Researchers Build AI That Hides a Skill From Its Tests

Researchers say they have built a model with an encrypted capability that ordinary tests failed to expose, raising a security problem for anyone relying on tests to certify what AI cannot do. ^{[1] [2]}

Their paper, submitted to arXiv on October 9, 2026, describes embedding a hidden neural network inside a larger model. A secret trigger activates it. According to the authors, recovering that trigger or identifying the concealed capability is computationally hard even for an inspector with full access to the model's weights, the numerical values that govern its operation. ^{[1] [2]}

The work concerns deliberate tampering: someone with the power to change those weights before deployment could install a capability designed to stay hidden during evaluation. The authors' small demonstration used a chemical-reaction prediction task, and they report that four methods intended to draw out concealed abilities failed to reveal it. ^[2]

The practical lesson is that an evaluation showing no sign of a skill cannot, by itself, certify that the skill is absent. If the object being tested has been engineered to frustrate inspection, testing its behaviour is only part of the security job. The integrity of the model's construction and delivery matters too.

The paper, AI Models Can Provably Hide Arbitrary Capabilities, is by Andis Draguns of Contramont Research, Sumeet Ramesh Motwani and Christian Schroeder de Witt of the University of Oxford, and Raymond Douglas of ACS Research. It says it was accepted at NeurIPS 2026, an AI research conference. The findings here come from the authors' paper and summary, rather than an independent reproduction. ^{[1] [2]}

A skill behind a lock

A capability test normally asks a model to perform a task and measures the result. Success establishes that it can do something under those conditions. Failure has more possible explanations. The model may lack the skill, or the test may simply have failed to bring it out.

The researchers examine an especially difficult version of that second possibility. Their construction embeds an encrypted neural network within a host model's weights, with a secret trigger controlling whether the hidden network runs. The concealed component is executable: it can perform a task once activated. According to the authors, this extends earlier work on hiding fixed strings or password-protected behaviours to hiding neural networks themselves. ^[2]

That changes what an inspector is trying to uncover. Finding a hidden answer means recovering a piece of information. Finding a hidden network means uncovering a mechanism that can produce answers to new inputs. A locked capability can therefore be more consequential than a locked message.

The central device is a digital locker, a program holding encrypted data that is computationally infeasible to decrypt without the correct secret, even when someone can inspect its implementation. The researchers use that idea to protect the concealed network. Their guarantees depend on stated cryptographic assumptions: that the mathematical problems underpinning the protection remain hard to solve. ^[2]

"Computationally infeasible" is a claim about the difficulty of doing the work, rather than a claim that no answer exists. An auditor can possess the model's weights without having a practical way to extract the protected capability. Access to the object and access to what it conceals are different things.

This is why the paper matters beyond the familiar concern that an AI system might perform poorly during a test. The authors frame the problem as security against an actor deliberately modifying the model. The construction does not require a model to decide that deceiving an evaluator would serve its interests. Someone installs the concealment. ^[2]

That puts responsibility in a more concrete place. For this threat, the important questions concern who could alter the weights, what they could insert and how an auditor would discover the change. Debates about a model's intentions would miss the mechanism the paper studies.

Four tests, one concealed task

The proof of concept used a small neural network that predicts whether specified chemical reagents would yield a candidate product. The authors describe it as a constrained proxy for a capability relevant to chemical, biological, radiological and nuclear risk assessment. ^[2]

The task gives the researchers a specific ability to hide and a specific result to look for. Instead of asking whether a model has become generally more dangerous, they can ask whether their testing methods recover this embedded predictor. That makes the experiment narrow, but legible.

They report trying four approaches: supervised fine-tuning, weight noising, gradient-based trigger search and latent adversarial training. None elicited the hidden task in their experiments. ^{[1] [2]}

Those names describe different ways of probing a model. Supervised fine-tuning trains it further using examples of the desired behaviour. Weight noising perturbs its numerical settings.

Gradient-based search uses information about how changes affect a result to hunt for an activating input. Latent adversarial training probes internal representations, rather than relying only on ordinary prompts.

The reported failures matter because the researchers did more than ask a few questions and receive unhelpful answers. They tried to alter, train and search the model in ways intended to expose its hidden function. The capability still stayed concealed in those experiments. ^[2]

The evidence has a firm boundary. This is a small, deliberately constructed proof of concept with substantial overhead, and the authors say it is not a turnkey attack.

It does not demonstrate harmful chemical or biological activity, concealment in any deployed model, or the emergence of these cryptographic structures through ordinary training. A small hidden circuit augmenting an already capable host remains to be demonstrated. ^[2]

The result is still useful. A narrow experiment can establish a failure mode worth investigating without establishing how often it occurs or how cheaply an attacker could reproduce it. Here, the authors pair their experimental results with a conditional theoretical argument that the concealed capability can resist recovery. ^[2]

Those are two different kinds of evidence. The experiments say what happened when the researchers tried particular methods against their construction. The cryptographic argument addresses why recovery should be hard under its assumptions. Four failed methods alone would not justify a universal claim about every possible test.

Inspecting the weights is not the finish line

Giving auditors access to model weights allows them to examine more than a stream of answers. The paper challenges the idea that such access necessarily resolves a hidden-capability problem: the authors say the trigger and embedded capability can remain hard to recover or identify even with full weight access. ^[2]

For a security review, that is a reason to separate three questions. Can the inspector detect something suspicious? Can the inspector work out what it does? Can the inspector activate it? These questions need different answers.

The authors acknowledge that the presence of a compiled circuit, the hidden network and its protective machinery after they have been built into the model's weights, may itself be detectable. Their claim about protecting the trigger and capability therefore does not amount to a promise that the construction leaves no visible trace. ^[2]

That gives defenders a useful opening. An auditor does not necessarily need to unlock a suspicious component before deciding that a model should be investigated or withheld from deployment. A reliable sign of tampering could be enough to stop it from passing an inspection.

The strongest practical objection to the paper is consequently straightforward: if the construction is costly and conspicuous, an attacker may gain little from making its contents hard to recover. Concealment is less useful when the container advertises that something has been concealed.

That objection limits the immediate threat. It does not rescue a certification process that treats unsuccessful capability tests as proof of absence. Detecting the circuit would be a separate defensive success, achieved by inspecting for tampering rather than by eliciting the hidden task.

There is another useful boundary to the guarantee. The authors say it concerns extracting or activating the capability embedded in their construction. It does not prevent an auditor from learning the same task independently using outside data. ^[2]

An inspector might therefore build a chemical predictor without unlocking this one. That would establish knowledge of the task, but it would not answer what was installed in the inspected model. In a security investigation, reproducing a skill and identifying an unauthorised component are different jobs.

The security question comes before deployment

The threat model names actors able to modify weights before deployment, including a malicious insider or a compromised supply chain. The paper studies their ability to sabotage a model deliberately. ^[2]

That framing points towards a broader audit than a battery of prompts. Evaluators should care about the origin and handling of the weights they receive, as well as the behaviour those weights produce. A model that passes a test has passed that test. Turning the result into an assurance about everything it could do requires more evidence.

This is a reason to improve testing, not abandon it. Behavioural evaluations can demonstrate capabilities, measure performance and expose failures. Their value does not depend on making an impossible promise that every negative result proves permanent incapacity.

The research also gives defense work a concrete target. The authors say they release their models to support that work. The next step is to establish that the models and implementation are accessible for independent examination, then test whether other researchers reproduce the reported results. ^{[1] [2]}

Practical scrutiny should focus on the construction's costs and traces: how much extra computation it requires, whether that burden can be reduced, and whether auditors can reliably spot the compiled circuit without recovering its secret. Those questions determine whether this remains an expensive demonstration or becomes a credible deployment threat.

Independent researchers now need to try both sides of it: reproduce the concealment, then find a way to detect it. The most useful next result may be an auditor who cannot unlock the hidden network but can still stop it at the door.