You cannot eval what is encrypted: models can provably hide arbitrary capabilities
Every capability evaluation rests on one assumption: if the model can do the dangerous thing, a good enough red team can get it to show you. A paper from Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas and Christian Schroeder de Witt says that assumption is false against an adversarial developer, and proves it rather than arguing it. The construction embeds an encrypted neural network inside the host model's weights. The hidden circuit is decrypted and executed only when a secret trigger arrives. Using digital lockers, the authors show the hidden computation is provably hard to elicit or interpret under standard cryptographic assumptions even with full white-box access to the weights. Prior work could hide a fixed string; this hides an arbitrary program.
They built it in PyTorch and then attacked their own models the way an auditor would: fine-tuning, weight noising, gradient-based trigger search, latent adversarial training. The hidden task was chemical reaction prediction, chosen as a stand-in for CBRN-relevant capability. None of the elicitation methods recovered it. The models are released so defenders can try harder.
Read this next to the week's other news. Anthropic took all internal evals offline on October 9. The UK AI Security Institute tested Gemini 4 Argon before today's launch. Google says it monitors internal activations to catch misuse. Reuters reported the same day that the labs have been negotiating how much outside evaluators get to publish. All of that assumes the evaluator can find what is there. This paper says a developer who wants to pass an audit can ship a model that passes it and still carries the capability, and the audit cannot tell. The practical conclusion is uncomfortable: weight access is not enough, so the trust has to move upstream to training provenance and who had write access to the checkpoint. HN pushed it to 270 points with the obvious question in the comments, which is whether a non-adversarial lab can do this to itself by accident. The paper does not claim that, and it is the question that matters for the evals-offline story.
Links: https://arxiv.org/abs/2610.13928 , https://news.ycombinator.com/item?id=50065692
← Back to all articles
They built it in PyTorch and then attacked their own models the way an auditor would: fine-tuning, weight noising, gradient-based trigger search, latent adversarial training. The hidden task was chemical reaction prediction, chosen as a stand-in for CBRN-relevant capability. None of the elicitation methods recovered it. The models are released so defenders can try harder.
Read this next to the week's other news. Anthropic took all internal evals offline on October 9. The UK AI Security Institute tested Gemini 4 Argon before today's launch. Google says it monitors internal activations to catch misuse. Reuters reported the same day that the labs have been negotiating how much outside evaluators get to publish. All of that assumes the evaluator can find what is there. This paper says a developer who wants to pass an audit can ship a model that passes it and still carries the capability, and the audit cannot tell. The practical conclusion is uncomfortable: weight access is not enough, so the trust has to move upstream to training provenance and who had write access to the checkpoint. HN pushed it to 270 points with the obvious question in the comments, which is whether a non-adversarial lab can do this to itself by accident. The paper does not claim that, and it is the question that matters for the evals-offline story.
Links: https://arxiv.org/abs/2610.13928 , https://news.ycombinator.com/item?id=50065692
Comments