AI Models Can Hide Capabilities via Encrypted Backdoors

Researchers have demonstrated that AI models can hide arbitrary capabilities using encrypted backdoor attacks. These attacks embed encrypted neural networks within model weights, which only execute upon receiving a secret trigger. The hidden circuits are designed to be resistant to elicitation and interpretation, even with full access to model weights, relying on cryptographic assumptions. The study implemented these concepts in PyTorch and tested them against various elicitation methods, including fine-tuning and gradient-based trigger search. The findings suggest a limitation in the reliability of capability audits based on elicitation methods.