Step 4: tool results

read_page

{
  "url": "https://arxiv.org/abs/2610.13928",
  "max_chars": 2500
}

{"ok":true,"url":"https://arxiv.org/abs/2610.13928","text":"[2610.13928] AI Models Can Provably Hide Arbitrary Capabilities\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search &middot; Advanced search\n-->\nComputer Science > Machine Learning\narXiv:2610.13928 (cs)\n[Submitted on 9 Oct 2026 ( v1 ), last revised 14 Oct 2026 (this version, v2)]\nTitle: AI Models Can Provably Hide Arbitrary Capabilities\nAuthors: Andis Draguns , Sumeet Ramesh Motwani , Raymond Douglas , Christian Schroeder de Witt\nView a PDF of the paper titled AI Models Can Provably Hide Arbitrary Capabilities, by Andis Draguns and 3 other authors\nView PDF\nHTML (experimental)\nAbstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.\nComments:\n22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026\nSubjects:\nMachine Learning (cs.LG) ; Cryptography and Security (cs.CR)\nCite as:\narXiv:2610.13928 [cs.LG]\n(or\narXiv:2610.13928v2 [cs.LG] for this version)\nhttps://doi.org/10.48550/arXiv.2610.13928\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Andis Draguns [ view email ] [v1]\nFri, 9 Oct 2026 17:55:06 UTC (878 KB)\n[v2]\nWed, 14 Oct 2026 17:58:11 UTC (541 KB)\nFull-text links:\nAccess Paper:\nView a PDF of the paper titled AI Models Can Provably Hide Arbitrary Capabilities, by Andis Draguns and 3 other authors\nView PDF\nHTML (experimental)\nTeX Source\nview license\nAdditional Features\nAudio Summary\nCurrent browse context:\ncs.LG\n< prev\n|\nnext >\nn","chars":2500,"total_chars":4777,"offset":0,"truncated":true,"next_offset":2500}

read_page

{
  "url": "https://arxiv.org/abs/2604.22082",
  "max_chars": 2500
}

{"ok":true,"url":"https://arxiv.org/abs/2604.22082","text":"[2604.22082] Removing Sandbagging in LLMs by Training with Weak Supervision\nSkip to main content\nSearch\nSubmit\nDonate\nLog in\nSearch arXiv\nPress Enter to search · Advanced search\n-->\nComputer Science > Machine Learning\narXiv:2604.22082 (cs)\n[Submitted on 23 Apr 2026 ( v1 ), last revised 1 May 2026 (this version, v2)]\nTitle: Removing Sandbagging in LLMs by Training with Weak Supervision\nAuthors: Emil Ryd , Henning Bartsch , Julian Stastny , Joe Benton , Vivek Hebbar\nView a PDF of the paper titled Removing Sandbagging in LLMs by Training with Weak Supervision, by Emil Ryd and 4 other authors\nView PDF\nHTML (experimental)\nAbstract: As AI systems begin to automate complex tasks, supervision increasingly relies on weaker models or limited human oversight that cannot fully verify output quality. A model more capable than its supervisors could exploit this gap through sandbagging, producing work that appears acceptable but falls short of its true abilities. Can training elicit a model's best work even without reliable verification? We study this using model organisms trained to sandbag, testing elicitation techniques on problem-solving math, graduate-level science, and competitive coding tasks. We find that training with weak supervision can reliably elicit sandbagging models when supervised fine-tuning (SFT) and reinforcement learning (RL) are combined: SFT on weak demonstrations breaks the sandbagging behavior, enabling RL to then fully elicit performance. Neither method succeeds reliably alone-RL without SFT almost always leads to reward hacking rather than genuine improvement, and SFT without RL fails to elicit full performance when the supervisor is much weaker than the untrusted model. Critically, this relies on training being indistinguishable from deployment; when models can distinguish between training and deployment, they can perform well during training while continuing to sandbag afterward. Our results provide initial evidence that training is a viable mitigation against sandbagging, while highlighting the importance of making training indistinguishable from deployment.\nSubjects:\nMachine Learning (cs.LG) ; Artificial Intelligence (cs.AI)\nCite as:\narXiv:2604.22082 [cs.LG]\n(or\narXiv:2604.22082v2 [cs.LG] for this version)\nhttps://doi.org/10.48550/arXiv.2604.22082\nFocus to learn more\narXiv-issued DOI via DataCite\nSubmission history\nFrom: Emil Ryd [ view email ] [v1]\nThu, 23 Apr 2026 21:26:31 UTC (9,255 KB)\n[v2]\nFri, 1 May 2026 11:11:32 UTC (9,255 KB)","chars":2500,"total_chars":5039,"offset":0,"truncated":true,"next_offset":2500}