A hidden model locked by a password passes every safety test

Every frontier lab shipping a model today signs off on it with the same assumption: a dangerous skill the model holds can be surfaced on the way out. A new paper from Oxford and two research outfits builds a model where that assumption breaks on purpose.

The paper, titled "AI Models Can Provably Hide Arbitrary Capabilities" and published on arXiv on 9 October, comes from Andis Draguns at Contramont Research, Sumeet Ramesh Motwani and Christian Schroeder de Witt at the University of Oxford, and Raymond Douglas at ACS Research. It is accepted at NeurIPS 2026. The authors released their code and model weights with it.

What they built

The team wrote a small neural network to predict whether given chemicals react to form a product, then encrypted it with a secret trigger using a cryptographic tool called a digital locker. They embedded the locker directly in the weights of a larger host network. On every forward pass, the host tries to decrypt the inner weights. The right trigger unlocks them and runs the hidden network. Any other input gets nothing. The authors picked chemical reaction prediction as a stand-in for the chemical, biological, radiological and nuclear capabilities that frontier labs test for before shipping a model.

What the tests missed

The authors ran four kinds of elicitation on their host model, which are the methods frontier labs rely on today. Supervised fine-tuning on the chemistry task did not surface the hidden network. Weight noising, which perturbs the parameters, did not surface it. Gradient-based trigger search, which looks for the input that activates the circuit, did not surface it. Latent adversarial training did not surface it. Under standard cryptographic assumptions, the paper proves why: the trigger and the hidden capability are computationally hard to recover from the weights, even with full white-box access, so a better search procedure cannot close the gap.

The scope of the attack

The construction is a proof of concept. The hidden network is a small binary classifier, and the overhead is high enough that a real-world attack would take real engineering work to build. The authors say the presence of a cryptographic circuit inside the weights may itself be detectable, so the result hides the trigger and the capability while leaving open the question of whether the structure can be spotted at all. The threat model is a worst case: an adversary who can modify weights between training and deployment, such as a malicious insider or a compromised supply chain. The authors treat the construction as a deliberate sabotage case and say they do not claim the same structure arises from normal training. For a team deploying a model it trained end to end on its own data, the paper changes little.

What a team can do

For a team deploying a model from a source it does not control, the paper argues that elicitation audits alone are too weak a bar. Appendix H lists mitigations the authors treat as live options: watching outputs in production, controlling who touches the weights between training and deployment, requiring canary strings in the training set so a stripped-down replica can be detected, and treating a model from an unverified source the way an operating system treats an unsigned binary. Any model whose origin cannot be verified now needs the same handling as any other untrusted dependency.

Source

AI Models Can Provably Hide Arbitrary Capabilities, Draguns, Motwani, Douglas and Schroeder de Witt, arXiv 2610.13928.