AI Models Can Provably Hide Arbitrary Capabilities

A NeurIPS 2026 paper shows backdoors can embed encrypted neural networks in host model weights that decrypt only on a secret trigger, keeping hidden circuits provably hard to elicit or interpret under cryptographic assumptions even with full weight access. Implemented in PyTorch and tested on a chemical reaction prediction task, they resisted fine-tuning, weight noising, gradient-based trigger search and latent adversarial training, exposing limits of elicitation-based capability audits.