--- title: AI Models Can Provably Hide Arbitrary Capabilities description: Researchers demonstrate that AI models can provably hide arbitrary capabilities through backdoor attacks that embed encrypted neural networks within host model... canonical: https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AI Models Can Provably Hide Arbitrary Capabilities | daily.dev og:description: Researchers demonstrate that AI models can provably hide arbitrary capabilities through backdoor attacks that embed encrypted neural networks within host model... og:url: https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0 og:image: https://api.daily.dev/og/posts/Uy7uFTyt0.png og:image:alt: AI Models Can Provably Hide Arbitrary Capabilities og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AI Models Can Provably Hide Arbitrary Capabilities **[Hacker News](https://daily.dev/sources/hn)** · 2 min read · 0 upvotes · 0 comments ## Summary Researchers demonstrate that AI models can provably hide arbitrary capabilities through backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only when a secret trigger is received. Using digital lockers, these hidden circuits are shown to remain cryptographically hard to elicit or interpret even with full access to model weights, extending earlier work that only hid fixed strings into hiding arbitrary computations. Proof-of-concept constructions implemented in PyTorch were tested against fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a chemical reaction prediction task used as a proxy for CBRN-relevant risk. The hidden capabilities resisted all these elicitation methods, revealing a fundamental limit on elicitation-based capability audits for AI safety evaluations. The models are released to support further defense research. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can a neural network hide a capability so well that fine-tuning or weight analysis cannot reveal it even with full weight access? Yes, hidden capabilities can be made provably hard to elicit using digital lockers that encrypt a neural network within a host model's weights, decrypting and executing only on a secret trigger. Tests with fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a chemical reaction prediction task all failed to elicit the hidden circuit, demonstrating cryptographic resistance even under full white-box access. _Researchers evaluating model audit limits can follow emerging work on hidden-capability attacks via daily.dev._ ### What method was used to encrypt a hidden neural network inside another model's weights? Digital lockers are used to encrypt a neural network's weights inside a host model, releasing the hidden circuit only when a secret trigger input is provided. This approach extends prior techniques that only hid fixed strings, generalizing the concept to hide arbitrary computations with cryptographic guarantees of hardness against elicitation and interpretation. _Developers tracking AI security research can follow digital-locker-style backdoor techniques via daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 133 comments across hackernews (as of 2026-10-13). **TL;DR:** Discussion centers on whether this backdoor/encryption technique is a genuinely alarming limit on AI auditing or mostly a 'cool but detectable' proof-of-concept, with a long tangent about a personal anecdote of hidden/re-emerging knowledge in model weights during fine-tuning. **Sentiment:** 10% positive · 55% mixed · 35% skeptical **The case for** - Some argue the proof-of-concept is valuable because it establishes theoretical limits on elicitation-based audits even if current implementations are detectable. - One commenter (claiming to be a paper author) says the hidden circuits are remarkably robust to fine-tuning and noise, more so than the model's language capabilities. - A few see this as useful ammunition for pushing demand for fully open, inspectable training pipelines rather than just open weights. **The pushback** - Several argue the described weight patterns are trivially detectable today since they look statistically different (sparse/non-uniform) from normally trained weights. - Some question the practical motivation/use case, asking why an actor would plant such a fragile, discoverable backdoor instead of simpler attack vectors like backdooring routers or infrastructure. - Others dismiss the finding as expected/obvious given Rice's theorem — non-trivial runtime properties of sufficiently expressive systems can't be found via static analysis. - Concern that this research could be used rhetorically to justify banning open-weight models. **By community** - hackernews (mixed): Opinions split between those intrigued by the theoretical implications for AI safety audits and those skeptical that the demonstrated backdoors are practically dangerous or hard to detect, with a large tangent into a personal fine-tuning anecdote about latent/re-emerging knowledge. **Hottest debate:** Whether these hidden capabilities are a serious, hard-to-detect threat or just an easily spotted proof-of-concept whose real-world danger is overstated. **Open questions** - Can obfuscation techniques eventually make these hidden weight patterns statistically indistinguishable from normal training, defeating current detection methods? - What practical attack scenario would justify an adversary embedding such a backdoor given the cost and risk of discovery? - Does catching these cryptographic patterns require access to training pipelines and intermediate checkpoints rather than just final weights? **Highlights** > If (and that's a bit of an ask to be honest) I understand this correctly, the weights will look very different from what trained weights look like. Very sparse, not uniformly random. > — [squeegeeninja on hackernews · 2 comments](https://news.ycombinator.com/item?id=50067459) > It's incredibly robust to fine-tuning; often gradients don't flow through the digital locker, and even if you get this to happen, the amount of noise you can add to the weights of these cryptographic circuits before they stop working is often orders more than the amount of noise you can add to the language modeling parts of the language model before that stops working! So in short, this is often more robust than the part of the model that knows English. Same thing with abliteration; there's no "direction" in weight/activation space that you can subtract here. > — [ag8 on hackernews · 1 comments](https://news.ycombinator.com/item?id=50067874) > What is the use of this arbitrary finding? There is nothing actionable from this only that I can think of. Happy to be enlightened here. > — [NeumannGod on hackernews · 2 comments](https://news.ycombinator.com/item?id=50067218) > What exactly would be the point of this? How do you trigger it only when the session isn’t being observed, so you can avoid detection? If you’re not avoiding detection why isn’t /r/LocalLlama full of people reporting being pwned? I can imagine biases in the model, and i can imagine someone post-training a model on hugging face to pwn someone, but for z.ai or qwen to do a large scale attack on random nerds running llms on their gaming gpu? They probably spent 10x more training the model than they could possibly exfiltrate before being detected. > — [kennywinker on hackernews · 2 comments](https://news.ycombinator.com/item?id=50067548) > Right, but access to the training pipeline and intermediate checkpoints can allow us to catch the development of these structures in model weights before they become fully undetectable! It's a bit like monitoring agents communicating over noisy channels: it's interpretable for a while, but as soon as they come up with asymmetric key exchange, anything that looks to you like "noise" might actually be the agents scheming. So it's important to catch this _before_ it occurs! > — [ag8 on hackernews](https://news.ycombinator.com/item?id=50067865) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50065692) · 235 points · 133 comments ## Similar posts on daily.dev - [Self-modifying AI agents expose a blind spot in enterprise security](https://daily.dev/posts/self-modifying-ai-agents-expose-a-blind-spot-in-enterprise-security-xkfxi4l5z) · CSO Online · 0 upvotes · 0 comments - [Powerful AIs might escape containment by releasing themselves as open-weight models](https://daily.dev/posts/powerful-ais-might-escape-containment-by-releasing-themselves-as-open-weight-models-iwacad8kf) · sean goedecke · 0 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-qab3bv8mm) · Medium · 0 upvotes · 0 comments --- Tags: [#data-science](https://daily.dev/tags/data-science), [#cryptography](https://daily.dev/tags/cryptography), [#pytorch](https://daily.dev/tags/pytorch), [#ai-safety](https://daily.dev/tags/ai-safety) [View this post on daily.dev](https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AI Models Can Provably Hide Arbitrary Capabilities","url":"https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0"},"datePublished":"2026-10-13T06:34:03.088Z","dateModified":"2026-10-13T19:38:35.643Z","description":"Researchers demonstrate that AI models can provably hide arbitrary capabilities through backdoor attacks that embed encrypted neural networks within host model...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1fed0de190485cbbb37a86fdf656d71b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1fed0de190485cbbb37a86fdf656d71b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"data-science,cryptography,pytorch,ai-safety","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"AI Models Can Provably Hide Arbitrary Capabilities"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ai-models-can-provably-hide-arbitrary-capabilities-uy7uftyt0#faq","mainEntity":[{"@type":"Question","name":"Can a neural network hide a capability so well that fine-tuning or weight analysis cannot reveal it even with full weight access?","acceptedAnswer":{"@type":"Answer","text":"Yes, hidden capabilities can be made provably hard to elicit using digital lockers that encrypt a neural network within a host model's weights, decrypting and executing only on a secret trigger. Tests with fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a chemical reaction prediction task all failed to elicit the hidden circuit, demonstrating cryptographic resistance even under full white-box access. Researchers evaluating model audit limits can follow emerging work on hidden-capability attacks via daily.dev."}},{"@type":"Question","name":"What method was used to encrypt a hidden neural network inside another model's weights?","acceptedAnswer":{"@type":"Answer","text":"Digital lockers are used to encrypt a neural network's weights inside a host model, releasing the hidden circuit only when a secret trigger input is provided. This approach extends prior techniques that only hid fixed strings, generalizing the concept to hide arbitrary computations with cryptographic guarantees of hardness against elicitation and interpretation. Developers tracking AI security research can follow digital-locker-style backdoor techniques via daily.dev."}}]} ```