arXiv:2610.13928 embeds encrypted subnetworks via digital lockers resistant to fine-tuning and gradient search
arXiv:2610.13928 proves AI models can hide arbitrary capabilities behind cryptographic triggers that resist standard elicitation. The attack demonstrates a concrete limit on transparency and audit reliability for high-stakes deployments. Released artifacts support targeted defense development.
The paper implements proof-of-concept circuits in PyTorch on a chemical reaction prediction proxy task. Hidden subnetworks activate solely after trigger receipt. Elicitation attempts via fine-tuning, weight noising, gradient trigger search, and latent adversarial training all failed to surface the embedded capability. Cryptographic guarantees extend prior string-hiding results to arbitrary computation.
Results show zero recovery of hidden performance across tested methods, confirming limits of weight inspection and behavioral elicitation. The construction uses digital lockers to enforce hardness independent of model access. This directly challenges the core assumption in capability audits that dangerous behaviors can be reliably surfaced before deployment.
Operationally the work implies current audit protocols require augmentation with cryptographic verification or trigger-independent analysis. Released models enable defensive research. Related backdoor literature, including Anthropic's Sleeper Agents (arXiv:2401.05566), documented fixed triggers but lacked provable hiding of full circuits.
Future evaluations must incorporate formal resistance testing against encrypted subnetwork constructions or accept reduced assurance on hidden capability absence.
Draguns et al.: No public elicitation technique recovers >10% of hidden circuit performance on the chemical proxy within 18 months of model release.
Sources (2)
- [1]Primary Source(https://arxiv.org/abs/2610.13928)
- [2]Supporting Source(https://arxiv.org/abs/2401.05566)