Hacker News· sbulaev·· 21 天前精选AI 评分60
AI 模型可隐藏任意能力而不被发现
AI models can provably hide arbitrary capabilities
AI 导读
NeurIPS 2026 接收论文（arXiv:2610.13928）构造了可在模型权重中嵌入加密神经网络的后门模型，仅在收到密钥触发时执行任意能力。作者用 PyTorch 在化学反应预测任务上测试，显示微调、权重扰动、梯度触发搜索、潜在对抗训练均难以发现隐藏电路，并给出密码学保证，揭示基于引出测试的能力评估存在结构性局限。
推荐理由
原文给出隐藏任意能力的后门示例，并显示现有评估手段难以发现，对部署前安全审计方法的设计选择有参考价值。
正文 · 原文
Abstract:Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
| Comments: | 22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026 |
| Subjects: | Machine Learning (cs.LG); Cryptography and Security (cs.CR) |
| Cite as: | arXiv:2610.13928 [cs.LG] |
| (or arXiv:2610.13928v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.13928 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Andis Draguns [view email]
[v1]
Fri, 9 Oct 2026 17:55:06 UTC (878 KB)
来源：Hacker News · arxiv.org