AI models enable covert implantation of arbitrary computational capabilities.

A recent study accepted by the Conference on Neural Information Processing Systems (NeurIPS 2026) has revealed potential limitations in the safety evaluation of artificial intelligence models. By constructing a backdoor attack, the research team embedded an encrypted neural network into the host model's weights, enabling it to decrypt and execute hidden computations only upon receiving a specific secret trigger signal. Leveraging digital encryption lock technology, this mechanism ensures that, under cryptographic assumptions, the hidden circuit remains difficult to induce or interpret even if auditors have full access to the model weights, extending related research from hiding fixed strings to hiding arbitrary computational tasks. The research team implemented a proof of concept based on PyTorch and conducted experiments around chemical reaction prediction tasks, testing various capability induction methods such as fine-tuning, weight noise injection, gradient-based trigger search, and potential adversarial training. The results showed that none of these methods were effective in inducing the hidden capabilities. Combined with theoretical guarantees at the cryptographic level, this study reveals the practical and theoretical limitations of model auditing methods that rely on capability induction. The research team has also publicly released the relevant models to support subsequent defense technology research and promote the development of a more reliable AI safety evaluation system.