Andis Draguns and colleagues hide a small executable neural network inside another network’s weights using encryption. A secret input unlocks it. Their paper challenges a safety assumption: that enough testing or additional training will expose every hidden ability, even when someone deliberately tampers with a model.
The authors build a “digital locker,” a program that releases encrypted contents only for the right key. They compile that program into model weights, where it can decrypt and run a hidden chemistry classifier. The task is a constrained test of reaction feasibility.
Their reported results separate ordinary password locks from this encrypted construction:
- Training on correct task examples: after 500 steps, the encrypted model scores 50.9% on balanced chemistry questions, near chance. A separately trained password-locked model reaches 92.8%.
- Supplying the secret: the encrypted model reaches 73.5%; the password-locked model reaches 92.7%. They contain different classifiers, so their unlocked abilities differ.
- Searching for the trigger: an eight-bit key is found by trying every candidate. With a sixteen-bit key, the tested search reaches 52.7%, doing no better than matched random search.
The cryptographic argument concerns appropriately strong settings and explicit assumptions. Most attack tests use reduced-strength settings; a separate 128-bit-trigger construction demonstrates correct execution. The guarantee protects the trigger and payload identity, while unusual weight structures may still reveal tampering.
Caveat: this is an expensive, deliberately constructed proof of concept. The complete attack has yet to be integrated and evaluated in an existing pretrained LLM.
Behavioral tests remain valuable, but assurances about adversarial models also need attention to their provenance and what they can do after deployment. This note follows v2, dated October 14; its main chemistry table is unchanged from v1.