---
id: "2026-10-09-ai-models-can-provably-hide-arbitrary-capabilities"
url: "https://postcutoff.com/e/2026-10-09-ai-models-can-provably-hide-arbitrary-capabilities/"
as_of: "2026-10-13T13:21:00+02:00"
date: "2026-10-09"
date_precision: day
category: research
importance: 2
confidence: high
status: [Confirmed]
sources: 2
editor: Adam Bicz
human_review: null
version: "2026-10-13"
---

As of: 2026-10-13 13:21 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-10-09-ai-models-can-provably-hide-arbitrary-capabilities/

# Paper: models can hide arbitrary capabilities behind cryptographic backdoors that evaluations cannot elicit

"AI Models Can Provably Hide Arbitrary Capabilities" (arXiv 2610.13928, 9 Oct 2026; Draguns, Motwani, Douglas, Schroeder de Witt) constructs backdoors that embed encrypted neural networks inside a host model's weights and decrypt and run them only on a secret trigger. Using digital lockers, the hidden circuits are "provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights". In small PyTorch experiments (a chemical reaction prediction task as a CBRN proxy) fine-tuning, weight noising, gradient-based trigger search and latent adversarial training did not surface the capability. The paper reached the Hacker News front page (about 215 points on Oct 13).

## Key facts
- Claim (abstract): capability evaluations rely 'on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions'
- Method: 'backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger', 'extending prior work from hiding fixed strings to arbitrary computations'
- Elicitation methods tested: fine-tuning, weight noising, gradient-based trigger search, latent adversarial training; none surfaced the hidden capability
- Scale: small 'model organisms' in PyTorch; the hidden classifier in the chemistry experiment is a tiny ternary MLP; the construction was also injected into Gemma 3 270M. The authors note that the cryptographic circuit and small-scale settings 'limit the immediate practicality'
- Threat model: a deliberate attacker who modifies weights (for example a poisoned open-weight release), not capabilities that arise in ordinary training
- Status: arXiv preprint, not peer-reviewed. Hacker News item 50065692, about 215 points

## What happened

The authors show how to hide a working neural network inside another model's weights so that it is encrypted until a secret
trigger appears in the input. They give cryptographic arguments that, without the trigger, the hidden circuit cannot be
elicited or interpreted even by someone who holds the weights, and they test standard elicitation methods on small models.

## Why it matters

Pre-deployment testing of open-weight or third-party models assumes that a dangerous capability can be made to show itself
through prompting, fine-tuning or interpretability. This result says that for a model altered by an adversary the
assumption can fail in principle, so provenance and supply-chain checks matter alongside evaluations. It does not show
that current frontier models hide capabilities this way.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 162 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 101 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 192 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 131 days after its cutoff

## Sources

1. [arXiv 2610.13928: AI Models Can Provably Hide Arbitrary Capabilities](https://arxiv.org/abs/2610.13928) (arxiv.org, paper)
2. [Hacker News discussion](https://news.ycombinator.com/item?id=50065692) (news.ycombinator.com, discussion)

## Changes

- 2026-10-13 (filed): Created (PDF read)

## Related

- 2026-10-12: [Anthropic's Frontier Red Team](https://postcutoff.com/e/2026-10-12-anthropic-self-replicating-ai-iot-devices/index.md)
- 2026-09-18: [Anthropic and Accenture commit $1B+ to embedded third-party evaluation](https://postcutoff.com/e/2026-09-18-anthropic-accenture-embedded-evaluation/index.md)