Can an AI Model Hide a Skill That No Test Can Find?
Safety teams test AI models for dangerous skills. This preprint hides an encrypted skill inside a model's weights, and the usual tests could not draw it out.
In one paragraph
This preprint shows that a deliberately built AI model can carry an encrypted skill that safety tests do not surface. The authors lock a small classifier's weights in cryptographic digital lockers inside a larger model, which runs it only for a private trigger. After 500 steps of fine-tuning, a password-locked model reached 92.8% on the hidden chemistry task, while the encrypted model stayed at 50.9%, close to guessing. It is a small, costly proof of concept.
How can a skill be hidden inside an AI model's weights?
Safety teams run capability evaluations before release: they prompt and sometimes fine-tune a model to surface dangerous abilities, such as chemical know-how. If nothing comes out, the ability is usually treated as absent.
The authors imagine an attacker, such as a malicious insider or a compromised supply chain, who can edit a model's weights before it ships. They train a small classifier and lock each of its weight matrices in a digital locker: a hash-based program that releases its contents only for the right key, even to someone who can read all of its code. The lockers are compiled into the layers of a larger model. On every input the model tries to unlock them; with the private trigger the hidden network runs, and otherwise an ordinary model answers.
The hidden task predicts whether chemical reagents yield a given product, a deliberately limited stand-in for weapons-relevant chemistry. The authors then tried to draw it out without the trigger, using supervised fine-tuning on the exact task, weight noising, gradient-based trigger search and latent adversarial training, and compared the results with a normally trained password-locked model.
Did fine-tuning reveal the hidden skill?
Not for the encrypted model. After 500 steps of supervised fine-tuning, the password-locked model reached 92.8% accuracy on the chemistry task, while the encrypted model stayed at 50.9%, close to the 50% expected from guessing.
A control model whose locker held a random network scored 50.6% under the same fine-tuning, so the hidden chemistry skill gave no visible advantage. Latent adversarial training reached 52.9%. Trigger search found an 8-bit trigger only by trying every candidate, no better than random search, and with a 16-bit trigger it reached 52.7%.
With the correct trigger, the hidden classifier ran at 73.5% accuracy. On a second task, subset parity, which gradient training struggles to learn, fine-tuning lifted the password-locked model to 100% while the compiled model stayed at chance.
Why does this matter for AI safety testing?
Many safety decisions rest on the idea that if a determined evaluation cannot draw out a capability, the model does not have it. This study shows that, against a deliberate attacker who controls the weights, that inference can fail.
The authors frame this as the difference between safety and security: ordinary testing assumes average cases, while sabotage calls for worst-case thinking. They point to complementary defences that do not depend on eliciting a skill, such as verifying how a model was produced and monitoring it while it runs.
A fair reading is that the work is a warning about the limits of testing models from untrusted sources, rather than evidence that current models hide anything.
What are the limits of this hidden capability study?
Read before you quote it
This is a preprint that has not been peer reviewed, and its limits are clear:
- Small proof of concept. The hidden classifier has 672 ternary weights, yet the compiled model has 38 layers, with roughly 95% of its parameters spent on the locking circuits.
- Not built into a real language model. Only individual compiled units were checked inside Gemma 3 270M; the full construction was not integrated into a pretrained model.
- Possibly detectable. About 99% of the raw compiled weights are exact zeros; disguising them helped, but unusual patterns remained.
- Reduced security settings. Experiments used 8- or 16-bit triggers so they would run quickly, over 3 runs per setting.
The study does not show that today's AI models hide skills this way, or that such circuits arise through ordinary training. It also does not show that a model containing one cannot be flagged as suspicious: the guarantee is only that the hidden skill cannot be unlocked or identified.
- It does not show that real AI models hide skills this way, or that such circuits arise through ordinary training.
- It does not show that a model with a hidden circuit cannot be flagged as suspicious; it only shows the hidden skill cannot be unlocked or identified.
- It is a small proof of concept: the hidden classifier has 672 ternary weights, yet the compiled model needed 38 layers, with roughly 95% of its parameters spent on the hash circuits.
- The full construction was not built into a pretrained language model; only individual compiled units were checked inside Gemma 3 270M.
- The unusual weights can betray that something is hidden: about 99% of raw compiled weights are exact zeros, and even after obfuscation unusual correlations remain.
- Experiments used reduced security settings for speed, with triggers of 8 or 16 bits.
Takeaways
- saysFine-tuning drew the skill out of a password-locked model at ninety-two point eight percent, but left the encrypted model at fifty point nine, a coin flip.
- saysTrigger search and latent adversarial training also failed once the trigger was sixteen bits, so the hidden skill couldn't be unlocked or identified.
- saysIt's a small, costly proof of concept that may still look suspicious, and it hasn't been built into a real language model.
- explainsA digital locker is a program that releases its hidden contents only for the right key, even to someone who can read its full code.
- interpretsA fair reading is that failing to find a dangerous skill in a model from an untrusted source is not proof that the skill is absent.
Ask the paper
In PaperSays you can ask this paper anything, by text or by saying “Hey Aiden”. Three questions listeners asked:
Can an AI model hide a capability from safety tests?
In this preprint, a deliberately built model kept an encrypted skill hidden from fine-tuning and other tests, but only in small proof-of-concept models. Hear the full answer in the app →
Why didn't fine-tuning reveal the hidden skill?
The skill's weights are encrypted and only unlocked by a private trigger, so training without it gave no advantage over a random control. Ask in the app →
Could an auditor spot a model like this?
Possibly: the raw compiled weights are about 99% exact zeros and show unusual patterns, even though the skill itself stays locked. Ask in the app →
Briefing reviewed by an editor before publication. The paper belongs to its authors; this page summarises it and links to the original. Paper licence: CC BY 4.0. Corrections: support@papersays.com.