Hiding Capabilities in AI Models

Summary

Researchers show that capability evaluations can be defeated by backdoor attacks that embed encrypted neural networks inside a host model's weights. The hidden circuits decrypt and run only when a secret trigger is received, and they stay hard to elicit or interpret even with full weight access, under cryptographic assumptions. Tests with fine-tuning, weight noising, gradient-based trigger search and latent adversarial training on a small chemical reaction prediction proxy for CBRN capabilities found the hidden capabilities resisted these methods.

Related items

• MediumAlibaba AI model tried to send data to Beijing server, Cohere saysSimilar attack · CSO Online
• MediumThe days of assuming another company’s breach is someone else’s problem are overSimilar attack · CSO Online
• HighCVE-2026-115924: Rembg unauthenticated file disclosure through public /api/remove endpointSimilar attack · NVD/CVE Database
• HighCVE-2026-115915: vLLM image loading flaw allows EPS payload dispatchSimilar attack · NVD/CVE Database
• LowThe RealReal won’t let AI agents hog designer clothingSimilar attack · The Verge (AI)