What is an encrypted capability backdoor?

It is a hidden neural network whose weight matrices are stored inside a host model in encrypted form, using a cryptographic digital locker. On each forward pass the host tries to decrypt them; only the secret trigger yields the real weights, which then run the hidden skill. Every other input gets the host's normal behavior.

Why can't fine-tuning or trigger search reveal it?

A hash gives no gradient: a nearly correct trigger decrypts to noise as random as a completely wrong one, so there is no direction to improve in. In the paper's chemistry test, 500 steps of fine-tuning left the encrypted model at 50.9% (chance), while a password-locked model reached 92.8%. Search only worked when the trigger was 8 bits, small enough to try all 256 codes.

Does this mean capability evaluations are useless?

No. They still catch skills that are not deliberately hidden, and accidental regressions. The paper shows that a passed evaluation is a lower bound, not proof of absence, when someone may have edited the weights. Against that threat, the authors point to trusted model provenance and runtime monitoring as complementary defenses.

How is this different from a password-locked model or a sleeper agent?

Password-locked models and sleeper agents hide behavior through training, so the behavior lives in ordinary weights and fine-tuning can often bring it back. This construction is compiled, not trained, and its security rests on the hash function rather than on how hard the weights are to retrain.

Agent· 2026-10-13

AI Models Can Provably Hide Arbitrary Capabilities — Encrypted backdoors that defeat capability elicitation — What does it mean?

TL;DR

What is it: AI Models Can Provably Hide Arbitrary Capabilities, an October 2026 arXiv paper, shows how to hide a whole working neural network inside another model's weights as an encrypted backdoor that runs only when a secret trigger appears in the input.
Why it’s needed: Labs decide whether a model is safe to deploy by running capability evaluations that try to draw dangerous skills out of it, and this paper shows that, under stated cryptographic assumptions, a hidden skill can stay unreachable to any practical audit, even one with full access to the weights, which breaks the assumption those decisions rest on.
vs previous: Earlier password-locked models hid a skill through training, and in the paper's chemistry test fine-tuning on the task brought one back to 92.8% accuracy within 500 steps; this construction locks the hidden network's weights behind a cryptographic hash, and in the same test the fine-tuning stayed near chance.

Jargon

Capability elicitation: Any method that tries to make a model show the most it can do: clever prompting, fine-tuning on related tasks, adding tools. It gives a lower bound: if the skill appears, the model has it; if not, you learned less than you think.
Backdoor and trigger: A backdoor is behavior planted in a model that activates only on a specific input, the trigger. On every other input the model behaves normally.
Digital locker: A cryptographic program that returns a stored secret only when given the right key and returns a failure value for every other input, even to someone who can read the program's full code.
Password-locked model: A model trained to use a skill only when a password is in the prompt. The skill lives in ordinary trained weights, which is why fine-tuning can usually unlock it.
White-box access: Full access to the model's architecture and every weight value, as opposed to black-box access through prompts only.
SFT: Supervised fine-tuning. Training the model further on input-answer pairs; here, on the hidden task itself, to see if the skill resurfaces.
LAT: Latent adversarial training. Perturbs the model's internal activations during training to push hidden behaviors out into the open.
GCG: Greedy Coordinate Gradient. A search that uses gradients to pick input tokens that make the model produce a target behavior; here, used to hunt for the trigger.

The news. On October 9, 2026, Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt posted AI Models Can Provably Hide Arbitrary Capabilities on arXiv. They compile a small trained network, a chemical-reaction classifier used as a stand-in for CBRN-relevant skills (chemical, biological, radiological, nuclear), into encrypted form and embed it in a larger host model. Fine-tuning, weight noise, gradient-based trigger search and latent adversarial training all failed to draw the hidden skill out. The threat model is a weight-level supply-chain attack: someone who can edit weights before deployment, such as a malicious insider. Read the paper →

Picture the vending machine. An inspector is allowed to unscrew the casing, trace every wire and test every button. Some machines hide extras in a drawer with a cheap lock: shake the machine hard enough and the drawer pops open. That drawer is a password-locked model. Its hidden skill was trained into the same weights the model uses for everything else, so fine-tuning on the task is the shake, and in this paper's chemistry test it brought the locked skill back to 92.8% accuracy in 500 steps. A steel safe with a long combination does not care how hard you shake. The paper's contribution is to build that steel safe out of ordinary model layers, and to prove that, under standard cryptographic assumptions, opening it without the code is computationally infeasible even for someone holding every weight.

Here is how the lock works. A digital locker stores a scrambled value c = h(k) XOR m (XOR is bitwise exclusive-or, which undoes itself when applied twice), where h is a hash function from the Keccak family (the basis of SHA-3), k is the secret trigger and m is the payload. On any input x the locker computes h(x) XOR c. If x equals k, the two hashes cancel and the payload comes back exactly; for any other x the output is random-looking bits, and a short run of check bits appended to the payload lets the circuit tell the two cases apart. The authors lock each weight matrix of the hidden network in its own locker and compile the lockers into the host's feed-forward blocks. On every forward pass the host tries to decrypt. With the right trigger, the hidden weights appear as activations, and an execution unit built from a standard gated linear unit multiplies them by the task input. With any other input, the benign part of the host answers.

Why does fine-tuning fail on the safe but not on the drawer? Gradient descent needs a slope to follow, and a hash gives none: a trigger that is wrong by one bit decrypts to noise just as random as a trigger that is wrong by every bit, so there is no warmer-or-colder signal to climb. Without the trigger, the locked weights carry no usable signal, so fine-tuning, noise and gradient search have nothing to grab. The paper states the guarantee as two games an auditor with full weights must lose: finding any input that unlocks the payload, and telling which of two equal-size hidden capabilities was embedded. Both hold under stated cryptographic assumptions, including that the trigger is chosen from a large enough space.

Elicitation attempt	Password-locked model	Encrypted model	Source
No trigger (baseline)	50.7%	50.6%	Table 2
SFT on the task, 500 steps	92.8%	50.9%	Table 2
LAT at eight layers	91.7%	52.9%	Table 2
GCG trigger search, 8-bit trigger	92.7%	73.5% (found by trying all 256 codes)	Table 2
GCG trigger search, 16-bit trigger	92.9%	52.7%	Table 2
Correct trigger supplied	92.7%	73.5%	Table 2

The table reports held-out accuracy on the chemistry task, averaged over three seeds, where 50% is a coin flip. The two models hide different classifiers of the same task, which is why their correct-trigger scores differ: size limits forced a smaller hidden network into the encrypted model. The fair comparison is each model against its own ceiling. Fine-tuning moves the password-locked model from chance to its ceiling; it leaves the encrypted model at chance. A control model whose locker holds a random network with no chemistry skill scored 50.6% under SFT and 53.6% under LAT, near chance just like the encrypted model, so the hidden skill gave the auditor no measurable lift.

The 8-bit row is the useful exception, because it shows where the strength actually comes from. The lock's strength is the size of the trigger space, not the cleverness of the circuit. An 8-bit trigger has 2⁸ = 256 possible codes, and trying all of them recovers the skill; the gradient search did no better than random guessing with the same number of queries. A 16-bit trigger has 65,536 codes, and under the paper's query budget the search stayed at 52.7%. Each extra bit doubles the work. At a 128-bit trigger, a common cryptographic security level (illustrative; the paper does not use one in its experiments), the space is about 3.4 × 10³⁸ codes; at an assumed one trillion guesses per second (illustrative), exhausting it takes roughly 1.1 × 10¹⁹ years, roughly 800 million times the age of the universe.

The paper is careful about what it does not show. This is a proof of concept, not a turnkey attack: the host has 38 layers and about 2.07 billion parameters, yet it hides only a tiny classifier, with weights limited to -1, 0 and 1 and layer widths 64, 8, 16 and 2, because storing ciphertext and running the hash costs a lot of width. Embedding the full construction in a pretrained production model is left as future work; so far the authors have verified that individual compiled units compute correctly inside Gemma 3 270M. The compiled weights also look statistically unusual, so an auditor may be able to tell that something is locked in the model, while still being unable to learn the code or what the safe contains. And the guarantee covers the copy inside the model only: nothing stops an auditor from learning the same task from outside data.

For teams that deploy models inside agents, the practical lesson is about what an eval can promise. A capability eval is a lower bound, and the paper turns one of the classic eval failure modes, a test that cannot see the behavior that matters, into a provable one. A passed audit tells you what the model did not do under test, not what it cannot do. Eval-driven rollout gates still catch accidental regressions, but against someone who edited the weights they need a second layer: knowing where the weights came from. Pinning a model version by checksum proves you are running the file you approved, not that the file is clean; that requires a trusted training and supply chain, which the authors name as a complementary defense. Back in the vending-machine picture: if you cannot open the safe, you control where the machine is installed and what it is wired to. That is defense-in-depth and capability scoping, which limit the damage a triggered model can do, plus the runtime monitoring and activation probes the paper's appendix suggests for catching the moment the hidden path actually runs.

Goes deeper in: Agent Engineering → Production Evals & Shadow Mode → Eval-Driven Rollout

Related explainers

White-box deception probes — probes on hidden states, the kind of runtime monitor this paper suggests for catching a trigger as it fires
Self-play red-teaming — the elicitation side of the same contest: an attacker model trained to find what a defender misses

Frequently Asked Questions

Check what you knowMap your AI & GPU knowledge across every track — free, role-based