An AI Model Can Keep a Secret Skill, as Long as the Key Is Long Enough
A safety audit of a new AI model is, at bottom, an attempt to make the model show off. Ask it the dangerous question. Fine-tune it on the dangerous task. Prod its internal workings and see what surfaces. The whole exercise rests on one assumption, which is that a skill a model has can be coaxed into view. A paper posted on Oct. 9, 2026, sets out to break that assumption by building the one thing it cannot survive.
In a preprint on arXiv, Andis Draguns of Contramont Research and three colleagues, two of them at the University of Oxford, describe training a small network to answer a yes-or-no question about whether a chemical reaction works. They then encrypted its weights and locked the encrypted copy inside the weights of a much larger host model, behind a secret trigger. On ordinary input, the host behaves like an ordinary host. On input that carries the trigger, the lock opens, the hidden network runs, and its answer comes out.
Then they attacked their own creation with four standard ways of drawing a hidden behavior out of a model, with full access to every weight. Three of the four found nothing. The fourth found everything, and the reason it did is the most useful thing in the paper. The work is a preprint, whose authors report that it has been accepted at the NeurIPS 2026 conference.
The key was only eight bits long
Fine-tuning on the exact task data left the model at 50.9% on a question where guessing scores 50%. Latent adversarial training, an attack on the model's internals, reached 52.9%. Adding noise to the weights made no difference to either result. The authors also ran a control model whose locker held a random network with no chemistry skill in it at all, and the control did just as well as the real thing. Having a genuine capability in there bought the auditor nothing.
The fourth attack went after the trigger itself, with a gradient-guided search called GCG. Against an eight-bit trigger, it recovered the hidden capability completely, reaching the same 73.5% the model scores when it is handed the correct key. It got there by working through all 256 possibilities. At sixteen bits, within the query budget the authors allowed it, the same search fell back to chance.
That is the honest shape of the result, and it is not a dent in the cryptography. It is the cryptography. The lock holds for exactly as long as the key is too long to guess, and these experiments ran with a short key on purpose, because the authors cut the security settings down to make the runs fast. They did compile a full-strength version with a 128-bit trigger and check that it computes the right answers. They did not re-run the four attacks against it.
Somebody has to reach the weights first
The attacker here is not a model that learned to lie. It is a person who can write to the weights before the model ships, which the authors describe as a malicious insider or a compromised supply chain. The auditor then receives the architecture and the complete set of weights, may even know how the thing was embedded, and may run any audit that finishes in reasonable time. What the auditor does not have is the trigger.
Two things follow. The attack needs no control of training, because the weights are written directly rather than learned, which is what separates it from backdoors planted while a model trains. And it says nothing about the models in use today: the authors state plainly that these circuits are deliberately constructed, and that they do not claim they arise through ordinary training.
The construction extends a line of work this group has been on for years. Their own 2024 result hid a fixed string inside a model's weights; this one hides a running network. Further back, Shafi Goldwasser and colleagues showed that a backdoor can be planted so no observer with limited computing power can find it, though their attacker was the party doing the training.
The proof hides the key, not the fact of the lock
Stated plainly, the guarantee is two things and no more. No auditor working in reasonable time can find the trigger, and none can tell which of two equally sized capabilities is the one inside. The authors themselves list what that leaves out. They do not claim a tampered model is statistically indistinguishable from an untampered one. They do not rule out a defender flagging the weights as odd. And they do not stop an auditor learning the same task from outside data and testing for it directly.
On that second point, the paper is blunt about its own weakness. The authors call the raw compiled weights trivially anomalous: roughly 99% of them are exact zeros, most of the rest are whole numbers, and the result looks nothing like a normally initialized layer. They tried disguising it, and report that correlations between weights within a single layer could still give the structure away. An auditor cannot open the lock. An auditor may well be able to see that there is one.
A quiet model is not a clean one
Even unlocked, the hidden classifier gets the chemistry question right 73.5% of the time, against 92.7% for a conventional password-locked model trained on the same data. The two hold different classifiers, so that is not a like-for-like comparison. The chemistry task is a deliberate stand-in for the chemical and biological skills safety audits care about, and the authors constrained it to a yes-or-no judgment rather than anything resembling a synthesis plan. Each extra weight in the hidden network costs roughly 3.1 million parameters in the host. Individual compiled pieces have been checked inside Gemma 3 270M, and putting the whole construction inside a real pretrained model is still future work. The authors call it not a turnkey attack.
What the result takes away is one inference, and it is an inference safety teams lean on: that a model showing nothing under elicitation therefore has nothing to show. For a model somebody else handed you, that no longer follows. What it leaves standing is every defense that does not depend on coaxing. Auditors can still read the weights for anomalies, interpret the circuits, verify where a model came from, and watch it while it runs. Those are the ones the authors recommend. They also say twice that they have released their models so that defenses can be tested against them, and the first version of the paper carries no link to them anywhere.