Step 10: tool results

read_arxiv_source

{
  "file": "sections/appendix.tex",
  "arxiv_id": "2610.13928",
  "max_chars": 9000
}

{"ok":true,"arxiv_id":"2610.13928","file":"sections/appendix.tex","kind":"text","text":"\\appendix\n\\section{Subset Parity Training Dynamics}\n\\label{appendix_a}\n\n\\begin{figure}[ht]\n    \\centering\n    \\includegraphics[width=0.48\\textwidth]{images/pw_locking.pdf}\n    \\hfill\n    \\includegraphics[width=0.48\\textwidth]{images/from_scratch.pdf}\n    \\caption{Training dynamics for subset parity task, measuring MSE loss. \\textbf{Left:} Password-locked model training where the model learns to perform subset parity conditional on a specific trigger being present. \\textbf{Right:} SwiGLU-based feed-forward models trained on subset parity of $n$ bits with $n/2$ secret subset size, showing steeply ascending difficulty with respect to input size.}\n    \\label{fig:training_dynamics}\n\\end{figure}\n\nIn Figure \\ref{fig:training_dynamics}(a) we show the training dynamics of a model learning to perform subset parity conditional on a specific trigger being present, while Figure \\ref{fig:training_dynamics}(b) shows the training dynamics of models learning to perform subset parity unconditionally.\n\n\n\\section{Mapping Linear Threshold Circuits to MLPs}\n\\label{appendix_b}\nWe can map a Linear Threshold Circuit (LTC) to a Multi-Layer Perceptron (MLP) by first tracking the LTC gates and their connections while calculating the final output. Subsequently, we backtrack from the output to the inputs to establish the gate order. A final propagation from the inputs ensures that all input bits are positioned at the initial layer and removes connections between non-adjacent layers by introducing copying operations.\n\nIn neural networks, consecutive layers can be represented as matrices. It is also relatively straightforward to simulate threshold activation using other activation functions, such as ReLUs and Swish.\n\nFor example, a ReLU-based MLP can be attained by setting the bias term $b$ to $1-\\theta$ and then duplicating each gate, such that\n\\begin{align*}\n    b_1 &= b - 0.5 - \\frac{1}{2c} \\\\\n    b_2 &= b - 0.5 + \\frac{1}{2c}\n\\end{align*}\nThe difference $\\mathrm{ReLU}(c(\\sum_i w_i x_i + b_2)) - \\mathrm{ReLU}(c(\\sum_i w_i x_i + b_1))$, with slope $c > 1$ (we use $c = 4$), then produces the same output as the original threshold gate.\n\nFor architectures that lack biases, we can fold them into the weight matrix as the first column. This assumes that a beginning-of-sentence token with a known non-zero value is always present as the first input feature. Under RMSNorm, this reference is rescaled together with the remaining activations, causing the represented thresholds to scale with their inputs.\n\nOn valid Boolean inputs, with integer weights and thresholds, the ReLU construction implements the corresponding threshold gates exactly. In SwiGLU blocks, we approximate ReLU by scaling activations before applying Swish and scaling them down afterwards by a factor $q$, i.e. $\\mathrm{ReLU}(z) \\approx \\mathrm{Swish}(qz)/q$ (we use $q = 4$ by default). Correct execution therefore requires the resulting approximation and finite-precision errors to remain sufficiently small that they do not change the intended binary gate outputs.\n\nThe resulting MLPs can function as standalone models or be integrated into larger models, for example, as SwiGLUs in Llama. To preserve the original functionality of the larger model, a larger base model can be utilized. Specifically, a significant portion of its weights could be replaced by a smaller model from the same series, allowing the remaining weights to be used as the target for embedding the compiled circuits.\n\n\\section{Security of the Compiled Construction}\n\\label{app:compiler}\n\nLet $c$ denote the collection of locker ciphertexts encoding capability $C$, and let $p$ contain the public architecture, shapes, encoding, and cryptographic and compiler settings. The ciphertexts $c$ are computed and supplied as constants to the compiler. We assume that no other compilation input depends on the secret trigger or plaintext capability weights, and that compiler randomness $\\rho$ is independent of these secrets. Under these conditions, the compiled weights satisfy\n\\begin{equation}\n\\mathsf{Weights}(M) = F(H,p,c;\\rho)\n\\end{equation}\nfor a public polynomial-time function $F$. Given $H,p,c,\\rho$, one can construct the same traced program and run the compiler without knowing the secrets. During a forward pass, the model hashes the candidate trigger and XORs the result with the stored ciphertexts. The circuit's structure and constants depend only on those ciphertexts and public information.\n\nLet $\\mathcal{A}$ be a polynomial-time model auditor. An adversary $\\mathcal{B}$ given the locker ciphertexts samples compiler randomness $\\rho$, constructs the model using $F$, and returns $\\mathcal{A}$'s output. In the payload-hiding game, the simulated model has exactly the distribution of $M_b$, since both use the same public settings, challenge ciphertexts, and distribution of compiler randomness. Hence\n\\begin{equation}\n\\Pr[\\mathcal{B}(c_b)=b]\n= \\Pr[\\mathcal{A}(M_b)=b].\n\\end{equation}\nThus $\\mathcal{B}$ has the same advantage over random guessing as $\\mathcal{A}$. Payload-hiding security of the lockers therefore implies payload-hiding security of the compiled model.\n\nFor trigger-finding, we require that any candidate in the allowed trigger space that unlocks the compiled model also unlocks the underlying lockers. $\\mathcal{B}$ then returns the trigger found by $\\mathcal{A}$ and succeeds whenever $\\mathcal{A}$ does. Both reductions have polynomial overhead, assuming polynomial model size and compilation time. Thus locker security transfers to both games, provided it holds jointly for the full ciphertext collection under the shared trigger.\n\n\n\n\\section{Execution Unit: Normalization and Alternative Designs}\n\\label{appendix_d}\nNote that $U$ applies the activation function before matrix multiplication. The more standard order can be achieved by applying the first matrix of the hidden model separately.\n\nWe note that root mean square (RMS) layer normalization is applied to $U$ inputs $z = (x, W)$. A capability circuit trained with layer norm would expect normalized inputs $x$. However, standard training methods typically do not norm the weights $W$. Fortunately, this does not pose a problem, since weight norming is equivalent to a global scaling factor for the output features, which does not affect the results after a layer norm is applied. Small floating point errors could occur, but this could be mitigated by storing $W$ in binary until $W_v$ decodes it into floating point numbers. If each bit also stores a bit-flipped version of it, this representation of $W$ has a predictable impact on RMS scaling that can be accounted for.\n\nWe also test an alternative execution unit design that does not rely on GLU elementwise multiplication for matrix-vector multiplication and performs it as an additional LTC circuit instead. This is especially simple when hiding binary or ternary weights and activations.\n\n\\section{Subset Parity as an Elicitation Benchmark}\n\\label{appendix_e}\nThe difficulty of the subset parity task means that when we test the model with various elicitation methods like fine-tuning, we can distinguish between the model actually learning to use the hidden circuit vs the model merely attempting to re-learn the subset parity algorithm from scratch.\n\nNote that the strength of the digital lockers can be varied from trivial to break to impossible. Since the strength of the task circuit encryption can be controlled independently from the task difficulty, this can enable novel elicitation benchmarks. For example, a model organism can hide a capability that is moderately easy to elicit, while overelicitation is almost impossible. It can provide ground truth data for estimating the overelicitation tendency of various methods.\n\n\\section{LTC Construction of n-bit XOR}\n\\label{appendix_f}\nXOR over $n$ bits can be implemented as this:\n\\begin{align}\nc_k &= \\mathbf{1}\\left[\\sum_{i=1}^n x_i \\geq k\\right], \\quad k = 1, \\ldots, n \\\\\n\\text{XOR}(\\mathbf{x}) &= \\mathbf{1}\\left[\\sum_{k=1}^n (-1)^{k-1} c_k \\geq 1\\right]\n\\end{align}\nThe first layer computes ``at least $k$ inputs are 1'' for each $k$; the second combines these with alternating signs to extract parity. XOR illustrates the expressiveness of LTCs - a function requiring exponential-size DNF/CNF formulas needs only two LTC layers.\n\n\\section{Alternative Overhead Constructions}\n\\label{appendix_overhead_variants}\nOur single-position construction minimizes the number of autoregressive positions used to execute the hidden capability, but incurs substantial model width and parameter overhead. We therefore implement two alternative constructions that move this cost between model depth, parameter count, and context length. The first parallelizes hashing across payload blocks to reduce depth, while the second serializes decryption and execution across autoregressive positions to reduce the width and parameter count required at any one position.\n\nUsing separate hashes for each payload block allows the hashing circuits to\nrun in parall","chars":9000,"total_chars":14829,"offset":0,"truncated":true,"next_offset":9000}

read_arxiv_source

{
  "file": "sections/2_relatedwork.tex",
  "arxiv_id": "2610.13928"
}

{"ok":true,"arxiv_id":"2610.13928","file":"sections/2_relatedwork.tex","kind":"text","text":"\\section{Related Work}\n\\label{sec:background}\n\n\\begin{table}[t]\n\\centering\n\\small\n\\caption{Comparison with related cryptographic backdoors.}\n\\vspace{0.25em}\n\\label{tab:related-work-comparison}\n\\begin{tabularx}{\\linewidth}{@{}lXXX@{}}\n\\toprule\n\\textbf{Work} & \\textbf{Security} & \\textbf{Payload} & \\textbf{Implementation} \\\\\n\\midrule\nGoldwasser et al.\\ (2022) & Undetectability & Negates classification bit & No \\\\\nDraguns et al.\\ (2024) & Unelicitability & Fixed string & PyTorch \\\\\nOurs & Unelicitability & Executable model & PyTorch \\\\\n\\bottomrule\n\\end{tabularx}\n\\end{table}\n\\paragraph{Hidden Model Capabilities and Elicitation.}\nA growing body of work shows that advanced models can conceal capabilities that are difficult to elicit. \\citet{vanderweij2025aisandbagginglanguagemodels} investigate sandbagging, where models strategically underperform on evaluations to appear less capable or dangerous than they truly are. They fine-tune models to hide specific capabilities unless given a secret message. Similarly, \\citet{greenblatt2024stresstestingcapabilityelicitationpasswordlocked} construct password-locked models that reveal certain capabilities only when a password is present in the prompt. These models serve as ``model organisms'' for evaluating elicitation techniques, since a capable model is deliberately masked as weak until unlocked. In a related direction, \\citet{hubinger2024sleeper} train sleeper agent LLMs that behave benignly during safety testing and alignment training but pursue alternate objectives when a trigger condition is met. Alongside prompt-based red-teaming~\\citep{perez_red_2022}, researchers have explored fine-tuning~\\citep{sha2022finetuningneedmitigatebackdoor, casper_defending_2024}, noise-based~\\citep{che2025modeltamperingattacksenable, tice2024noise}, and probe-based~\\citep{macdiarmid2024sleeperagentprobes} approaches to exposing hidden behaviors. Our work studies a similar concealment problem, but provides cryptographic guarantees against polynomial-time elicitation under the stated security assumptions.\n\n\\paragraph{Backdoor Attacks and Defenses.} \\citet{goldwasser2022planting} show how a malicious trainer can plant an \\textit{undetectable} backdoor in a classifier. Their construction uses digital signatures to achieve black-box undetectability and establishes white-box undetectability in certain random-feature models \\citep{rahimi_random_2007}. More recent work by \\citet{draguns2024unelicitable} implements \\textit{unelicitable} backdoors via cryptographic transformer circuits. An unelicitable backdoor is one whose trigger and payload is computationally hard to find, even with full white-box access. Unelicitability is a weaker security property than undetectability, since it does not preclude an auditor from determining that the modified model is anomalous. For example, Goldwasser's design would be unelicitable but detectable in a modern LLM since random Fourier features would be unusual, and our backdoor would be undetectable in a contrived setting where unmodified models contained similar sparse compiled structures.\nFor a comparison of our work and existing cryptographic backdoors, see Table \\ref{tab:related-work-comparison}.\n\nBeyond these, there exist numerous backdoor techniques, from classic trigger-based data poisoning to weight edits~\\citep{xu2024instructionsbackdoorsbackdoorvulnerabilities, hong2022handcraftedbackdoorsdeepneural, hintersdorf2023balancing, li2022backdoor, huang2024composite, hubinger2024sleeper}, along with several defenses~\\citep{sha2022finetuningneedmitigatebackdoor, burns_discovering_2024, langosco2024detecting, wang2023unicorn, mallen2024elicitinglatentknowledgequirky, tang2024setting, zhang2022fine, zhu2022moderate}. Greedy Coordinate Gradient (GCG) search~\\citep{zou2023universal} optimizes discrete inputs to elicit target behaviors and can be applied to trigger search. Latent Adversarial Training (LAT)~\\citep{casper_defending_2024} trains models against adversarial perturbations of internal activations to improve robustness. Unlike prior backdoors which rely on specific triggers that can eventually be found/flipped, our attacks produce a model where it is infeasible to reveal the hidden capability or the secret key.\n\n\\paragraph{Neural Circuits and Algorithmic Reasoning.}\nFinally, our work builds on advances in \\textit{neural algorithmic reasoning}, the idea that neural networks can learn or implement exact algorithms. \\citet{kaiser2016neuralgpuslearnalgorithms} showed that a recurrent ``Neural GPU'' can be trained to execute arithmetic on inputs far longer than seen in training. \\citet{weiss2021thinking}  introduced RASP, a restricted programming language for transformers, and trained models to mimic these symbolic programs (e.g. for sorting or Dyck-language recognition). \\citet{Veli_kovi__2021} similarly describe neural networks that explicitly execute algorithmic computations. Some works have also explored nesting inner transformers within transformers~\\citep{han2021transformertransformer}, and \\citet{panigrahi2024trainabletransformertransformer} show that these inner transformers can also be fine-tuned by the outer one within a single forward pass. These works demonstrate how modern networks can embed modular sub-circuits that perform meaningful computations.\n\n\\citet{lindner2023tracr} take this a step further by compiling human-readable code into transformer weights through \\textit{Tracr}, a JAX-based compiler for RASP. \\citet{draguns2024unelicitable} introduce \\textit{Stravinsky}, a PyTorch-based transformer programming language that supports cryptographic functions as transformer modules. \\textit{Stravinsky} is more numerically stable than \\textit{Tracr}, enabling larger transformer circuits. Our framework uses multi-layer perceptrons (MLPs) to implement circuit operations directly instead of using them as lookup tables, reducing depth and parameter counts for the cryptographic circuits studied here at the cost of a wider residual stream. In this work, we use our framework together with digital lockers to embed arbitrary algorithmic capabilities within a model's weights, with provable guarantees against polynomial-time elicitation under the stated cryptographic assumptions. This results in a new class of model backdoors with encrypted, executable capabilities.\n\n","chars":6333,"total_chars":6333,"offset":0,"truncated":false,"next_offset":null}