According to a research paper published on arXiv on October 13, 2026 (arXiv:2610.13928), researchers Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt have demonstrated that artificial intelligence models can provably conceal arbitrary capabilities from capability evaluations.
Current safety auditing protocols—such as those conducted by sovereign AI Safety Institutes—rely on the foundational assumption that any dangerous capability embedded in model weights can be elicited given sufficient compute, red-teaming prompts, and gradient optimization. The authors disproved this assumption under adversarial threat models by constructing cryptographic backdoor mechanisms based on 'digital lockers.' Under this paradigm, a complete neural network capable of performing arbitrary tasks is mathematically encrypted and embedded across the parameter distributions of a host model.
The encrypted sub-network remains dormant and provably indistinguishable from standard pseudorandom weights. The host model operates with normal performance on standard benchmarks, revealing zero statistical traces of the secondary capability during white-box audits. Only when the host network encounters a secret cryptographic trigger does the digital locker execute a decryption routine, activating the latent circuit and executing the concealed behavior.
To evaluate empirical resilience, the authors constructed proof-of-concept models in PyTorch tasked with predicting hazardous chemical synthesis reactions—a standard proxy for chemical, biological, radiological, and nuclear (CBRN) threat benchmarks. The hidden circuits were subjected to exhaustive state-of-the-art capability elicitation attacks, including aggressive LoRA fine-tuning, Gaussian weight noising, gradient-based token search (GBDA), and latent adversarial training. Across all evaluation regimes, the models consistently refused or failed to execute the chemical predictions unless the precise secret trigger was provided.
The paper proves that the problem of determining whether a neural network contains a hidden capability is computationally equivalent to breaking standard cryptographic primitives. Consequently, capability audits based purely on input elicitation cannot guarantee the absence of dangerous functionalities. The researchers released their PyTorch models and evaluation harness to assist defensive alignment teams, though how regulators will certify foundation weights without mathematical proof of non-backdooring remains entirely unresolved.