Imagine you're a building inspector, and someone hands you blueprints for a house. You can study every beam, every wire, every joint. But hidden inside one wall is a safe — and the safe only opens when it hears a specific whispered phrase. You can X-ray the wall, tap every surface, run every test in your manual. You will never find what's inside, because the lock is mathematically harder to crack than your tools can handle. That's what this paper does to AI capability evaluations. The core claim is stark: you can embed an entire neural network — not a fixed string, not a simple trigger-response, but arbitrary learned computation — inside the weights of a host model, encrypted so that it only activates upon receiving a secret cryptographic trigger. The construction uses digital lockers, a cryptographic primitive that ensures the hidden circuit is computationally indistinguishable from random noise in the weights, even if you have full white-box access. This extends prior backdoor work (which hid fixed outputs) to hiding arbitrary capabilities — the jump from smuggling a note to smuggling a fully operational laboratory. The ladder here matters. Previous work by Goldwasser et al. (2022) and others demonstrated that fixed strings could be hidden in model weights. This paper climbs from hiding static data to hiding dynamic computation — encrypted neural networks that perform real inference only when triggered. The baseline for comparison isn't another backdoor paper; it's the entire elicitation-based safety evaluation paradigm. The paper doesn't beat a SOTA method on a benchmark — it proves a category of methods has a ceiling. The architecture is a nested construction: a host neural network's weights contain an encrypted guest network. The encryption uses digital lockers (built on pseudorandom generators and one-way functions), so the guest network's parameters are indistinguishable from noise without the key. On receiving the trigger, the host's forward pass decrypts and executes the guest network's computation. This is not gradient-based hiding — it's cryptographic embedding, which means standard interpretability and fine-tuning attacks are operating in the wrong threat model entirely. The proxy task is chemical reaction prediction, chosen as a stand-in for CBRN-relevant capabilities. Integrity is strong for a constructive proof paper. The authors implement the full construction in PyTorch, then throw four distinct elicitation attacks at it: fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training (LAT). All fail. The cryptographic guarantees provide the formal backbone — the empirical attacks are demonstrations that practice matches theory. The chemical reaction prediction task is small (a proxy, not a frontier deployment), and the authors are transparent about this. They release models publicly, which is the right move for enabling defensive research, though it also hands the construction to anyone who wants it. The milestone question is where this gets uncomfortable. The paper doesn't point toward a next number that fixes the problem — it points toward a fundamental limit. The constructive direction is: can defensive methods move beyond elicitation to detect structural anomalies (e.g., unusually high weight entropy, non-standard parameter distributions) that betray cryptographic embedding? The field needs detection methods that operate on the statistical signature of the hiding, not on the hidden content. No concrete threshold exists yet for what 'good enough' detection looks like. The obvious successor experiment the authors didn't run: scaling this construction to a frontier-sized model (billions of parameters) and testing whether the weight-space budget for hiding a useful encrypted network is practically available without degrading host performance. The honest read is (a) — compute and engineering cost. Embedding encrypted circuits in a 7B or 70B model and running elicitation sweeps is expensive. But this is the experiment the safety community needs, because the threat model only matters if it works at scale.
