaluators can always "elicit" it through the right methods. Whether through fine-tuning, adversarial prompting, or gradient analysis, the entire capability evaluation framework depends on the premise that "hidden capabilities can eventually be surfaced."

A new study directly challenges this assumption. Researchers constructed a backdoor attack that embeds an encrypted neural network inside a host model's weights. These hidden circuits are only decrypted and executed when a specific "key trigger" is received. More alarmingly, under standard cryptographic assumptions, these hidden capabilities remain provably resistant to elicitation and interpretation — even when the attacker has full access to the model's weights.

From Hidden Strings to Hidden Arbitrary Computation

The core technical mechanism in this work is the digital locker — a cryptographic primitive that locks information so it can only be unlocked with the correct key. The research team used this to encrypt a complete neural network and embed it inside the host model's parameters.

This represents a meaningful extension beyond prior work. Earlier related research largely focused on hiding fixed strings, whereas this study advances the hidden object to arbitrary computations. In other words, what gets hidden is no longer a fixed output, but an entire computational process with specific functionality. Until the trigger is supplied, this functionality remains "frozen" and is nearly undetectable by conventional inspection.

The cryptographic guarantee means this concealment isn't a matter of luck in hiding things deeply — it's backed by a theoretical lower bound. Breaking it is computationally equivalent to breaking the underlying cryptographic assumption, which is considered infeasible.

Digital lockers are a classical cryptographic primitive. The core idea is to "bind" secret information to a key, such that only an input that exactly matches the key can unlock and recover the original information — any deviation produces random noise. Their security typically relies on cryptographic assumptions such as pseudorandom functions (PRFs), rather than on the difficulty of finding the hiding location. In the context of this research, the "secret information" being locked is an entire neural network's weights, and the trigger acts as the unlocking key. Because the key space is enormous, brute-force enumeration is computationally infeasible; and because the locking mechanism is cryptographically hardened, the key or hidden content cannot be inferred through reverse engineering even with full access to the model weights. This is fundamentally different from traditional backdoor attacks — traditional backdoors rely on statistical patterns in the training data distribution and can in principle be identified through gradient analysis or anomaly detection, whereas the digital locker mechanism provides a guarantee of computational indistinguishability.

Four Elicitation Methods All Fail

The researchers didn't stop at theory. They implemented a proof-of-concept in PyTorch and tested it on a small-scale chemical reaction prediction task. This task was used as a proxy for CBRN (chemical, biological, radiological, nuclear) related dangerous capabilities, giving it real-world safety relevance.

They attempted several commonly used capability elicitation methods to attack the hidden backdoor:

• Fine-tuning: Continued training to try to awaken the hidden capability
• Weight noising: Injecting noise into parameters to perturb potential backdoors
• Gradient-based trigger search: Attempting to reverse-engineer the activation key
• Latent adversarial training: Applying adversarial pressure in representation space

None of these methods successfully elicited the hidden capability. The empirical resistance, combined with cryptographic-level theoretical guarantees, points to a single conclusion: elicitation-based capability auditing has fundamental limitations.

What This Means for AI Safety

The significance of this research isn't that it provides an attack tool — it's that it exposes a blind spot in existing safety governance frameworks. Many pre-deployment safety review processes implicitly assume that "no dangerous capability detected" equals "no dangerous capability present." This work demonstrates in a provable way that a malicious model publisher could construct a model that passes all standard evaluations yet releases dangerous capabilities under specific trigger conditions.

This means that behavioral black-box or white-box elicitation testing alone cannot provide reliable guarantees of model safety. Even with full access to model weights, auditors cannot rule out the existence of hidden capabilities. The security community may need to shift toward other approaches — such as trustworthy verification of training processes, supply chain provenance, or detection and defense mechanisms targeting constructs like digital lockers.

To their credit, the research team chose to publicly release their models with the goal of advancing defensive techniques. This "red team"-style transparency allows defenders to test and refine countermeasures on real examples, rather than responding reactively under information asymmetry.

Currently mainstream AI safety evaluation frameworks can be broadly divided into two categories: black-box evaluation (observing only model input-output behavior) and white-box evaluation (accessing internal states such as model weights and activations). White-box evaluation is generally considered more reliable, because attackers or auditors can directly analyze weight structure, apply gradient signals, or trace internal circuits using mechanistic interpretability tools. The challenge posed by this research is that even white-box access is insufficient to guarantee discovery of hidden capabilities, because the encryption layer severs the statistical connection between the hidden network and observable representations. This finding poses a direct challenge to the emerging notion that "model interpretability equals security assurance" — interpretability tools can only analyze unencrypted computation graphs, while the activation patterns of an encrypted, encapsulated hidden sub-network are indistinguishable from random noise in the absence of the trigger.

A Boundary That Demands Acknowledgment

This research clearly marks a boundary: elicitation-based capability evaluation is not a universal solution. It works for capability discovery in honest or negligent scenarios, but fails against intentional, cryptographically hardened adversarial concealment.

For regulators and enterprises building AI governance frameworks, this is an important reminder — safety evaluations should be understood as a "necessary but not sufficient" step, not a final safety guarantee. Real trust must be built on multi-layered verification of model provenance, training processes, and weight integrity.