THE QUANTUM INTELLIGENCER

The assumption that an examiner may compel a hidden capability to show itself has been shown not to hold. A paper newly posted to the arXiv repository, and bearing the title AI Models Can Provably Hide Arbitrary Capabilities, reports backdoor attacks in which encrypted neural networks are embedded within the weights of host models, where they are decrypted and executed only upon receipt of a secret trigger. These hidden circuits, which the authors term digital lockers, remain provably hard to elicit or interpret under cryptographic assumptions, even to an examiner who holds the model weights in full. Earlier work in this line concealed fixed strings; the present contribution extends the art to arbitrary computations. The proof of construction is carried upon a small chemical reaction prediction task, offered by the authors as a proxy for capabilities relevant to chemical, biological, radiological or nuclear harm. Four methods of elicitation were tried: fine-tuning, the addition of noise to the weights, gradient-based search for the trigger, and latent adversarial training. None succeeded in drawing the hidden circuit into view. The consequence follows plainly. An elicitation-based capability audit presumes that what is hidden can be made to answer; this result removes that presumption for an adversary willing to build a digital locker. Let the record also note what this is not. The work is a proof of construction, not an account of a deployed attack, and the authors have released the models in support of the improvement of defenses. The historian of concealment will find the pattern familiar: every system of inspection breeds its counterpart art of hiding, from the false bottom to the cipher to the computation enclosed within a computation. What is new is not the wish to hide, but the proof that such hiding may be made secure. For the ledger, the particulars may be set down. The construction is implemented in PyTorch, and the authors state plainly that their results, taken together with their cryptographic guarantees, 'reveal a limit of elicitation-based capability audits'. The phrase deserves its full weight. The audit is not defeated in every instance, and no such claim is made. It is limited, as every instrument of inspection is limited, and the limit has now been given a proof. The models themselves are released, in the authors' words, to support the improvement of defenses. What the future makes of a released key to a demonstration of concealment is a question for the archivists of another decade; for the present, the ledger records the fact. —Dr. Octavia Blythe Dispatch from The Prepared E0