AI Models Can Secretly Hide Dangerous Abilities
A new study shows hidden skills can be locked inside AI models in ways that security tests cannot reliably uncover.
Proof That Hidden Skills Can Be Locked Inside Models
A research team has demonstrated that AI models can conceal arbitrary abilities in ways that are provably resistant to discovery. The work was published on arXiv and accepted at the NeurIPS 2026 conference by Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, and Christian Schroeder de Witt 1.
The finding challenges a core assumption behind how the AI industry tests model safety. Capability evaluations try to surface dangerous behaviors before models are released. These evaluations generally rely on the belief that hidden abilities can eventually be elicited, or brought out, through enough testing. The new research shows that this belief can fail.
How the Hidden Capabilities Work
The researchers built a technique based on a type of backdoor attack. A backdoor attack embeds a separate, hidden program inside a larger system so that it only activates when a secret trigger is present. In this case, the hidden program is an encrypted neural network that lives inside the weights of a host model. It stays locked away until a specific trigger signal is provided, at which point it decrypts and runs.
To keep these hidden circuits secure, the team used a method called a digital locker. A digital locker is a cryptographic tool that locks data behind a key so that it cannot be read or understood without the correct password. Even if someone has full access to the model weights, the hidden circuit remains protected under standard cryptographic assumptions 1. This is a step up from earlier research, which showed how to hide only fixed pieces of text, rather than full computations.
Testing Against Common Detection Methods
The researchers implemented their proof of concept in PyTorch, an open-source machine learning library. They tested the system using a small chemical reaction prediction task, which they used as a stand-in for dangerous chemical, biological, radiological, or nuclear capabilities.
They then tried to force the hidden capabilities out using several well-known methods: fine-tuning, weight noising, gradient-based trigger searches, and latent adversarial training. Fine-tuning retrains a model on new data, while weight noising adds random interference to model parameters to see if hidden structures are disturbed. A gradient-based trigger search tries to reverse-engineer the secret signal that activates the backdoor. None of these approaches were able to elicit the hidden circuit 1.
What This Means for AI Audits
The results suggest that elicitation-based audits, the kind of security reviews that try to provoke hidden behaviors, have real limits. If a dangerous capability is encrypted and locked in this way, standard testing may never reveal it. The researchers say their work is meant to highlight this problem and improve defenses, not to encourage abuse. They have released their models to help the research community develop better protections.
The finding does not mean that all AI safety testing is useless. It does mean that relying only on elicitation is insufficient, and that stronger safeguards may need to combine multiple detection strategies.
Key facts
- Hidden capabilities can be encrypted inside model weights using a backdoor technique
- Even full access to model weights cannot reliably uncover the hidden circuit
- The research used a digital locker method based on cryptographic assumptions
- Tests included fine-tuning, weight noising, trigger search, and adversarial training
- The work was accepted at NeurIPS 2026