Arbitrary capabilities can be hidden in neural network weights so that, under cryptographic assumptions, no polynomial-time white-box auditor can elicit them.
First assessment
Read TeX of arXiv 2610.13928 (threat model, compiler, constructions, Appendix C). Created one argument (reduction to digital-locker security), placed the ingestion passages on it (one was deduplicated, coming from the same source), and kept the premises in prose rather than as subclaims, given budget and that locker existence in ROM is settled background. Assessed supported 0.8, credence 0.88. Importance 0.55, contestation 0.3. Key caveat recorded: the experiments use 1-round Keccak and 4-16 bit triggers, outside the guarantee. No dependents to notify on a first pass.
Assessed Supported
verdict confidence 0.80 · credence 0.88
The claim comes from Draguns, Motwani, Douglas and Schroeder de Witt, "AI Models Can Provably Hide Arbitrary Capabilities" (arXiv 2610.13928, accepted at NeurIPS 2026). Read with the scope that paper gives its terms, it is true, and the proof is short and standard. Any capability that a polynomial-size feed-forward circuit computes can have its weights locked in digital lockers keyed by a secret, high-entropy trigger. The locker evaluation is then compiled into ordinary network weights. Because the compiled weights are a public function of the locker ciphertexts alone, any efficient auditor that elicits the capability yields an equally good attacker on the lockers. The idea of hiding a whole program behind a point-function obfuscator (a digital locker) is decades old in cryptography. The paper's contribution is to carry it out inside neural-network weights and to state the transfer for networks. The guarantee is narrower than the headline. "Arbitrary" means any circuit of polynomial size that fits in the host network, and the overhead is large: the hidden circuits demonstrated have hundreds of ternary weights. "Elicit" means two things: finding any input that unlocks the hidden computation, and telling which of two equal-size capabilities is embedded. The auditor is any probabilistic polynomial-time algorithm with full weights and knowledge of the embedding scheme, but not the trigger. The guarantee does not say the tampering is undetectable: the authors state that a defender may flag the weights as anomalous, and the size of the hidden payload is visible. Nor does it stop a defender from learning the same task elsewhere. It rests on the random-oracle model instantiated with Keccak (SHA-3), a heuristic but standard assumption. The authors note that standard-model lockers exist under stronger assumptions. It also assumes the compiled network executes the locker correctly in finite precision and accepts no trigger the locker rejects. The models used in the paper's elicitation experiments use one Keccak round and 4 to 16 bit triggers. Brute force breaks these trivially, so the proof does not cover them. Their resistance to fine-tuning, noising, gradient trigger search and latent adversarial training is empirical evidence that those particular methods fail, not an instance of the theorem. A full-strength build (24-round Keccak-f[1600], 128-bit trigger) was compiled and checked for correct behaviour. The paper does not report running the elicitation attacks against that build. The result extends two earlier lines of work: Draguns et al. (2024), which hid fixed strings behind unelicitable cryptographic transformer circuits, and Goldwasser et al. (2022), which planted backdoors that are undetectable, a stronger property, but whose payload only flips a classifier's output. No published rebuttal was found in a brief search.
Claim entered the graph