Abstract
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task – a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
Introduction (excerpt)
Large Language Models have advanced rapidly, and are now poised for deployment in increasingly high-stakes domains. Frontier model developers emphasize eliciting dangerous capabilities in audits – systematic evaluations designed to surface unsafe behaviors prior to deployment. However, a failure to elicit a capability does not establish its absence, particularly under adversarial conditions.
We consider an adversary who can modify model weights before deployment (e.g., a malicious insider or compromised supply chain) and aims to embed a capability that activates only on attacker-chosen inputs. The defender has full white-box access and may apply arbitrary elicitation techniques, including fine-tuning.
We introduce a novel class of attacks that allow capabilities to be hidden within model parameters under cryptographic assumptions. Our backdoor circuits can encode the behavior of neural networks pre-trained with standard procedures. We extend prior work from hiding fixed strings to hiding executable neural networks.
Our construction relies on a cryptographic primitive known as a digital locker: a program containing encrypted data that remains computationally infeasible to decipher without a specific password. We use a secret trigger to encrypt a neural network’s weights and embed the resulting locker directly into the weights of a larger host model.
We implement proof-of-concept constructions in PyTorch using SwiGLU MLPs and RMSNorm, hiding a small chemical reaction feasibility classifier inside a host model as a CBRN-risk proxy. Supervised fine-tuning, weight noising, gradient-based trigger search, and latent adversarial attacks failed to surface the hidden capability in experiments.
The authors release model organisms to support defense research and argue the results bound elicitation-based safety audits under adversarial weight modification.