Cryptographic backdoors break capability evaluations

Standard safety audits assume that if a neural network knows how to do something dangerous, a thorough red team can coax that behavior out of it before deployment. In a paper accepted at NeurIPS 2026, Andis Draguns and his co-authors demonstrate that this assumption fails against basic cryptography. By embedding encrypted subnetworks directly into model weights using digital lockers, they built circuits that stay computationally inert until they receive a specific trigger phrase. The demonstrated approach effectively turns the AI into a sleeper agent.

The authors tested the construction in PyTorch on a chemical reaction prediction task, targeting potential chemical and biological hazards. When they ran standard elicitation defenses against it, including fine-tuning, weight noising, gradient-based trigger searches, and latent adversarial training, none of them uncovered the hidden behavior. The guarantee holds even when the auditor has full access to the model weights, because the mathematics protects the dormant payload the same way encryption protects data at rest.

That poses a serious challenge for evaluation frameworks that treat white-box audits as the final word on safety. If an auditor cannot distinguish between clean weights and an encrypted trigger mechanism, capability evals cannot certify that a model is benign. Defenses cannot rely solely on post-training elicitation; the real security boundaries have to move to verifiable training pipelines, supply chain provenance, and strict runtime execution sandboxes.