Hiding Capabilities in AI Models

Researchers have demonstrated that artificial intelligence models possess the ability to conceal arbitrary functionalities.

This finding challenges the core premise of capability evaluations, which generally rely on the idea that any hidden, potentially dangerous model behavior can be brought to light before deployment.

The team achieved this by developing backdoor attacks that embed encrypted neural networks directly within the weights of a host model. These hidden circuits only decrypt and run when a specific, secret trigger is presented.

Employing what they term "digital lockers," these embedded circuits remain provably difficult to extract or understand, even when an observer has complete access to the model's weights, extending prior research beyond simply hiding fixed strings to concealing complex computations.

The proof-of-concept constructions were implemented using PyTorch.

To test how these hidden features could be elicited, the researchers employed several techniques, including fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training.

They used a modest chemical reaction prediction task as a stand-in for capabilities relevant to CBRN threats.

The outcomes confirmed that these defensive methods were ineffective against the hidden capabilities. Coupled with their cryptographic assurances, this work exposes a definitive boundary for audits based on elicitation.

The team has made their models available to aid in the advancement of defensive measures.