AI Models Can Provably Hide Arbitrary Capabilities
Summary
The paper shows backdoor attacks that embed encrypted neural networks inside host model weights, enabling hidden capabilities that are provably hard to elicit even with full access to weights. It provides cryptographic guarantees and demonstrates resistance to elicitation methods through experiments in PyTorch on a chemical reaction prediction task. The work challenges the reliability of capability audits and has important implications for AI safety and model auditing.