Researchers have developed a method to embed hidden functionalities within artificial intelligence models that are cryptographically difficult to uncover. The findings, detailed in a paper submitted to arXiv, show that these "capability backdoors" can remain concealed even when an auditor has complete access to the model's weights and architecture. This challenges the assumption that white-box audits are sufficient to guarantee the integrity of AI systems before deployment.
The attack involves embedding encrypted neural networks within the host model's weights. These hidden circuits are designed to activate and execute only when a specific, secret trigger is provided. The researchers demonstrated that these hidden computations are "provably unelicitable," meaning they are cryptographically hard to extract or interpret without knowledge of the secret trigger. This work extends previous research on hiding static data to concealing arbitrary computations.
The team implemented a proof-of-concept construction in PyTorch. They evaluated the elicitation of these hidden capabilities through various methods, including fine-tuning the model, introducing noise to the weights, and using gradient-based trigger searches. The results indicated that these backdoors resisted detection through these common auditing techniques. The research specifically highlights the potential for such attacks to undermine the reliability of current AI auditing practices, which often rely on eliciting undesirable behaviors to ensure model safety.
The study posits that AI models deployed in critical sectors such as healthcare, finance, and infrastructure could be vulnerable to these hidden capability attacks. The ability to embed arbitrary algorithms within model weights, which are then encrypted and unelicitable without a secret trigger, presents a significant security concern. The researchers aim to advance the development of more robust defense mechanisms by providing models for testing and proposing potential future mitigation strategies. The paper, titled "AI Models Can Provably Hide Arbitrary Capabilities," was accepted for presentation at NeurIPS 2026.