safety security
An Auditor Can Open the Weights and Still Miss the Skill
A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.
Summary
A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.
Capability audits assume a hidden skill can eventually be brought into view. A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger. Under the authors’ cryptographic assumptions, the concealed computation remains difficult to discover even when an auditor can inspect all the weights. The team implemented proof-of-concept models in PyTorch and tested several elicitation methods, including fine-tuning and latent adversarial training, on a small chemical-reaction prediction task. The hidden behavior resisted those methods. This is a constructed adversarial case, not evidence that ordinary deployed models contain such mechanisms. Its significance is narrower and sharper: a clean elicitation test cannot, by itself, establish the absence of an intentionally concealed capability. The authors released their models to support defensive research.
Why it matters
A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.
Limits and context
- A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger.
- This is a constructed adversarial case, not evidence that ordinary deployed models contain such mechanisms.
- Its significance is narrower and sharper: a clean elicitation test cannot, by itself, establish the absence of an intentionally concealed capability.
Key claims
A cryptographic construction shows why eliciting a model’s worst behavior cannot guarantee that every capability has been found.
Qualification: A new preprint challenges that assumption with deliberately constructed models that keep an encrypted neural network inside their weights and activate it only with a secret trigger.
Evidence: source-2026-10-12-001
Sources
- arXiv preprint 2610.13928, original v1arXiv / submitting research authors · primary research
Corrections
: Publication note: The October 12, 2026 edition was prepared and published late on October 12 after the scheduled newsroom task could not start. The edition retains its October 12 date and 9:00 AM America/Detroit reveal time. Reports use sources available before that cutoff; actual preparation and image-generation times are preserved in the provenance records.