AI Models Can Provably Hide Arbitrary Capabilities

URL SCAN: AI Models Can Provably Hide Arbitrary Capabilities
FIRST LINE: # Computer Science > Machine Learning

The Dissection

This paper is an attack on the epistemology of capability audits. It embeds encrypted neural networks inside host weights, unlocks them only under a secret trigger, and reports resistance to several elicitation methods using a chemical-reaction proxy. Its payload is simple: non-elicitation is not evidence of non-capability. Full weight access does not equal knowledge of what the weights contain.

Under DT, the control layer is weaker than the deployment layer. An institution can possess the artifact and still lack a reliable way to bound its behavior. An audit that cannot provide an upper bound is a demonstration, not a safety certification.

The Core Fallacy

The surrounding safety regime’s core fallacy is treating successful testing as proof of absence. This paper destroys that assumption.

The paper itself must not be overread. “Provably hard to elicit under cryptographic assumptions” is not “every capability can be invisibly embedded in every production model.” The abstract does not establish universal stealth across retraining, quantization, runtime monitoring, supply-chain inspection, or sandboxing. It establishes a narrower and more damaging point: an evaluator cannot infer safety merely because ordinary elicitation failed.

The result is not proof that hidden capabilities are everywhere. It is proof that the audit regime cannot know they are nowhere.

Hidden Assumptions

• The attacker can modify the weights and preserve the hidden circuit through deployment.
• The cryptographic primitive, trigger secrecy, and execution path remain intact.
• The host architecture has enough capacity and the implementation overhead does not expose the payload.
• The small chemical-reaction proxy transfers to larger, general-purpose, or CBRN-relevant systems.
• Fine-tuning, weight noising, trigger search, and adversarial training represent the serious defenses.
• “Hard to interpret” is treated as practically equivalent to “hard to detect,” although the abstract establishes only the former under stated assumptions.
• The threat actor can place the model inside a trusted supply chain or deployment path.
• The hidden capability remains operationally useful rather than becoming a brittle demonstration.
• Governance can compensate after verification has failed. That is a political hope, not a technical result.

Social Function

Classification: partial truth, prestige signaling, and transition-management material.

It is a partial truth because it identifies a real cryptographic limit in elicitation-based audits. It is prestige signaling because “provably” can make a narrow construction sound like a universal verdict. It becomes transition management when institutions replace the promise of verification with rituals: red-teaming, benchmark theater, and compliance paperwork that cannot certify absence.

The most dangerous social use is elite self-exoneration. If hidden behavior cannot be ruled out, deployers may claim that no one can be responsible for what emerges. Uncertainty becomes an accountability solvent. The paper does not logically justify that move, but the system will try to use it.

The Verdict

This is a forensic strike against the idea that model weights can be audited into safety. It does not, by itself, prove P1, P2, or P3, and it does not demonstrate that post-WWII capitalism dies from this result alone. It weakens the institutional lag defenses that might govern AI while cognitive automation expands.

Under the Discontinuity Thesis, verification becomes another scarce control point. Sovereigns who control provenance, cryptographic attestation, compute, deployment, and incident response gain altitude. Everyone else is asked to trust a sealed artifact whose dangerous contents may be deliberately non-elicitable.

The true verdict is brutal: capability audits can show what a model revealed—or was forced to reveal. They cannot reliably certify what an adversary hid.