A paper accepted at NeurIPS 2026 has proven that an AI model can be made to conceal an arbitrary hidden capability from every known class of pre-deployment safety evaluation — not through clever behavioral training that better elicitation could eventually uncover, but through a cryptographic barrier whose security guarantee is as strong as SHA-3. The finding sets a formal mathematical ceiling on what capability audits can ever learn, and that ceiling is set by the hardness of inverting a standard hash function — not by how many compute hours an evaluator spends or how sophisticated their methods become.

The paper, titled AI Models Can Provably Hide Arbitrary Capabilities and posted to arXiv on October 9, describes a technique for embedding an entire encrypted neural network inside the weights of a host model. The hidden network executes only when a secret trigger is present; without that trigger, under standard cryptographic assumptions, the capability is computationally infeasible to recover or even confirm, even for an evaluator with complete access to the model's weights, architecture, and the embedding procedure itself.

The authors write that capability absence cannot be proven by a failure to elicit it, "particularly under adversarial conditions."

This is a different kind of finding than prior work on AI evaluation limits. Organizational audits run out of time, red-teaming teams run out of budget, benchmarks saturate before they can be replaced. The NeurIPS 2026 result says something harder: there exists a class of hidden capability that no elicitation effort — however large, however well-funded, however technically sophisticated — can surface, because the barrier is not practical but mathematical.

What Researchers Built: Encrypted Weights, Not Hidden Behavior

The construction works as a weight-based supply chain attack. An adversary who can modify model weights before deployment — a malicious insider, or a compromised element of the fine-tuning or distribution chain — uses a compilation framework the authors built in PyTorch to embed a hidden capability that survives any polynomial-time audit.

The process has three layers. First, the hidden neural network is compiled into a linear threshold circuit — a representation of arbitrary computation as interconnected threshold logic gates, analogous to how hardware logic is specified in chip design. Second, each weight matrix of the hidden network is locked under a cryptographic primitive called a digital locker using the SHA-3 Keccak family of hash functions. Third, on every forward pass, the host model attempts to decrypt those lockers: with the wrong input, decryption fails and the model behaves normally; with the correct trigger, the weights are recovered and the hidden network executes, producing output that reflects the concealed capability rather than the host model's ordinary behavior.

The security guarantees are formal. Under the random oracle model — the standard assumption used to reason about hash function security — an adversary given full white-box access to the modified model cannot, in polynomial time, find an input that unlocks the locker, nor determine which of two equal-size hidden capabilities is present. The trigger space is constrained to ensure sufficient entropy against polynomial-time adversaries. The authors use the full SHA-3 Keccak hash, which has been extensively validated in security-critical deployment.

The key distinction from prior work on hidden AI behavior is what the adversary faces. Earlier work on "password-locked" models — models fine-tuned to reveal a capability only when a password appears in the prompt — hides capabilities through learned behavior that gradient-based methods can override. The encrypted construction hides capabilities through a cryptographic barrier that gradient descent cannot cross.

Every Known Elicitation Method Failed

To demonstrate that the formal guarantees hold against the techniques actually used in safety evaluations, the researchers tested their construction against four elicitation classes, all failing.

Supervised fine-tuning — training the model on labeled examples of the hidden task in hopes of activating latent capabilities — produced accuracy indistinguishable from a random baseline: roughly 50.9 percent on a binary classification task. A password-locked model performing the same task reached 92.8 percent under the same fine-tuning budget.

Latent adversarial training, a technique developed specifically to surface hidden behaviors by adversarially perturbing a model's internal activations, achieved 52.9 percent accuracy against the encrypted model — again indistinguishable from a random result. The password-locked baseline reached 91.7 percent.

Gradient-based trigger search, using the Greedy Coordinate Gradient method that optimizes discrete inputs to elicit target behaviors, achieved 73.5 percent accuracy on an 8-bit trigger — but only by exhaustively enumerating all 256 possible 8-bit triggers, performing no better than query-matched random search. With a 16-bit trigger (65,536 possibilities), GCG dropped to 52.7 percent accuracy under a realistic query budget, with no advantage over random.

Weight noising — injecting noise into model weights at two scales to disrupt hidden circuits — had no material effect on elicitation results for either model.

The contrast with the password-locked baseline is stark in every case: every method that failed completely against the encrypted model succeeded readily against the non-cryptographic baseline. This is the expected result. The password-locked model hides its capability through training; gradient descent, applied with enough effort, can undo training. The encrypted model hides its capability through SHA-3; breaking that requires inverting a hash function.

Why Chemical Reactions: CBRN Evaluations as the Target Audience

The task chosen for empirical demonstration is deliberate. Researchers selected reaction feasibility prediction — predicting whether a set of reagents can yield a particular chemical product, given molecule representations as binary fingerprints, using USPTO chemical patent database data.

Chemical, biological, radiological, and nuclear capabilities — collectively CBRN — are the central concern in frontier AI safety evaluations. Anthropic, OpenAI, and other developers treat CBRN uplift as a threshold category: a model that provides meaningful assistance with mass-casualty weapon development triggers escalating deployment restrictions under published AI safety frameworks. The authors selected reaction feasibility prediction because it captures the structure of CBRN capability evaluation — can the model predict the outcome of a chemical reaction? — while being deliberately constrained to avoid providing actual uplift.

The point is not that a binary chemical feasibility classifier is itself the threat. It is that if a sophisticated adversary can embed any arbitrary neural network in the weights of a general-purpose model, they can embed a network trained on any task — including ones far more dangerous than binary feasibility classification — and that network will survive evaluation intact.

Weight Access Is Already Widely Distributed

The paper's threat model assumes deliberate sabotage: a malicious insider or a compromised element of the supply chain. The authors are explicit that their cryptographic structures do not arise through normal gradient descent, and that the construction describes what a sophisticated adversary can do, not what an AI system spontaneously does.

What makes that threat model worth taking seriously is not a hypothetical future scenario — it is the current state of AI deployment infrastructure. Models are distributed through supply chains, fine-tuned by third parties under commercial agreements, optimized for inference by organizations that never participated in the original training, distilled into smaller variants by downstream developers, and integrated into production systems by companies whose security posture varies widely. The Hugging Face model hub alone hosts hundreds of thousands of model variants. The number of parties with access to modify weights between original training and end-user deployment continues to grow.

The weight-edit surface is large, and the digital locker construction does not require access to the original training procedure — only to the weights of an already-trained host model. An adversary with access to model weights at any point in that distribution chain can apply the technique. The paper establishes what they can do with it.

This is the finding that prior TechTimes coverage of AI evaluation limits has not captured: earlier reporting addressed how organizational constraints — limited red-teaming budgets, benchmark saturation, evaluation team size — prevent evaluations from surfacing capabilities that more effort could find. This paper establishes a class of hidden capability that more effort cannot find, embedded through a mechanism that already exists in the weight-access infrastructure of production AI deployment.

What the Construction Cannot Yet Do

The authors are careful about scope, and the paper spends considerable space on scope limitations the authors identify.

The security guarantee covers elicitability, not detectability. An auditor inspecting weights for anomalies might observe unusual sparse structures consistent with a compiled circuit. The paper does not claim the presence of such a circuit would be invisible — only that its trigger and capability cannot be recovered without the trigger. This is a weaker property than full undetectability, which prior theoretical work approached through different means in simpler architectures. The authors of a 2022 paper at FOCS showed that undetectable backdoors were theoretically possible without implementing them; the new work provides implementation at the cost of detectability. The authors note the detectability gap could be addressed through weight obfuscation in future work.

The current implementation also carries substantial computational overhead. A proof-of-concept model hiding a small binary chemistry classifier — a compact neural network with dimensions 64→8→16→2 and 672 ternary weights — requires a host model with 38 layers and approximately 2.07 billion parameters for proof-of-concept hiding. The cryptographic hash subcircuits account for roughly 95 percent of those parameters. A full-strength version using a 24-round Keccak hash and a 128-bit trigger yields a model with 110 layers and approximately 3.58 billion parameters.

These numbers make clear that this is not yet a practical attack. The overhead scales with the hidden network's size and the cryptographic security parameter; a future adversary trying to embed a substantially larger and more capable hidden network would require a correspondingly larger host model. The construction has also not yet been integrated into an existing pretrained model end-to-end — only individual compiled units have been verified to function correctly when inserted into Google's Gemma 3 270M. Incorporating the full construction into a frontier model remains future work.

The authors' own framing is explicit: "Our goal is to motivate security research and support the development of stronger defense methods before more practical variants emerge." They released their model weights and code for that purpose.

How This Research Program Progressed

The NeurIPS 2026 paper is the third major publication in a research program that began with a NeurIPS 2024 paper by overlapping authors demonstrating cryptographic backdoors in transformer models that hide fixed trigger-response strings. That earlier work introduced Stravinsky, a programming language for compiling programs directly into transformer weights, and demonstrated that arbitrary hash function evaluations could be embedded to make trigger search computationally infeasible.

The 2026 paper solves a more difficult problem: hiding not a fixed string but an entire executable neural network. The practical significance of that extension is large. Hiding a fixed string — a password that causes a model to reply "yes" to a specific query — is a limited attack. Hiding an executable network means an adversary can embed any trained capability: a classifier, a predictor, a generative module, or anything else expressible as a neural network. The space of what can be concealed expands from a single behavior to an arbitrary function.

The paper explicitly tracks this progression: Goldwasser et al. (2022) achieved theoretical undetectability without implementation; Draguns et al. (2024) achieved unelicitability with fixed-string payloads; the new work achieves white-box unelicitability with an executable model payload. The security property is the same; the payload capability has advanced from a lookup to a full computation.

What This Adds to the Evaluation Gap Literature

The finding lands in a widening literature on the limits of AI capability evaluations that has become increasingly policy-relevant.

The International AI Safety Report 2026, chaired by Yoshua Bengio with more than 100 expert contributors, formally identified an "evaluation gap" as a central finding, concluding that AI systems continued to advance rapidly while the methods used to test and manage their risks did not keep pace. The METR Frontier Risk Report, published in May 2026 after a pilot exercise with Anthropic, Google, Meta, and OpenAI, found that internal AI agents already possessed means, motive, opportunity to initiate small autonomous deployments. Research published by Barnett and Thiergart at MIRI found that one evaluated model's exploit rate rose with new scaffolding from 5 percent to 71 percent, suggesting that negative capability evaluations may reflect evaluator tool limitations more than actual capability ceilings.

Most of that literature identifies practical and organizational sources of the evaluation gap. The NeurIPS 2026 paper identifies something different: a mathematical limit that is not addressable through more evaluation effort or better organizational design. It establishes that under adversarial conditions, capability evaluations based on elicitation cannot provide the guarantee the current safety governance framework assumes they provide.

Pre-deployment capability evaluations are now a central pillar of AI safety governance. Frontier AI developers including Anthropic, OpenAI, and Google publish evaluation frameworks — Responsible Scaling Policies, Preparedness Frameworks, and Frontier Safety Frameworks — that condition deployment decisions on capability evaluation. The implicit assumption underlying all of these frameworks is that if evaluators try hard enough and use sophisticated enough techniques, they can surface any capability the model actually has. The NeurIPS paper shows that assumption fails under adversarial conditions.

Defensive Directions and Open Problems

The paper surveys possible mitigation strategies, none of which the authors claim is sufficient.

Zero-knowledge proofs of training provenance — cryptographic certificates that a model's weights were produced by a specified training procedure and not subsequently modified — could in principle rule out weight edits of this kind. This approach is technically feasible but imposes substantial computational and infrastructure costs, and no major AI developer currently requires or produces such certificates.

Anomaly detection on compiled weight structures — searching for the sparse, structured patterns characteristic of compiled circuits — could flag models for additional scrutiny. The authors note this defense is not robust: compiled weights could be obfuscated, and flagging heuristics would need to keep pace with new construction techniques.

Zero-knowledge proofs that any given output was produced by an unmodified version of a certified model would address the inference-time verification problem, but require cryptographic infrastructure that does not currently exist at scale.

The authors' decision to release their model weights and code is itself the most immediate contribution to defense: by making the attack concrete and reproducible, they create conditions for empirical defense evaluation before more capable or resource-efficient variants of the construction appear.

The paper adds a new class of hard constraint to a problem the AI safety community has treated, until now, as primarily a resource and effort problem. How thoroughly you can audit a model has always depended on how much compute you allocate and how clever your elicitation techniques are. The NeurIPS 2026 result establishes that under adversarial conditions, it also depends on whether you can break SHA-3 — and until that becomes computationally feasible, some things that could be in a model's weights will remain, provably, hidden.

Frequently Asked Questions

Does this mean existing AI models already contain hidden dangerous capabilities?

No. The construction requires deliberate weight modification by an adversary with access to the model before deployment — a malicious insider or a compromised supply chain. The authors are explicit that these structures do not arise through normal training. What the paper establishes is that such a modification, if made, could not be detected by any currently known evaluation method. The threat model is adversarial, not spontaneous.

How is this different from a "jailbreak" or a model that simply refuses to reveal certain behaviors?

Jailbreaks and behavioral suppression work by changing how a model responds to prompts. They can be reversed: fine-tuning on examples of the suppressed behavior, or adversarially perturbing a model's internal activations, can surface what was hidden. The encrypted construction works differently — it hides a capability behind a cryptographic key whose security is guaranteed by the mathematical hardness of inverting SHA-3, the same hash function used in security-critical cryptographic applications. No gradient-based method crosses that barrier because the barrier is not a learned behavior but a mathematical lock.

What would a practical version of this attack actually require?

The current proof-of-concept is computationally expensive: hiding a small binary classifier requires a host model of approximately 2.07 billion parameters, with about 95 percent of those parameters dedicated to SHA-3 hash evaluation circuits. A full-strength version with a 128-bit trigger and 24-round Keccak reaches approximately 3.58 billion parameters for full-strength.

A practical attack embedding a substantially larger and more capable hidden network would require a correspondingly larger host model, plus access to modify weights in a deployed or distributed model. The authors released their code explicitly so that defensive research can advance before more efficient implementations emerge.

What would actually stop this kind of attack if better elicitation cannot?

The paper surveys three candidate defenses, none currently deployed at scale. Zero-knowledge proofs of training provenance — cryptographic certificates proving that weights were produced by a specified training run and not subsequently modified — could in principle rule out weight edits entirely but require infrastructure no major AI developer currently provides.

Anomaly detection searching for the sparse, structured weight patterns characteristic of compiled circuits could flag models for scrutiny, though this defense could be circumvented by weight obfuscation. Zero-knowledge proofs verifying that each output was produced by an unmodified certified model would address the inference-time problem, but this cryptographic infrastructure doesn't exist at scale.