Preprint demonstrates encrypted model capabilities that resist audit methods

Researchers describe a way to conceal arbitrary computations inside AI model weights in a new preprint, challenging the assumption that capability audits can elicit every hidden behavior. Their construction embeds encrypted neural networks that decrypt and execute only when a model receives a secret trigger. The researchers implemented proof-of-concept attacks in PyTorch and tested them on a small chemical reaction prediction task. The hidden capabilities resisted fine-tuning, weight noising, gradient-based trigger searches and latent adversarial training. Their cryptographic guarantees depend on assumptions, and the chemical task serves as a proxy for capabilities relevant to chemical, biological, radiological and nuclear risks.