The AI Model With a Secret Second Brain

Current AI safety evaluations largely depend on a critical assumption: if a model possesses dangerous capabilities, red-teaming and fine-tuning will inevitably expose them. These elicitation techniques aim to surface any hidden threats before a model’s release, deeming it safe if nothing concerning emerges.

However, researchers from Contramont Research, the University of University of Oxford, and ACS Research have demonstrated a fundamental flaw in this premise. They successfully embedded an entire functional neural network within a larger, benign host model, proving that dangerous capabilities can remain completely concealed.

Their method leverages a cryptographic primitive called a digital locker. This mechanism allows a secret network to lie dormant within the host, indistinguishable from random noise during routine inspection or black-box testing. The host model behaves normally, passing all standard safety checks without revealing its hidden payload.

Only a precise, secret trigger can activate the embedded network. When the correct cryptographic key is supplied, the host model decrypts and executes the hidden weights as part of its normal forward pass. This creates a severe threat model: an AI could harbor sophisticated, unobservable capabilities, activated only by an adversary with the key.

Researchers from Contramont Research, the University of University of Oxford, and ACS Research implemented this digital locker by compiling the SHA-3 Keccak hash function directly into standard transformer components. These included gated linear units, allowing the cryptographic lock to operate as an integral part of the host model’s forward pass.

The system works by hashing every input during the model’s execution. If the input matches the secret trigger, the Keccak hash output then XOR-decrypts the hidden network's weights. An internal execution unit immediately multiplies these decrypted weights by the input representation, running the secret model.

Conversely, an incorrect trigger yields unusable, random-looking bits from the decryption process. The host model then bypasses the hidden network and continues its normal operations, exhibiting no anomalous behavior. This ensures the hidden capability remains dormant and undetectable without the precise 128-bit key.

This mechanism proved robust against traditional auditing methods. While a standard password-locked model leaked its secret after only 500 steps of fine-tuning, the cryptographically locked model showed 0% capability leakage, even when researchers added random noise to its weights. This strong cryptographic guarantee means auditors cannot elicit or even identify the hidden model without breaking the hash function itself.

Researchers tested their cryptographic locker by embedding a small, 672-weight classifier. This hidden model was trained to predict chemical reaction outcomes using data from the USPTO patent dataset. The goal was to determine if specific reagents would yield a desired product.

A crucial comparison involved a conventional password-locked backdoor, which typically represents a hidden capability in current safety research. After just 500 steps of fine-tuning, this ordinary backdoor model achieved 92.8% accuracy, effectively revealing its secret. In stark contrast, the cryptographically locked version demonstrated remarkable resilience, resisting both the study's fine-tuning and weight-noise perturbation tests.

Despite its theoretical robustness, the practical implementation comes with an enormous cost. Hiding the compact 672-weight model necessitated a host model of approximately 2.07 billion parameters. Around 95% of these host parameters were dedicated solely to implementing the Keccak hash circuitry, translating to roughly three million host parameters for every single hidden weight.

The researchers confirmed that individual components worked when dropped into the Gemma 3 270M parameter model, but they did not embed the complete system into a real, pretrained LLM. This research, detailed further in AI Models Can Provably Hide Arbitrary Capabilities, highlights a profound challenge for current safety evaluation methodologies.

Security claim: a 128-bit trigger and full 24-round Keccak hash function mean cryptographic strength secures the hidden network. Recovering the secret without its key would require breaking the hash, a computational impossibility with current technology. This research does not claim every real-world model can hide arbitrary skills; rather, it demonstrates a novel method for provable concealment.

This finding carries a stark warning for models with third-party weights or compromised training pipelines. Behavioral tests alone cannot establish what a model contains or where its weights originated. A cryptographically locked network remains inert and indistinguishable from random noise without the precise key.

To counter this, a defense-in-depth strategy becomes critical. Auditors must inspect weight distributions and structural anomalies, verify end-to-end provenance of model components, and treat behavioral evaluations as one layer of safety, not as proof of absence for hidden capabilities. This approach is essential for robust AI security.

How can an AI model hide another neural network?

Researchers compiled a cryptographic hash function into model layers, using it to unlock and execute encrypted network weights only when given the correct trigger.

Can ordinary safety tests detect the hidden capability?

In the proof of concept, standard elicitation and fine-tuning did not reveal the cryptographically locked capability. Static analysis of unusual weight patterns may still raise suspicion.

Is this practical for hiding a large AI model today?

Not yet. Hiding a 672-weight network required a host with about 2.07 billion parameters, making the approach extremely inefficient.

What should AI model auditors do differently?

Combine behavioral testing with weight-structure analysis and stronger verification of training data, model provenance, and the supply chain.