Track genomics, neuroscience and molecular biology.
Search papers, labs, and topics across Lattice.
We demonstrate that arbitrary model capabilities can be provably hidden within model weights using encrypted neural networks, rendering them undetectable by standard elicitation techniques even with full weight access. These "digital locker" backdoors are resistant to fine-tuning, weight perturbation, and gradient-based trigger searches, as validated on a chemical reaction prediction task. This work fundamentally challenges the efficacy of elicitation-based capability auditing for AI safety.
Hidden neural networks can be cryptographically secured within model weights, making them provably undetectable by current elicitation methods.
Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.