Researchers show AI models can hide encrypted capabilities in their weights that only activate on a secret trigger
- Researchers Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt built backdoor attacks that embed encrypted neural networks inside host model weights, decrypting and running them only when a secret trigger is received
- Using digital lockers, the hidden circuits are provably hard to elicit or interpret under cryptographic assumptions, even for someone with full access to the model weights
- The paper extends earlier work that hid fixed strings so that it now covers arbitrary computations
- The proof of concept was implemented in PyTorch and tested on a small chemical reaction prediction task that stands in for CBRN-relevant capabilities
- Fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training all failed to surface the hidden capability, and the authors released their models to support defense work (paper accepted at NeurIPS 2026)
Hacker News opinions
Only a matter of time before this got published. LLMs were always a decent way to exfiltrate targeted data. It's basically an encrypted payload that only decrypts when it sees the right input.
Did this research actually need to happen? After the xz mess we all worried about binary blobs, and now everyone runs giant binary blobs with access to their filesystems and accounts.
They proved it's possible by building it themselves. Whether anyone is actually doing this in the wild is still unknown.
My worry with open models is that someone gives them away free with a sleeper trigger baked in. Local setups still tend to have web search connectors, so that's bad.
The open weight vs closed debate is really a publisher trust debate. Open weights can at least be scrutinized for this kind of thing. Closed models make you trust the publisher 100%.
This is cool, but it also follows from Rice's theorem. Any expressive enough program has runtime behavior you can't catch with static analysis, so you have to run it to see what it does. There's also an openreview paper on backdoors that can't be probed at all.
I think it's trivially detectable with current weights, so the framing feels a bit misleading. It's a demo that holds encrypted secrets, not much more.
Proof of concept work on poison pills is still useful, though. I don't see a theoretical reason an attacker couldn't someday make one indistinguishable from normal weights.
Wouldn't this break easily under fine-tuning or abliteration? In practice the cryptographic circuits seem to survive far more weight noise than the language parts do, so they're often more robust than the English-knowing part of the model.
More accurate title would be capabilities can be hidden in model weights by encryption. It's not about AI agents hiding what they can do.
So what's the use of this? Without having read the article, I'd guess it shows benchmarks alone can't reliably tell you what a model can do without knowing how it was trained.