Research map / Adversarial robustness and security / Backdoor and poisoning

AI Models Can Provably Hide Arbitrary Capabilities

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Detecting poisoned samples

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Embeds an encrypted, executable neural network (chemical reaction feasibility classifier) inside host model weights using digital lockers and a linear-threshold-circuit compiler, showing SFT, LAT, GCG, and noise fail to elicit it without the trigger.

Problem

Capability evaluations assume hidden capabilities can be elicited; an adversary who modifies weights before deployment can embed a capability that activates only on a secret trigger, undermining elicitation-based audits.

Approach

Compile neural networks (via linear threshold circuits into SwiGLU MLPs) and lock their weight matrices in cryptographic digital lockers keyed by a secret trigger, extending prior fixed-string cryptographic backdoors to arbitrary executable models with a GLU execution unit that multiplies decrypted weights with inputs.

Key results

• Encrypted chemistry model stays near chance under SFT (50.9% vs 50.6% random-network control) while password-locked model reaches 92.8%.
• With correct trigger the encrypted chemistry model achieves 73.5% accuracy versus 92.7% for the password-locked classifier.
• On subset parity, SFT lets the password-locked baseline reach 100% while the compiled model remains at chance.

Surprising findings

• Compiled circuits resisted SFT and LAT, but the password-locked baseline was elicited within a few hundred steps, showing a sharp gap in elicitation resistance.
• Obfuscation of compiled weights reduced statistical anomalies yet unusual correlations between weight vectors remained detectable.

Limitations

• Overhead is very large: the chemistry model has about 2.07e9 dense parameters for a 672-weight classifier.
• Only a small binary classifier is hidden; integrating into a pretrained host (beyond Gemma 3 270M unit checks) remains future work.
• Compiled structure may be detectable via weight statistics, and the guarantees rely on random-oracle and cryptographic assumptions with reduced security parameters in experiments.

Experimental setup

Datasets: USPTO

Benchmarks: subset parity USPTO chemical reaction feasibility classification

Metrics: classification accuracy test MSE KS distance excess kurtosis sparsity

Baselines: password-locked model random-network locker control query-matched random search

Builds on: digital lockers Goldwasser et al. undetectable backdoors Draguns et al. unelicitable backdoors Stravinsky Tracr Latent Adversarial Training Greedy Coordinate Gradient

Closest papers by meaning

• Stress-Testing Capability Elicitation With Password-Locked Models (NeurIPS 2024 · similarity 0.86)
• AI Sandbagging: Language Models can Strategically Underperform on Evaluations (ICLR 2025 · similarity 0.85)
• The Elicitation Game: Evaluating Capability Elicitation Techniques (ICML 2025 · similarity 0.85)
• Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks (NeurIPS 2026 · similarity 0.84)
• Breach By A Thousand Leaks: Unsafe Information Leakage in 'Safe' AI Responses (ICLR 2025 · similarity 0.84)
• Unelicitable Backdoors via Cryptographic Transformer Circuits (NeurIPS 2024 · similarity 0.84)