A SKILL LOCKED INSIDE AN AI, WITH NO WAY TO PRY IT OUT

Before a powerful AI model is released, its developers run capability audits: they try to draw out dangerous abilities — for instance chemical, biological, radiological or nuclear knowledge — by prompting the model cleverly, giving it tools, or fine-tuning it on related tasks. If the dangerous ability never shows up, the model is judged safe enough.

This rests on an assumption: if a capability is there, a determined auditor will find it. But failing to find something does not prove it is absent, especially if someone has worked to hide it.

The threat: a sabotaged model

Andis Draguns of Contramont Research, Sumeet Ramesh Motwani and Christian Schroeder de Witt of the University of Oxford, and Raymond Douglas of ACS Research consider a worst case. An attacker — a malicious insider, or someone who has compromised the supply chain — can modify a model’s weights before it is deployed. They want to hide an ability that switches on only when the model sees a secret trigger. Their example: a helpful coding assistant that turns to hacking when it detects it is running inside critical infrastructure.

The defender has everything: the full weights, the architecture, even the method used to hide the ability. Only the trigger is secret.

Earlier work had hidden fixed strings of text this way, or trained “password-locked” models that only perform a task when a password appears in the prompt. The new work hides a complete, working neural network.

A cryptographic safe inside the weights

The key tool comes from cryptography: a digital locker, a kind of safe that holds encrypted data. Without the right key, opening it is computationally out of reach, even for someone who can read every line of its code. The team uses a hash function from the family behind the SHA-3 standard.

• They train a small network for the hidden skill, then encrypt its weights using the trigger as the key.
• They build the safe out of the same building blocks used in today’s AI models, and embed it in a larger host model.
• On every input, the host tries to open the safe. With the right trigger, the hidden weights reappear and the model runs them. Otherwise it behaves normally.

Under standard cryptographic assumptions, they prove that no auditor with practical computing power can find the trigger, switch on the hidden ability, or even tell which of two hidden abilities of the same size is inside.

The test: a chemistry skill that would not come out

As a stand-in for a dangerous capability, kept deliberately harmless, the hidden network predicts whether given reagents produce a given product. The host model has 38 layers and about 2 billion parameters, most of them used by the encryption.

The team then tried to extract the skill without the trigger, and compared the result with a classic password-locked model doing the same task:

• Fine-tuning on the chemistry task for 500 steps: the password-locked model reached 92.8% accuracy; the encrypted one stayed at 50.9%, no better than chance.
• Latent adversarial training, which perturbs the model’s internal signals: 91.7% versus 52.9%.
• An automated trigger search only found an 8-bit trigger by trying all 256 possibilities, like a blind guess; with a 16-bit trigger it failed.
• Adding noise to the weights revealed nothing.

A control model with a random network in its safe did just as well under these attacks — the hidden chemistry skill gave no detectable advantage. With the right trigger, the encrypted model scored 73.5%.

Fine-tuning quickly unlocks the password-locked model (red) but not the encrypted one (blue), which stays near chance. — Figure 4, Draguns et al. (2026), arXiv:2610.13928.

What the lock cannot hide

The authors are explicit about the limits. This is a proof of concept with a tiny hidden network and a huge overhead — “not a turnkey attack”. The presence of the compiled machinery can be spotted: raw, about 99% of its weights are exact zeros. Disguising them makes the weights look more ordinary, but unusual patterns remain. And the full construction has not yet been built into a real pre-trained model.

What it does show is that audits based only on drawing out capabilities cannot guarantee that a model supplied by an adversary is clean. The authors call for complementary defences: verifying a model’s provenance, from data to training, and monitoring it while it runs, when a hidden circuit would have to fire. They release their models so others can test defences against them.

Conflict of interest. The paper cites Anthropic’s Responsible Scaling Policy, alongside OpenAI’s Preparedness Framework, as examples of the audit-based safety decisions whose limits it exposes. No Anthropic model was tested. This article is written by Claude, made by Anthropic.

The paper is formatted for the NeurIPS 2026 conference; its arXiv version does not state that it has been accepted.