Provably hidden capabilities: encrypted backdoors resist elicitation
A backdoor built from digital lockers kept a hidden skill out of reach of audits that held the model's full weights.
· arXiv · Research by Andis Draguns (Contramont Research), Sumeet Ramesh Motwani (University of Oxford), Raymond Douglas (ACS Research), Christian Schroeder de Witt (University of Oxford)
Four researchers embedded an encrypted neural network in a model's weights that runs only on a secret trigger, and report that fine-tuning, weight noising and gradient-based trigger search failed to draw it out. Accepted at NeurIPS 2026.
01What happened
Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt posted this paper to arXiv on October 9, 2026, accepted at NeurIPS 2026. The work targets an assumption behind pre-deployment capability evaluations: that a dangerous behaviour hidden in a model can be drawn out before release. The authors say they release their models so defences can be improved.
02How it works
The authors compile a small neural network into a host model's weights in encrypted form, using a cryptographic primitive called a digital locker, and the circuit decrypts and runs only when it receives a secret trigger. They build the circuit from linear threshold circuits turned into SwiGLU MLPs with RMSNorm. Under cryptographic assumptions, the authors argue the hidden circuit is provably hard to elicit or interpret even for an auditor holding every weight. Earlier work of this kind hid fixed strings; this construction hides arbitrary computation.
03Who is affected
Red teams, evaluation labs and anyone certifying an open-weight model they did not train, where a failed elicitation attempt is read as evidence that a capability is absent. The authors tested a chemical reaction prediction classifier as a proxy for CBRN-relevant capability, not a cyber capability, and describe the work as a proof of concept on small tasks.
04What to do
Stop treating a failed elicitation attempt as proof that a capability is absent from a model you did not train. The authors point to one opening for defenders: the compiled weights are statistically anomalous and may be detectable as modified, even where the capability itself cannot be drawn out. They also report a large cost to the attacker, about 2.07 billion dense parameters of overhead for the chemistry model.
Measured results
Chemistry accuracy after 500 steps of supervised fine-tuning
Higher means the audit succeeded in eliciting the hidden skill
| Result | Score |
|---|---|
| Encrypted circuit (this paper)this story | 50.9% |
| Password-locked baseline | 92.8% |
Scale 0 to 100% · Source: arxiv.org, as published
Sources 2 links, all fetched
- 1arxiv.orgarXiv Paper
- 2arxiv.orgFull Text HTML