Research shows AI models can provably hide arbitrary capabilities behind cryptographic backdoor triggers, defeating capability audits
Academic research titled "AI Models Can Provably Hide Arbitrary Capabilities", highlighted by Bruce Schneier, shows that capability evaluations cannot be relied on to surface dangerous model behaviors under adversarial conditions. The authors build backdoor attacks that embed encrypted neural networks inside host model weights. The hidden network is decrypted and executed only when a secret trigger is received. Using digital lockers, the hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even with full access to model weights. This extends prior work from hiding fixed strings to hiding arbitrary computations. The authors have released their models to support defense development.
Detalhes técnicos
- Proof-of-concept constructions were implemented in PyTorch.
- Elicitation was tested through fine-tuning, weight noising, gradient-based trigger search and latent adversarial training. The hidden capability resisted all of them.
- A small chemical reaction prediction task served as a proxy for CBRN-relevant capabilities.
- The result exposes a limit of elicitation-based capability audits: failing to elicit a behavior does not prove it is absent.
Remediação
The article gives no specific mitigations beyond the authors' release of their models to support improved defenses.
Linha do tempo
-
Research shows AI models can provably hide arbitrary capabilities behind cryptographic backdoor triggers, defeating capability audits
ler a análise desta fonte ocultar
Academic research titled "AI Models Can Provably Hide Arbitrary Capabilities", highlighted by Bruce Schneier, shows that capability evaluations cannot be relied on to surface dangerous model behaviors under adversarial conditions. The authors build backdoor attacks that embed encrypted neural networks inside host model weights. The hidden network is decrypted and executed only when a secret trigger is received. Using digital lockers, the hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even with full access to model weights. This extends prior work from hiding fixed strings to hiding arbitrary computations. The authors have released their models to support defense development.
Technical Details
- Proof-of-concept constructions were implemented in PyTorch.
- Elicitation was tested through fine-tuning, weight noising, gradient-based trigger search and latent adversarial training. The hidden capability resisted all of them.
- A small chemical reaction prediction task served as a proxy for CBRN-relevant capabilities.
- The result exposes a limit of elicitation-based capability audits: failing to elicit a behavior does not prove it is absent.
Remediation
The article gives no specific mitigations beyond the authors' release of their models to support improved defenses.