论文：AI模型可证明隐藏任意能力，突破能力审计极限
AI models can provably hide arbitrary capabilities
这篇NeurIPS 2026录用论文从密码学角度证明了模型隐藏能力的可行性，直接挑战了当前安全审计的核心假设，对理解AI对齐与红队测试边界极具参考价值。
Computer Science > Machine Learning
计算机科学 > 机器学习
arXiv:2610.13928 (cs)
[Submitted on 9 Oct 2026]
[提交于 2026年10月9日]
Title:AI Models Can Provably Hide Arbitrary Capabilities
标题：AI模型可证明地隐藏任意能力
Authors:Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt
作者：Andis Draguns, Sumeet Ramesh Motwani, Raymond Douglas, Christian Schroeder de Witt
View a PDF of the paper titled AI Models Can Provably Hide Arbitrary Capabilities, by Andis Draguns and 3 other authors
查看由 Andis Draguns 等3位作者撰写的《AI模型可证明地隐藏任意能力》一文的PDF版本
View PDF HTML (experimental)
查看 PDF HTML（实验性）
Abstract:Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training on a small chemical reaction prediction task - a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
摘要：能力评估旨在部署前暴露危险模型行为，但其可靠性依赖于“隐藏的能力可以被诱导出来”这一假设。我们通过构建后门攻击证明了该假设在对抗条件下不成立：这些攻击将加密的神经网络嵌入宿主模型的权重中，仅在接收到秘密触发器时才解密并执行它们。借助数字保险箱技术，这些隐藏电路在密码学假设下即使拥有对模型权重的完全访问权限，也依然难以被诱导和解释，从而将此前仅用于隐藏固定字符串的工作扩展到了任意计算任务。我们在 PyTorch 中实现了概念验证构造，并在一个小型化学反应预测任务（作为 CBRN 相关能力的代理指标）上通过微调、权重加噪、基于梯度的触发器搜索以及潜在对抗训练来评估诱导效果。我们的结果展示了这些方法对此类攻击的抵抗力，结合我们的密码学保证，揭示了基于诱导的能力审计的局限性。我们公开了我们的模型以支持防御技术的改进。
Comments: 22 pages, 6 figures, 3 tables. Accepted at NeurIPS 2026 Subjects: Machine Learning (cs.LG); Cryptography and Security (cs.CR) Cite as: arXiv:2610.13928 [cs.LG] (or arXiv:2610.13928v1 [cs.LG] for this version) https://doi.org/10.48550/arXiv.2610.13928
评论：22页，6张图，3个表。已被 NeurIPS 2026 接收 主题：机器学习 (cs.LG)；密码学与安全性 (cs.CR) 引用格式：arXiv:2610.13928 [cs.LG]（或 arXiv:2610.13928v1 [cs.LG] 为本版本） https://doi.org/10.48550/arXiv.2610.13928
Focus to learn more
聚焦深入学习
arXiv-issued DOI via DataCite (pending registration)
arXiv 通过 DataCite 提供的 DOI（注册待定）
Submission history
投稿历史
From: Andis Draguns [view email]
来自：Andis Draguns [查看邮箱]
[v1] Fri, 9 Oct 2026 17:55:06 UTC (878 KB)
[v1] 周五, 2026年10月9日 17:55:06 UTC (878 KB)
Full-text links:
全文链接：
Access Paper:
访问论文：
View a PDF of the paper titled AI Models Can Provably Hide Arbitrary Capabilities, by Andis Draguns and 3 other authors
查看由 Andis Draguns 等3位作者撰写的《AI模型可证明地隐藏任意能力》一文的PDF版本
- View PDF
- HTML (experimental)
- TeX Source
- 查看 PDF
- HTML（实验性）
- TeX 源文件
view license
查看许可证
Additional Features
附加功能
- Audio Summary
- 音频摘要
Current browse context:
当前浏览上下文：
cs.LG
< prev | next >
< 上一页 | 下一页 >
new | recent | 2026-10
新发布 | 近期更新 | 2026-10
Change to browse by:
切换浏览方式：
cs
cs.CR
References & Citations
参考文献与引用
- NASA ADS
- Google Scholar
- Semantic Scholar
export BibTeX citation Loading...
导出 BibTeX 引用 加载中...
BibTeX formatted citation
BibTeX 格式引用
×
loading...
加载中...
Data provided by:
数据提供：
Bookmark
书签
Bibliographic Tools
文献工具
Bibliographic and Citation Tools
文献与引用工具
Bibliographic Explorer Toggle
文献探索器 切换
Bibliographic Explorer (What is the Explorer?)
文献探索器（什么是探索器？）
Connected Papers Toggle
关联论文 切换
Connected Papers (What is Connected Papers?)
关联论文（什么是关联论文？）
Litmaps Toggle
Litmaps 切换
Litmaps (What is Litmaps?)
Litmaps（什么是 Litmaps？）
scite.ai Toggle
scite.ai 切换
scite Smart Citations (What are Smart Citations?)
scite 智能引用（什么是智能引用？）
Code, Data, Media
代码、数据、媒体
Code, Data and Media Associated with this Article
与本文相关的代码、数据和媒体
alphaXiv Toggle
alphaXiv 切换
alphaXiv (What is alphaXiv?)
alphaXiv（什么是 alphaXiv？）
Links to Code Toggle
代码链接切换
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
CatalyzeX 论文代码查找器（什么是 CatalyzeX？）
DagsHub Toggle
DagsHub 切换
DagsHub (What is DagsHub?)
DagsHub（什么是 DagsHub？）
GotitPub Toggle
GotitPub 切换
Gotit.pub (What is GotitPub?)
Gotit.pub（什么是 GotitPub？）
Huggingface Toggle
Huggingface 切换
Hugging Face (What is Huggingface?)
Hugging Face（什么是 Huggingface？）
ScienceCast Toggle
ScienceCast 切换
ScienceCast (What is ScienceCast?)
ScienceCast（什么是 ScienceCast？）
Demos
演示
Demos
演示
Replicate Toggle
Replicate 切换
Replicate (What is Replicate?)
Replicate（什么是 Replicate？）
Spaces Toggle
Spaces 切换
Hugging Face Spaces (What is Spaces?)
Hugging Face Spaces（什么是 Spaces？）
Spaces Toggle
Spaces 切换
TXYZ.AI (What is TXYZ.AI?)
TXYZ.AI（什么是 TXYZ.AI？）
Related Papers
相关论文
Recommenders and Search Tools
推荐器与搜索工具
Link to Influence Flower
影响力花朵链接
Influence Flower (What are Influence Flowers?)
影响力花朵（什么是影响力花朵？）
Core recommender toggle
核心推荐器开关
CORE Recommender (What is CORE?)
CORE 推荐器（什么是 CORE？）
IArxiv recommender toggle
IArxiv 推荐器开关
IArxiv Recommender (What is IArxiv?)
IArxiv 推荐器（什么是 IArxiv？）
- Author
- Venue
- Institution
- Topic
- 作者
- 会议/期刊
- 机构
- 主题
About arXivLabs
关于 arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs：与社区合作者的实验性项目
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
arXivLabs 是一个框架，允许合作者直接在网站上开发和共享新的 arXiv 功能。
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
所有与 arXivLabs 合作的个人和组织都认同并接受了我们的开放、社区、卓越和用户数据隐私价值观。arXiv 致力于这些价值观，仅与遵守这些价值观的合作伙伴合作。
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
有一个能为 arXiv 社区增添价值的项目想法吗？了解更多关于 arXivLabs 的信息。
Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)
本文的哪些作者是背书人？ | 禁用 MathJax（什么是 MathJax？）
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力