Hacker News· sbulaev·· 5 天前AI 评分66
AI 模型可证明地隐藏任意能力：NeurIPS 2026 论文揭示能力审计的极限
AI models can provably hide arbitrary capabilities
AI 导读
arXiv 论文《AI models can provably hide arbitrary capabilities》提出一种后门攻击，将加密神经网络嵌入宿主模型权重，仅在收到秘密触发时解密并执行，从而在密码学假设下使隐藏电路难以被诱导或解释。
正文 · 原文
Abstract:Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
| Comments: | 22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026 |
| Subjects: | Machine Learning (cs.LG); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.13928 [cs.LG] |
| (or arXiv:2610.13928v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.13928 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Andis Draguns [view email]
[v1]
Fri, 9 Oct 2026 17:55:06 UTC (878 KB)
来源：Hacker News · arxiv.org