Capability evaluations are designed to surface potentially dangerous model behaviors prior to deployment. However, the dependability of these evaluations rests on the premise that any concealed capabilities can be successfully elicited.
This research demonstrates that this assumption fails when facing adversarial circumstances. The authors achieved this by developing backdoor attacks. These attacks embed encrypted neural networks within the existing host model weights.
These hidden circuits are engineered to decrypt and execute only when a specific secret trigger is provided. Employing digital lockers, these embedded circuits are provably difficult to interpret or elicit, even when an observer possesses complete access to the model weights.
This work advances prior research, which previously focused on concealing fixed strings, to now encompass arbitrary computations.
The proof of concept constructions were implemented using PyTorch. The team then assessed elicitation using several techniques, including fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training.
A small chemical reaction prediction task served as a proxy for CBRN-relevant capabilities in the evaluation. The findings indicate resistance to these specified elicitation methods.
When combined with cryptographic assurances, these results expose a fundamental boundary to capability audits that rely on elicitation. The research team has released their models to aid in the enhancement of defensive measures.
These findings suggest that current security paradigms for vetting AI infrastructure may require reassessment given the theoretical possibility of undetectable, embedded functionality.
