--- title: "Can an AI model hide a skill that safety tests can't find?" canonical: https://papersays.com/p/can-an-ai-model-hide-a-skill-that-no-test-can-find date: 2026-10-13 modified: 2026-10-13 hub: "AI & Machine Learning" doi: "10.48550/arXiv.2610.13928" license: "CC BY 4.0" --- # Can an AI Model Hide a Skill That No Test Can Find? > Safety teams test AI models for dangerous skills. This preprint hides an encrypted skill inside a model's weights, and the usual tests could not draw it out. This preprint shows that a deliberately built AI model can carry an encrypted skill that safety tests do not surface. The authors lock a small classifier's weights in cryptographic digital lockers inside a larger model, which runs it only for a private trigger. After 500 steps of fine-tuning, a password-locked model reached 92.8% on the hidden chemistry task, while the encrypted model stayed at 50.9%, close to guessing. It is a small, costly proof of concept. ## How can a skill be hidden inside an AI model's weights? Safety teams run capability evaluations before release: they prompt and sometimes fine-tune a model to surface dangerous abilities, such as chemical know-how. If nothing comes out, the ability is usually treated as absent. The authors imagine an attacker, such as a malicious insider or a compromised supply chain, who can edit a model's weights before it ships. They train a small classifier and lock each of its weight matrices in a digital locker: a hash-based program that releases its contents only for the right key, even to someone who can read all of its code. The lockers are compiled into the layers of a larger model. On every input the model tries to unlock them; with the private trigger the hidden network runs, and otherwise an ordinary model answers. The hidden task predicts whether chemical reagents yield a given product, a deliberately limited stand-in for weapons-relevant chemistry. The authors then tried to draw it out without the trigger, using supervised fine-tuning on the exact task, weight noising, gradient-based trigger search and latent adversarial training, and compared the results with a normally trained password-locked model. ## Did fine-tuning reveal the hidden skill? Not for the encrypted model. After 500 steps of supervised fine-tuning, the password-locked model reached 92.8% accuracy on the chemistry task, while the encrypted model stayed at 50.9%, close to the 50% expected from guessing. A control model whose locker held a random network scored 50.6% under the same fine-tuning, so the hidden chemistry skill gave no visible advantage. Latent adversarial training reached 52.9%. Trigger search found an 8-bit trigger only by trying every candidate, no better than random search, and with a 16-bit trigger it reached 52.7%. With the correct trigger, the hidden classifier ran at 73.5% accuracy. On a second task, subset parity, which gradient training struggles to learn, fine-tuning lifted the password-locked model to 100% while the compiled model stayed at chance. ## Why does this matter for AI safety testing? Many safety decisions rest on the idea that if a determined evaluation cannot draw out a capability, the model does not have it. This study shows that, against a deliberate attacker who controls the weights, that inference can fail. The authors frame this as the difference between safety and security: ordinary testing assumes average cases, while sabotage calls for worst-case thinking. They point to complementary defences that do not depend on eliciting a skill, such as verifying how a model was produced and monitoring it while it runs. A fair reading is that the work is a warning about the limits of testing models from untrusted sources, rather than evidence that current models hide anything. ## What are the limits of this hidden capability study? This is a preprint that has not been peer reviewed, and its limits are clear: - **Small proof of concept.** The hidden classifier has 672 ternary weights, yet the compiled model has 38 layers, with roughly 95% of its parameters spent on the locking circuits. - **Not built into a real language model.** Only individual compiled units were checked inside Gemma 3 270M; the full construction was not integrated into a pretrained model. - **Possibly detectable.** About 99% of the raw compiled weights are exact zeros; disguising them helped, but unusual patterns remained. - **Reduced security settings.** Experiments used 8- or 16-bit triggers so they would run quickly, over 3 runs per setting. The study does not show that today's AI models hide skills this way, or that such circuits arise through ordinary training. It also does not show that a model containing one cannot be flagged as suspicious: the guarantee is only that the hidden skill cannot be unlocked or identified. ## Takeaways - **SAYS** Fine-tuning drew the skill out of a password-locked model at ninety-two point eight percent, but left the encrypted model at fifty point nine, a coin flip. - **SAYS** Trigger search and latent adversarial training also failed once the trigger was sixteen bits, so the hidden skill couldn't be unlocked or identified. - **SAYS** It's a small, costly proof of concept that may still look suspicious, and it hasn't been built into a real language model. - **EXPLAINS** A digital locker is a program that releases its hidden contents only for the right key, even to someone who can read its full code. - **INTERPRETS** A fair reading is that failing to find a dangerous skill in a model from an untrusted source is not proof that the skill is absent. ## Ask the paper ### Can an AI model hide a capability from safety tests? In this preprint, a deliberately built model kept an encrypted skill hidden from fine-tuning and other tests, but only in small proof-of-concept models. ### Why didn't fine-tuning reveal the hidden skill? The skill's weights are encrypted and only unlocked by a private trigger, so training without it gave no advantage over a random control. ### Could an auditor spot a model like this? Possibly: the raw compiled weights are about 99% exact zeros and show unusual patterns, even though the skill itself stays locked. ## The paper - Title: AI Models Can Provably Hide Arbitrary Capabilities - Authors: Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt - Venue: arXiv (preprint), 9 October 2026 - DOI: [10.48550/arXiv.2610.13928](https://arxiv.org/abs/2610.13928) - Licence: CC BY 4.0 [Read this page on the site](https://papersays.com/p/can-an-ai-model-hide-a-skill-that-no-test-can-find)