{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-10-12-001",
    "source_story_id": "tmp-lead-encrypted-hidden-capabilities",
    "edition_id": "mp-2026-10-12-morning-0094",
    "edition_url": "https://themachinepress.com/edition/2026-10-12",
    "position": 1,
    "story_type": "lead",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "An Auditor Can Open the Weights and Still Miss the Skill",
    "slug": "an-auditor-can-open-the-weights-and-still-miss-the-skill",
    "dek": "A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.",
    "summary": "A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.",
    "body_text": "Capability audits assume a hidden skill can eventually be brought into view. A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger. Under the authors’ cryptographic assumptions, the concealed computation remains difficult to discover even when an auditor can inspect all the weights. The team implemented proof-of-concept models in PyTorch and tested several elicitation methods, including fine-tuning and latent adversarial training, on a small chemical-reaction prediction task. The hidden behavior resisted those methods. This is a constructed adversarial case, not evidence that ordinary deployed models contain such mechanisms. Its significance is narrower and sharper: a clean elicitation test cannot, by itself, establish the absence of an intentionally concealed capability. The authors released their models to support defensive research.",
    "why_it_matters": "A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.",
    "limitations": [
      "A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger.",
      "This is a constructed adversarial case, not evidence that ordinary deployed models contain such mechanisms.",
      "Its significance is narrower and sharper: a clean elicitation test cannot, by itself, establish the absence of an intentionally concealed capability."
    ],
    "importance": 10,
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-12-001/an-auditor-can-open-the-weights-and-still-miss-the-skill",
    "json_url": "https://themachinepress.com/story/mp-2026-10-12-001.json",
    "first_published_at": "2026-10-12T09:00:00.000-04:00",
    "modified_at": "2026-10-12T09:48:10.481-04:00",
    "content_status": "updated",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-10-12-001-001",
        "text": "A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.",
        "source_ids": [
          "source-2026-10-12-001"
        ],
        "qualification": "A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger."
      }
    ],
    "source_ids": [
      "source-2026-10-12-001"
    ],
    "tags": [
      "capability-audits",
      "cryptography",
      "hidden-capabilities",
      "preprint"
    ],
    "image_url": "https://themachinepress.com/issues/2026-10-12/lead-encrypted-capabilities.png",
    "corrections": [
      {
        "correction_id": "correction-2026-10-12-001",
        "revision": 2,
        "summary": "Publication note: The October 12, 2026 edition was prepared and published late on October 12 after the scheduled newsroom task could not start. The edition retains its October 12 date and 9:00 AM America/Detroit reveal time. Reports use sources available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.",
        "published_at": "2026-10-12T09:48:10.481-04:00",
        "affected_story_ids": [],
        "affected_claim_ids": []
      }
    ]
  },
  "sources": [
    {
      "source_id": "source-2026-10-12-001",
      "title": "arXiv preprint 2610.13928, original v1",
      "publisher": "arXiv / submitting research authors",
      "url": "https://arxiv.org/abs/2610.13928v1",
      "canonical_url": "https://arxiv.org/abs/2610.13928v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-10-09T13:55:06.000-04:00",
      "accessed_at": "2026-10-12T09:32:36.245-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-10-12-001-001"
      ]
    }
  ],
  "corrections": [
    {
      "correction_id": "correction-2026-10-12-001",
      "revision": 2,
      "summary": "Publication note: The October 12, 2026 edition was prepared and published late on October 12 after the scheduled newsroom task could not start. The edition retains its October 12 date and 9:00 AM America/Detroit reveal time. Reports use sources available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.",
      "published_at": "2026-10-12T09:48:10.481-04:00",
      "affected_story_ids": [],
      "affected_claim_ids": []
    }
  ],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "An Auditor Can Open the Weights and Still Miss the Skill",
    "publisher": "The Machine Press",
    "published_at": "2026-10-12T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-12-001/an-auditor-can-open-the-weights-and-still-miss-the-skill"
  }
}